Nagios Support Forum

dwhitfield wrote:I am really confused about what is going on. Could you help clear some things up?

First off, you posted in "Core" but are using XI version #s.

What are the OSes on the servers you are checking against? You have some xinetd stuff and some NSClient stuff. If you are having issues with Windows servers and with Linux servers I would suggest breaking those into different threads. I was thinking you were running NSClient on Linux, but your first post has all sorts of windows-specific stuff.

If you are restarting xinetd on the XI server, then that has nothing to do with anything (unless you are monitoring one XI server with the other XI server). check_nrpe on the XI server talks to nrpe on the client machine.

If this is XI, can you PM me profiles from each system? You can download a profile by going to Admin > System Config > System Profile and click the ***Download Profile*** button in the top right corner. *If* for whatever reason you cannot download the profile, please put the output of View System Info (5.3.4+, Show Profile if older). This will give us access to many of the logs we would otherwise ask for individually. If security is a concern, you can unzip the profile take out what you like, and then zip it up again. We may end up needing something you remove, but we can ask for that specifically.

You can also generate a profile manually using the script at /usr/local/nagiosxi/html/includes/components/profile/getprofile.sh

That should generate a profile in /usr/local/nagiosxi/var/components/ which you can get off the server with an application such as FileZilla.

If you get an error that PROFILE BUILD FAILED, please see https://support.nagios.com/kb/article.p ... ategory=44

is check_nrpe not part of core?

[/settings/NRPE/server]

; VERIFY MODE - Comma separated list of verification flags to set on the SSL socket.  default-workarounds  Various workarounds for what I understand to be broken ssl implementations no-sslv2  Do not use the SSLv2 protocol. no-sslv3  Do not use the SSLv3 protocol. no-tlsv1  Do not use the TLSv1 protocol. single-dh-use  Always create a new key when using temporary/ephemeral DH parameters. This option must be used to prevent small subgroup attacks, when the DH parameters were not generated using "strong" primes (e.g. when using DSA-parameters).   
ssl options = 

; VERIFY MODE - Comma separated list of verification flags to set on the SSL socket.  none  The server will not send a client certificate request to the client, so the client will not send a certificate. peer  The server sends a client certificate request to the client and the certificate returned (if any) is checked. fail-if-no-cert  if the client did not return a certificate, the TLS/SSL handshake is immediately terminated. This flag must be used together with peer. peer-cert  Alias for peer and fail-if-no-cert. workarounds  Various bug workarounds. single  Always create a new key when using tmp_dh parameters. client-once  Only request a client certificate on the initial TLS/SSL handshake. This flag must be used together with verify-peer   
verify mode = none

; ALLOW INSECURE CHIPHERS and ENCRYPTION - Only enable this if you are using legacy check_nrpe client.
insecure = true
allow arguments = true
allow nasty characters = true

; ENABLE SSL ENCRYPTION - This option controls if SSL should be enabled.
use ssl = 1

; PORT NUMBER - Port to use for NRPE.
port = 5666

dwhitfield wrote:I would suggest submitting a ticket at https://support.nagios.com/tickets/ so we can take a closer look at the issue.