Page 2 of 4

Re: Unknown command: $ in using check_eventlog with check_nr

Posted: Fri Dec 14, 2018 4:58 pm
by scottwilkerson
raydx wrote:In re to "what you have configured for check_nrpe in the GUI", which file are you referring to?
In the GUI Configuration -> Select Commands
What does it say by check_nrpe ?
raydx wrote:In the CLI, in /usr/local/nagios/libexec$, I ran the command and CHECK_NRPE: Receive header underflow - only 0 bytes received (4 expected).
This looks like check_nrpe may not even be able to communicate with your nsclient machine, do you get anything with just this

Code: Select all

./check_nrpe - H 10.11.96.130
If not are you sure port 5666 is not being blocked by the Windows firewall?

Re: Unknown command: $ in using check_eventlog with check_nr

Posted: Fri Dec 14, 2018 5:34 pm
by raydx
In the GUI Configuration -> Select Commands for check_nrpe:
$USER1$/check_nrpe -H $HOSTADDRESS$ -t 120 -c $ARGS$
$USER1$/check_nrpe -H $HOSTADDRESS$ -t 120 -c (not an $ARGn$ index: "S")

Running ./check_nrpe - H 10.11.96.130 does return NRPE v3.2.1

I don't think it is an firewall issue as other checks are functioning.

Re: Unknown command: $ in using check_eventlog with check_nr

Posted: Fri Dec 14, 2018 5:42 pm
by scottwilkerson
danjoh wrote:

Code: Select all

# 'check_nrpe' command definition
define command{
	command_name    check_nrpe
	command_line    $USER1$/check_nrpe -H $HOSTADDRESS$ -t 120 -c $ARG1$ -a $ARG2$
	}
as stated before you need to change the command to the above
raydx wrote:Running ./check_nrpe - H 10.11.96.130 does return NRPE v3.2.1
This doesn't seem quite right, is 10.11.96.130 the windows machine?

Re: Unknown command: $ in using check_eventlog with check_nr

Posted: Fri Dec 14, 2018 5:59 pm
by raydx
commands.cfg updated and In the GUI Configuration:
$USER1$/check_nrpe -H $HOSTADDRESS$ -t 120 -c $ARGS$ -a $ARG2$

Status Information is NRPE Plugin for Nagios which is not correct.

10.11.96.130 is the Nagios Server running on Ubuntu v16.04

Re: Unknown command: $ in using check_eventlog with check_nr

Posted: Fri Dec 14, 2018 6:02 pm
by scottwilkerson
raydx wrote:commands.cfg updated and In the GUI Configuration:
$USER1$/check_nrpe -H $HOSTADDRESS$ -t 120 -c $ARGS$ -a $ARG2$
This is still incorrect, it needs to be

Code: Select all

$USER1$/check_nrpe -H $HOSTADDRESS$ -t 120 -c $ARG1$ -a $ARG2$
You want to run the command using the Windows servers IP not the Nagios servers IP

Re: Unknown command: $ in using check_eventlog with check_nr

Posted: Fri Dec 14, 2018 6:18 pm
by raydx
Ok, now the GUI Configuration does show:
$USER1$/check_nrpe -H $HOSTADDRESS$ -t 120 -c $ARG1$ -a $ARG2$

On the Windows Server machine and using nscp, do I run ./check_nrpe - H 10.11.103.104 or
check_nrpe -H 10.11.103.104?

Thanks again for your assistance.

Re: Unknown command: $ in using check_eventlog with check_nr

Posted: Mon Dec 17, 2018 8:11 am
by scottwilkerson
If 10.11.103.104 is the Windows server you would run the following from the Nagios server

Code: Select all

./check_nrpe -H 10.11.103.104

Re: Unknown command: $ in using check_eventlog with check_nr

Posted: Mon Dec 17, 2018 12:04 pm
by raydx
Running ./check_nrpe -H 10.11.103.104 returns:
I (0.5.2.35 2018-01-28) seem to be doing fine...

In the Nagios console for the check_eventlog services, I'm now seeing:
Invalid command line: unrecognised option '-a'

Re: Unknown command: $ in using check_eventlog with check_nr

Posted: Mon Dec 17, 2018 12:37 pm
by scottwilkerson
raydx wrote:Running ./check_nrpe -H 10.11.103.104 returns:
I (0.5.2.35 2018-01-28) seem to be doing fine...
Ok, good, this looks like what we would expect

Lets run this

Code: Select all

./check_nrpe - H 10.11.103.104 -t 30 -c check_eventlog -a "filter=provider = 'Application Error' and id = 1000 and message like 'Spacelabs.SLNIService.exe'" 
If you still get
raydx wrote:Invalid command line: unrecognised option '-a'
Lets show the output of this

Code: Select all

./check_nrpe -h

Re: Unknown command: $ in using check_eventlog with check_nr

Posted: Mon Dec 17, 2018 1:14 pm
by raydx
I ran ./check_nrpe - H 10.11.103.104 -t 30 -c check_eventlog -a "filter=provider = 'Application Error' and id = 1000 and message like 'Spacelabs.SLNIService.exe'" and the following was returned:
OK: No entries found| 'problem_count'=0;0;0