Nagios Support Forum

Cool, I will leave this open for a couple of days. Please do not respond unless you have more information to add.

jdalrymple wrote:AIX 7.1 is supported, but as with all nrpe daemons, you will have to compile it on the platform yourself. We don't provide packaged binaries.

What rajasegar is referencing is a long-standing vulnerability in that nrpe uses weak SSL ciphers. We know about this and it is on our roadmap to resolve the issue.

http://tracker.nagios.org/view.php?id=90

Regarding Windows, I'm not sure what he's referencing, nsclient actually supports quite strong security.

http://blog.medin.name/blog/2012/12/02/ ... ntication/

Monitoring agent should be secure out of the box and nagios should not push the responsibility to the customer with the hassle to setup up CA and NSClient server.
The same applies to the agent binaries. Do you think all your customers have developers who are well versed in compiling the source?
Compiling nrpe on AIX is one of the most painful frustrating experience.

Back to the original question, Agent for AIX 6.0 works fine on 7.1 assuming you have all the libraries in place.

rajasegar wrote: Monitoring agent should be secure out of the box and nagios should not push the responsibility to the customer with the hassle to setup up CA and NSClient server.

We're aware of the issue and it's on the roadmap to fix, as JR said. In regards to setting up NSClient, I am not entirely sure what you want changed. If you do have suggestions for NSCient, the developers website is a good place for that feedback.

rajasegar wrote:The same applies to the agent binaries. Do you think all your customers have developers who are well versed in compiling the source?

We do not assume this. We provide documentation and scripts that do it for you, and then do our best to support customers/community members that are still having difficulties when the scripts and documentation don't meet their needs.

rajasegar wrote:Compiling nrpe on AIX is one of the most painful frustrating experience.

I do agree that it can be a pain. You can submit feedback/patches/pull requests on NRPE's GitHub page if you have anything to contribute. It is an open source project. We do not have all of these systems available in our environment to test versus, and everyone's installation is going to differ. We try to support the most common systems we can using our documentation/full install script.

rajasegar wrote: Back to the original question, Agent for AIX 6.0 works fine on 7.1 assuming you have all the libraries in place.

Thank you for that information. Having a community that helps each other out is what makes Nagios great.

hsmith wrote:

rajasegar wrote: Monitoring agent should be secure out of the box and nagios should not push the responsibility to the customer with the hassle to setup up CA and NSClient server.

We're aware of the issue and it's on the roadmap to fix, as JR said. In regards to setting up NSClient, I am not entirely sure what you want changed. If you do have suggestions for NSCient, the developers website is a good place for that feedback.

rajasegar wrote:The same applies to the agent binaries. Do you think all your customers have developers who are well versed in compiling the source?

We do not assume this. We provide documentation and scripts that do it for you, and then do our best to support customers/community members that are still having difficulties when the scripts and documentation don't meet their needs.

rajasegar wrote:Compiling nrpe on AIX is one of the most painful frustrating experience.

I do agree that it can be a pain. You can submit feedback/patches/pull requests on NRPE's GitHub page if you have anything to contribute. It is an open source project. We do not have all of these systems available in our environment to test versus, and everyone's installation is going to differ. We try to support the most common systems we can using our documentation/full install script.

rajasegar wrote: Back to the original question, Agent for AIX 6.0 works fine on 7.1 assuming you have all the libraries in place.

Thank you for that information. Having a community that helps each other out is what makes Nagios great.

The problem is check_nrpe and not NSClient.
Here is the extract from the website

Deprecated insecure legacy check_nrpe SSL
If you are using NRPE you are in for a chock!
In 0.4.3 we will no longer support the rather insecure regular NRPE!
You can still enable support but you have to do so (in the installer or using the command line mode).
So keep a heads up when you run the installer so you wont miss it.

The model you described is ok for Nagios Core but not Nagios XI.
Please put this comments below in the Nagios XI promo pages so that your customers are aware of this.
Customer is responsible for building/acquiring monitoring agents for all supported environments. Nagios will only provide technical support.

rajasegar wrote:Please put this comments below in the Nagios XI promo pages so that your customers are aware of this.Customer is responsible for building/acquiring monitoring agents for all supported environments. Nagios will only provide technical support.

While largely the above statement is true, it's important to realize that 9 out of 10 of our users aren't having trouble deploying the agents in their environment. The individual who I helped this week get NRPE up and running on his RHEL 2.1 server was ecstatic to have the support whereas you might find some of our competitors might say "sorry, we don't support 15 year old operating systems." As you can understand for some the statement you made is more promotional than detrimental.

