Too many NRPE Connection

[dhinesh]

Hi,
I have implemented monitoring through NRPE. The Nagios is making around 20 NRPE connections on the node., every minute.
Check_Interval is 5mins. All the services are in OK state.

[tmcdonald]

What do you mean by "connections"? Are you talking about packets? TCP connections?

[dhinesh]

I mean to say TCP connections.

[slansing]

How many services are set up to actively check this host via NRPE? Do you perhaps have freshness enabled?

[dhinesh]

There are around 20 services to actively check the host.
The fresheness check is not enabled.

[technick]

I'm still learning nagios, so take this advice with a grain of salt.

How do you know how many connections are being opened per minute vs already established connections?

Are you running custom commands over nrpe that might keep the connection open and if so, have you changed the default timeout value for nrpe?

Have you changed any of the values in your nagios.cfg from the defaults? If so, which have you changed?

I'd start with getting these three questions answered, hopefully this might lead us to the cause.

[tmcdonald]

technick pretty much hit the nail on the head.

If you have a lot of NRPE checks going, some of those connections might not properly close and appear as open.

Run "netstat -an" on the Nagios server while you see this high number of NRPE connections, and post the output here. Then we can see how many of the connections are ESTABLISHED, CONNECTED, etc.

[dhinesh]

Hi tmcdonald,
Below is output for netstat -an.
-bash-3.2$ netstat -an | grep 5666
tcp 0 0 *.5666 *.* LISTEN

[dhinesh]

Hi technick,

1.How do you know how many connections are being opened per minute vs already established connections?
I was checking the logs for the open connections. Below is the snipet from the logs.
Mar 6 11:24:48 riker inetd[24243]: nrpe/tcp: Connection from chcrsoch601 (172.19.166.78) at Thu Mar 6 11:24:48 2014
Mar 6 11:24:48 riker inetd[24247]: nrpe/tcp: Connection from chcrsoch601 (172.19.166.78) at Thu Mar 6 11:24:48 2014
Mar 6 11:24:48 riker inetd[24248]: nrpe/tcp: Connection from chcrsoch601 (172.19.166.78) at Thu Mar 6 11:24:48 2014
Mar 6 11:24:48 riker inetd[24252]: nrpe/tcp: Connection from chcrsoch601 (172.19.166.78) at Thu Mar 6 11:24:48 2014
Mar 6 11:24:49 riker inetd[24259]: nrpe/tcp: Connection from chcrsoch601 (172.19.166.78) at Thu Mar 6 11:24:49 2014

2.Are you running custom commands over nrpe that might keep the connection open and if so, have you changed the default timeout value for nrpe?
No..
3.Have you changed any of the values in your nagios.cfg from the defaults? If so, which have you changed?
No.

[slansing]

Another thing to look into, how do the current, and next check scheduled times look compared to each other in Home > Service Detail > (host ---> service(s)). It is possible that they are all being scheduled at about the same time, though I agree it is strange that these connections are all made on roughly the same second.