Page 2 of 4

Re: NRPE sudo on RHEL 8

Posted: Mon Jul 06, 2020 1:42 pm
by drakedts
Hello! Here are the mounts you wanted to see:

Code: Select all

# mount | grep nosuid
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
devtmpfs on /dev type devtmpfs (rw,nosuid,size=4063336k,nr_inodes=1015834,mode=755)
securityfs on /sys/kernel/security type securityfs (rw,nosuid,nodev,noexec,relatime)
tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000)
tmpfs on /run type tmpfs (rw,nosuid,nodev,mode=755)
tmpfs on /sys/fs/cgroup type tmpfs (ro,nosuid,nodev,noexec,mode=755)
cgroup on /sys/fs/cgroup/systemd type cgroup (rw,nosuid,nodev,noexec,relatime,xattr,release_agent=/usr/lib/systemd/systemd-cgroups-agent,name=systemd)
pstore on /sys/fs/pstore type pstore (rw,nosuid,nodev,noexec,relatime)
efivarfs on /sys/firmware/efi/efivars type efivarfs (rw,nosuid,nodev,noexec,relatime)
bpf on /sys/fs/bpf type bpf (rw,nosuid,nodev,noexec,relatime,mode=700)
cgroup on /sys/fs/cgroup/perf_event type cgroup (rw,nosuid,nodev,noexec,relatime,perf_event)
cgroup on /sys/fs/cgroup/memory type cgroup (rw,nosuid,nodev,noexec,relatime,memory)
cgroup on /sys/fs/cgroup/net_cls,net_prio type cgroup (rw,nosuid,nodev,noexec,relatime,net_cls,net_prio)
cgroup on /sys/fs/cgroup/cpu,cpuacct type cgroup (rw,nosuid,nodev,noexec,relatime,cpu,cpuacct)
cgroup on /sys/fs/cgroup/devices type cgroup (rw,nosuid,nodev,noexec,relatime,devices)
cgroup on /sys/fs/cgroup/pids type cgroup (rw,nosuid,nodev,noexec,relatime,pids)
cgroup on /sys/fs/cgroup/freezer type cgroup (rw,nosuid,nodev,noexec,relatime,freezer)
cgroup on /sys/fs/cgroup/cpuset type cgroup (rw,nosuid,nodev,noexec,relatime,cpuset)
cgroup on /sys/fs/cgroup/blkio type cgroup (rw,nosuid,nodev,noexec,relatime,blkio)
cgroup on /sys/fs/cgroup/hugetlb type cgroup (rw,nosuid,nodev,noexec,relatime,hugetlb)
cgroup on /sys/fs/cgroup/rdma type cgroup (rw,nosuid,nodev,noexec,relatime,rdma)
tmpfs on /run/user/1000 type tmpfs (rw,nosuid,nodev,relatime,size=816100k,mode=700,uid=1000,gid=1000)
I am running the same version of check_jvm. If i add the "-x" to bash, nothing changes when calling it from the XI server:

Code: Select all

# /usr/local/nagios/libexec/check_nrpe -H lnx-ethosapi2-test -u -t 30 -c tomcat_heap
UNKNOWN Can't connect to the JVM: 
If i run it from the command line on the Tomcat server i get something a bit more interesting though:

