Nagios Support Forum

Hi lmiltchev,

I did ssh from my client server to Nagios Xi Server and ran the below commands. Please find the output:

ip addr after ssh:
================================
[root@cr2prd131 ~]# ssh dc1prd484
root@dc1prd484's password:
Last login: Thu Dec 19 17:17:02 2019 from dc2win7p018.tower.lan
[root@dc1prd484 ~]# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 00:50:56:b9:68:be brd ff:ff:ff:ff:ff:ff
inet 10.129.1.66/24 brd 10.129.1.255 scope global noprefixroute ens33
valid_lft forever preferred_lft forever
inet6 fe80::a44:a9ab:b5d6:aa72/64 scope link noprefixroute
valid_lft forever preferred_lft forever
==============================================================================

nmap 10.42.162.136 -p 5666
========================================
[root@dc1prd484 ~]# nmap 10.42.162.136 -p 5666

Starting Nmap 6.47 ( http://nmap.org ) at 2019-12-19 18:04 AEDT
Nmap scan report for cr2prd131.tower.lan (10.42.162.136)
Host is up (0.011s latency).
PORT STATE SERVICE
5666/tcp open nrpe

Nmap done: 1 IP address (1 host up) scanned in 0.09 seconds
===================================================================

/usr/local/nagios/libexec/check_nrpe -H 10.42.162.136
=====================================================================
[root@dc1prd484 ~]# /usr/local/nagios/libexec/check_nrpe -H 10.42.162.136
CHECK_NRPE: Error - Could not connect to 10.42.162.136: Connection reset by peer
====================================

I did force check also but there is not change in state of alerts. Please help me

Regards,
Srinija.

This is very strange - 5666 port is open, the IP address of your Nagios XI server is added to the "allowed_hosts" line in nrpe.cfg, but you are still getting the "Connection reset by peer" error...

Have you restarted the xinetd and NRPE after removing the /etc/xinetd.d/nrpe file?

Run the following commands on the client, remote machine and show the output:

Hi lmiltchev,

Please find the output of the mentioned commands and help me. I am unable to find the solution for this

1: find / -name '*nrpe*'
/run/nrpe
/sys/fs/cgroup/systemd/system.slice/nrpe.service
/etc/systemd/system/multi-user.target.wants/nrpe.service
/root/nrpe-3.2.1.tar.gz
/root/nrpe-3.2.1
/root/nrpe-3.2.1/contrib/README.nrpe_check_control
/root/nrpe-3.2.1/contrib/nrpe_check_control.c
/root/nrpe-3.2.1/include/nrpe.h
/root/nrpe-3.2.1/nrpe.spec.in
/root/nrpe-3.2.1/sample-config/nrpe.cfg.in
/root/nrpe-3.2.1/sample-config/nrpe.cfg
/root/nrpe-3.2.1/src/check_nrpe.c
/root/nrpe-3.2.1/src/nrpe.c
/root/nrpe-3.2.1/src/nrpe
/root/nrpe-3.2.1/src/check_nrpe
/root/nrpe-3.2.1/nrpe.spec
/var/tmp/systemd-private-7c2c1cde50b54772a50fc189b393d03e-nrpe.service-gsKhnP
/tmp/systemd-private-7c2c1cde50b54772a50fc189b393d03e-nrpe.service-lxLqYh
/usr/lib/systemd/system/nrpe.service
/usr/lib/tmpfiles.d/nrpe.conf
/usr/lib/firewalld/services/nrpe.xml
/usr/local/nagios/libexec/check_nrpe
/usr/local/nagios/bin/nrpe-uninstall
/usr/local/nagios/bin/nrpe
/usr/local/nagios/var/nrpe.pid
/usr/local/nagios/etc/nrpe.cfg
=======================================================
2: /usr/local/nagios/bin/nrpe -V
NRPE - Nagios Remote Plugin Executor
Version: 3.2.1
==================================================================
3: /usr/local/nagios/libexec/check_nrpe -H 127.0.0.1
NRPE v3.2.1
=================================================================
4: /usr/local/nagios/libexec/check_nrpe -H 10.129.1.66
connect to address 10.129.1.66 port 5666: Connection refused
connect to host 10.129.1.66 port 5666: Connection refused


Regards,
Srinija.

The last command I asked you to run was irrelevant (wrong) - I meant something else, my bad. The check_nrpe works fine though, when run locally. The Nagios XI server's IP is also added to nrpe.cfg. The port is open, so the only reason why this is not working would be if you had some other restrictions on this system. Are you by chance using TCP wrappers on this box? Do you have anything in the "/etc/hosts.allow" or in "/etc/hosts.deny" files?

Hi lmiltchev,

I have checked teh below mentioned hosts, hosts.allow, and hosts.deny config files but couldn't find any mistake iver there.

[root@cr2prd131 etc]# ls -l|grep hosts
-rw-r--r--. 1 root root 202 Nov 26 13:30 hosts
-rw-r--r--. 1 root root 370 Jun 8 2013 hosts.allow
-rw-r--r--. 1 root root 460 Jun 8 2013 hosts.deny
[root@cr2prd131 etc]# cat hosts.allow
#
# hosts.allow This file contains access rules which are used to
# allow or deny connections to network services that
# either use the tcp_wrappers library or that have been
# started through a tcp_wrappers-enabled xinetd.
#
# See 'man 5 hosts_options' and 'man 5 hosts_access'
# for information on rule syntax.
# See 'man tcpd' for information on tcp_wrappers
#
[root@cr2prd131 etc]# cat hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
10.42.162.136 cr2prd131.tower.lan cr2prd131
[root@cr2prd131 etc]# cat hosts.deny
#
# hosts.deny This file contains access rules which are used to
# deny connections to network services that either use
# the tcp_wrappers library or that have been
# started through a tcp_wrappers-enabled xinetd.
#
# The rules in this file can also be set up in
# /etc/hosts.allow with a 'deny' option instead.
#
# See 'man 5 hosts_options' and 'man 5 hosts_access'
# for information on rule syntax.
# See 'man tcpd' for information on tcp_wrappers
#
[root@cr2prd131 etc]#


Please check and help me.

Regards,
Srinija.

Hi @Srinija544

Thank you for your patience, a couple more questions regarding this issue.

1. How many remote hosts are you monitoring with NRPE? If more than one, are you gettings results from the others?

2. Are you certain you restarted the NRPE service on the remote host ( IP address ending in 136)?

3. Which server is cr2prd131.tower.lan cr2prd13?

Hi benjaminsmith,

1. we have so many hosts in our environment but all the hosts are fine in Nagios except cr2prd131.

2. I have restarted NRPE Service for the IP ending with 136 but this doesn't help me.

3. cr2prd131.tower.lan is the server which we are using.

Please help me if there is any possibilities to solve this issue.

Regards,
Srinija.

Do you know if there is a firewall between your Nagios server and cr2prd131? My thought is that there could be a firewall doing packet inspection and rejecting NRPE commands. Exceptions would then be made for servers known to be monitored using NRPE, which would explain why all of your other servers are able to be monitored with NRPE.

Also, can you try /usr/local/nagios/libexec/check_nrpe -H 10.42.162.136 -n Usually we get a different error when one side expect SSL, and the other side does not, but it's worth checking just in case.

Hi All,

Thank you all for your kind help.

I did a small mistake in NRPE file. We have to place , between IP's in nrpe.cfg

Now i have corrected it. All alerts are fine now.

I am very happy to close this request with all your help.

Thanks and Regards,
Srinija.

I am glad your issue has been resolved! I am closing this topic now.