/var/log/messages is full of nrpe start and exit messages

[a45634]

I have noticed that we are logging multiple nrpe start and exit messages each minute on the client machines. I have confirmed we have the dont_blame_nagios set to 1. I restarted the xinetd service. I confirmed the nagios server IP address in defined properly in the /etc/xinetd.d/nrpe file's only_from setting. Nagios is monitoring the hosts. I just wonder about all of these messages in the log.

grep dont_blame_nrpe /usr/local/nagios/etc/nrpe.cfg
dont_blame_nrpe=1
grep only_from /etc/xinetd.d/nrpe
only_from = 10.201.32.11

Here are some of the messages from one of our servers. They appear on all of our rhel servers that we are monitoring.
Mar 11 21:13:00 edcxlinuxutil xinetd[21631]: START: nrpe pid=15634 from=10.201.32.11
Mar 11 21:13:00 edcxlinuxutil xinetd[21631]: EXIT: nrpe status=0 pid=15634 duration=0(sec)
Mar 11 21:13:12 edcxlinuxutil xinetd[21631]: START: nrpe pid=15637 from=10.201.32.11
Mar 11 21:13:12 edcxlinuxutil xinetd[21631]: EXIT: nrpe status=0 pid=15637 duration=0(sec)
Mar 11 21:13:21 edcxlinuxutil xinetd[21631]: START: nrpe pid=15640 from=10.201.32.11
Mar 11 21:13:21 edcxlinuxutil xinetd[21631]: START: nrpe pid=15641 from=10.201.32.11
Mar 11 21:13:21 edcxlinuxutil xinetd[21631]: EXIT: nrpe status=0 pid=15641 duration=0(sec)
Mar 11 21:13:21 edcxlinuxutil xinetd[21631]: EXIT: nrpe status=0 pid=15640 duration=0(sec)
Mar 11 21:14:30 edcxlinuxutil xinetd[21631]: START: nrpe pid=15722 from=10.201.32.11
Mar 11 21:14:30 edcxlinuxutil xinetd[21631]: EXIT: nrpe status=0 pid=15722 duration=0(sec)
Mar 11 21:14:42 edcxlinuxutil xinetd[21631]: START: nrpe pid=15725 from=10.201.32.11
Mar 11 21:14:42 edcxlinuxutil xinetd[21631]: EXIT: nrpe status=0 pid=15725 duration=0(sec)
Mar 11 21:14:46 edcxlinuxutil xinetd[21631]: START: nrpe pid=15728 from=10.201.32.11
Mar 11 21:14:46 edcxlinuxutil xinetd[21631]: EXIT: nrpe status=0 pid=15728 duration=0(sec)
Mar 11 21:15:01 edcxlinuxutil xinetd[21631]: START: nrpe pid=15740 from=10.201.32.11
Mar 11 21:15:01 edcxlinuxutil xinetd[21631]: EXIT: nrpe status=0 pid=15740 duration=0(sec)
Mar 11 21:15:05 edcxlinuxutil xinetd[21631]: START: nrpe pid=15772 from=10.201.32.11
Mar 11 21:15:05 edcxlinuxutil xinetd[21631]: EXIT: nrpe status=0 pid=15772 duration=0(sec)
Mar 11 21:15:06 edcxlinuxutil xinetd[21631]: START: nrpe pid=15785 from=10.201.32.11
Mar 11 21:15:06 edcxlinuxutil xinetd[21631]: EXIT: nrpe status=0 pid=15785 duration=0(sec)

[abrist]

I have noticed that we are logging multiple nrpe start and exit messages each minute on the client machines.

It looks more like a bunch of checks, run every 5 minutes. This is wai, including the start/stops as they should be logged every time an active check is received.

[a45634]

Just to be clear. You are indicating the messages are expected behavior. Are you saying that running checks every 5 minutes is not a typical strategy? I am also unclear what the term WAI means.

[tmcdonald]

WAI = Working As Intended.

Everything appears to be normal in those logs. Checking every 5 minutes is standard.

[a45634]

Thank you for the confirmation!

[slansing]

We're going to go ahead and lock this thread up, let us know if you have further questions on this!