Additionally if you go through our XI splash site at https://www.nagios.com/products/nagios-xi/ you won't find anywhere that we market AIX, HP/UX, AS400, MIPS, DOS, etc as supported operating systems. The promotional site is not intended to be an all encompassing information source for our product and we do hope that you contact us about your monitoring application prior to purchase. If you do we will not only boast that we can monitor just about any platform, we will also explain the requirements and processes for those various platforms ad nauseam.

Distributing binaries is a can of worms:
1) The obvious cost of pSeries, iSeries, Nonstop, Itanium, etc hardware to run all the platforms not to mention the floor space.
2) Corollary to #1 - how far back are we providing binaries for? Today I'll happily support you building your own nrpe on your HP-UX 10.20 system (this happened also just this week). If you want that continued level of support I have to buy a pSeries capable of running enough LPARs for 7.1, 6.1, 5.3, 5.2, 4.3 ... etc.
3) What happens when IBM releases a new SP that updates OpenSSL? nrpe breaks and your pager goes off... (I understand that this is something we should resolve in the code, but as of today's code - this is how it is). Incidentally I have a 7.1 binary on my workstation here that I could distribute, but I don't trust it to work on your system and neither should you.

Right now it is double-click simple to install nrpe on 98% of the machines it goes on. The financial investment required to get us to 99.9% would likely quadruple our technology costs (which gets passed on in XI licensing costs) all to benefit a very few people who are unfamiliar with compiling binaries on their platform. Also - rest assured there is no way to get to 100%, don't you agree? In order to get to 100% we'd have to put an actual limit on what we say we can monitor. Today we prefer to be unlimited as a company and simply put the limitations in the hands of our user's knowledge and ambition.

With all that said, this thread is in the NagiosXI Customer forum and is intended to help resolve technical problems. This is not the forum for realigning our marketing strategy, that would be [email protected]. Thank you for your earlier contribution and please to keep this on topic only reply if you have more information that might be useful to the OP's question. You can count on your comments being brought to company administration and the marketing folks, however if you would like to continue to comment about inaccuracies in our promotional material or other topics unrelated to answering the OP's question please feel free to PM myself or any of the other green names and/or E-mail sales.

Thanks

You might also consider the NCPA agent. We have ported it to Solaris 10 (unofficially), so I know you can build it for other architectures. It's Python based and I feel is superior to the NRPE agent in that it incorporates both active and passive checking in a single agent architecture, as well as providing a very nice GUI interface on the monitored host and access to monitored host data from non-Nagios clients via HTTPS.

The NCPA agent is officially released only for Windows and Linux. Porting to another operating system would probably take a couple of weeks to do, although AIX might prove easier than Solaris was.

The NCPA agent operates pretty much like the NRPE agent for active checks and can run the same plugins.

... and is secured with https

Thanks mp4783

To be honest, the NCPA agent has a superior feature set to NRPE, but momentum being what it is, most go with NRPE. I'm trying to push us toward NCPA despite it's lack of support for anything (officially) other than Windows and Linux.

The Solaris port that we did involved a lot of work primarily due to a bug (lack of feature?) in an underlying Python module. The resulting agent appears to be stable and function as you would expect.

AIX could be a slam dunk if you don't run into the same problems we had and if you've got Python experience (which we didn't really, but learned).

mp4783 wrote:To be honest, the NCPA agent has a superior feature set to NRPE, but momentum being what it is, most go with NRPE. I'm trying to push us toward NCPA despite it's lack of support for anything (officially) other than Windows and Linux.

The Solaris port that we did involved a lot of work primarily due to a bug (lack of feature?) in an underlying Python module. The resulting agent appears to be stable and function as you would expect.

AIX could be a slam dunk if you don't run into the same problems we had and if you've got Python experience (which we didn't really, but learned).

Exceprt from Nagios Exchange

Their github site appears to be completely inactive though, and support questions are going unanswered. If the project isn't dead, someone needs to speak up, otherwise we're going to have to switch back to NSClient++.

Does this need any python runtime installed in the client machine?

NCPA is in its infancy, NRPE is mature. Right now the NCPA product is in bugfix mode only as the company seeks out the new python developer (Nagios Enterprises employee as it were) to continue it's development. The original primary developer is no longer with the company. Of course it's also open source so any community pull requests for furthering the product are reviewed and considered.

Regarding the project appearing dead... the last commit was just prior to us hunkering down for the XI5 release. We all agree that it's not ideal that other projects are a bit ignored during the XI5 build and release, you have to understand XI5 is the flagship product, and version 5 has been arguably the single biggest release since the product was first released. Everyone in the company had their hands on it. I'll kindly ask jomann to look over the issues in GitHub and respond as he sees fit.

As for the python runtime, NCPA has a binary installer for all supported platforms that loads the necessary runtime and static libraries as needed. As mp4783 indicated can be compiled to run on "non supported" platforms.