Code: Select all

# su - nrpe
Last login: Fri Jul  3 00:29:43 CDT 2020 on pts/0
$ /usr/bin/sudo -u tomcat8 /usr/lib64/nagios/plugins/check_jvm -n org.apache.catalina.startup.Bootstrap -p heap -w 90 -c 101
+ JVMINSPECTOR=/usr/local/libexec/JvmInspector.jar
+ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+ PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+ export ENV=
+ ENV=
+ export CDPATH=
+ CDPATH=
+ STATE_OK=0
+ STATE_WARNING=1
+ STATE_CRITICAL=2
+ STATE_UNKNOWN=3
+ MSG_OK=OK
+ MSG_WARNING=WARNING
+ MSG_CRITICAL=CRITICAL
+ MSG_UNKNOWN=UNKNOWN
++ basename /usr/lib64/nagios/plugins/check_jvm
+ SCRIPT_NAME=check_jvm
+ '[' 8 -eq 0 ']'
+ '[' '!' -z -n ']'
+ case $1 in
+ shift
+ NAME=org.apache.catalina.startup.Bootstrap
+ shift
+ '[' '!' -z -p ']'
+ case $1 in
+ shift
+ PROPERTY=heap
+ shift
+ '[' '!' -z -w ']'
+ case $1 in
+ shift
+ WARNING=90
+ shift
+ '[' '!' -z -c ']'
+ case $1 in
+ shift
+ CRITICAL=101
+ shift
+ '[' '!' -z '' ']'
+ '[' -z org.apache.catalina.startup.Bootstrap ']'
+ '[' -z heap ']'
+ '[' -z 90 ']'
+ '[' -z 101 ']'
+ expr 90 : '[0-9]\+$'
+ expr 101 : '[0-9]\+$'
+ '[' -f /usr/local/libexec/JvmInspector.jar ']'
++ ps axo pid,uid,command
++ grep '[j]ava'
++ grep org.apache.catalina.startup.Bootstrap
++ head -1
+ PSLINE='  10742   982 /usr/lib/jvm/jre/bin/java -Xms6144M -Xmx6144M -classpath /usr/share/tomcat8/bin/bootstrap.jar:/usr/share/tomcat8/bin/tomcat-juli.jar: -Dcatalina.base=/usr/share/tomcat8 -Dcatalina.home=/usr/share/tomcat8 -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/cache/tomcat8/temp -Djava.util.logging.config.file=/usr/share/tomcat8/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager org.apache.catalina.startup.Bootstrap start'
++ echo 10742 982 /usr/lib/jvm/jre/bin/java -Xms6144M -Xmx6144M -classpath /usr/share/tomcat8/bin/bootstrap.jar:/usr/share/tomcat8/bin/tomcat-juli.jar: -Dcatalina.base=/usr/share/tomcat8 -Dcatalina.home=/usr/share/tomcat8 -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/cache/tomcat8/temp -Djava.util.logging.config.file=/usr/share/tomcat8/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager org.apache.catalina.startup.Bootstrap start
++ awk '{print $1}'
+ PID=10742
++ echo 10742 982 /usr/lib/jvm/jre/bin/java -Xms6144M -Xmx6144M -classpath /usr/share/tomcat8/bin/bootstrap.jar:/usr/share/tomcat8/bin/tomcat-juli.jar: -Dcatalina.base=/usr/share/tomcat8 -Dcatalina.home=/usr/share/tomcat8 -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/cache/tomcat8/temp -Djava.util.logging.config.file=/usr/share/tomcat8/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager org.apache.catalina.startup.Bootstrap start
++ awk '{print $2}'
+ PUID=982
+ '[' -z 10742 ']'
+ expr 10742 : '[0-9]\+$'
+ '[' 982 = 982 ']'
+ TIMEOUT=
+ timeout --version
+ TIMEOUT='timeout 7'
++ timeout 7 java -jar /usr/local/libexec/JvmInspector.jar 10742
+ JVMDATA='
JVM pid: 10742
  name: org.apache.catalina.startup.Bootstrap start
  thread count: 27 (peak: 29)
  class count: 2739
  heap memory: max=6174015488|commited=6174015488|used=676473512
  non-heap memory: max=-1|commited=26673152|used=25549688
  java version: 1.8.0_252 (Oracle Corporation)
  java home: /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.252.b09-3.el8_2.x86_64/jre
  jvm arguments: [-Xms6144M, -Xmx6144M, -Dcatalina.base=/usr/share/tomcat8, -Dcatalina.home=/usr/share/tomcat8, -Djava.endorsed.dirs=, -Djava.io.tmpdir=/var/cache/tomcat8/temp, -Djava.util.logging.config.file=/usr/share/tomcat8/conf/logging.properties, -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager]
  class path: /usr/share/tomcat8/bin/bootstrap.jar:/usr/share/tomcat8/bin/tomcat-juli.jar:
  server container: Apache Tomcat/8.5.56
  active sessions: total=0|/=0'
+ '[' 0 -ne 0 ']'
+ echo '
JVM pid: 10742
  name: org.apache.catalina.startup.Bootstrap start
  thread count: 27 (peak: 29)
  class count: 2739
  heap memory: max=6174015488|commited=6174015488|used=676473512
  non-heap memory: max=-1|commited=26673152|used=25549688
  java version: 1.8.0_252 (Oracle Corporation)
  java home: /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.252.b09-3.el8_2.x86_64/jre
  jvm arguments: [-Xms6144M, -Xmx6144M, -Dcatalina.base=/usr/share/tomcat8, -Dcatalina.home=/usr/share/tomcat8, -Djava.endorsed.dirs=, -Djava.io.tmpdir=/var/cache/tomcat8/temp, -Djava.util.logging.config.file=/usr/share/tomcat8/conf/logging.properties, -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager]
  class path: /usr/share/tomcat8/bin/bootstrap.jar:/usr/share/tomcat8/bin/tomcat-juli.jar:
  server container: Apache Tomcat/8.5.56
  active sessions: total=0|/=0'
+ grep 'class count'
+ '[' heap = threads ']'
+ '[' heap = classes ']'
+ '[' heap = heap ']'
++ printf %s '
JVM pid: 10742
  name: org.apache.catalina.startup.Bootstrap start
  thread count: 27 (peak: 29)
  class count: 2739
  heap memory: max=6174015488|commited=6174015488|used=676473512
  non-heap memory: max=-1|commited=26673152|used=25549688
  java version: 1.8.0_252 (Oracle Corporation)
  java home: /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.252.b09-3.el8_2.x86_64/jre
  jvm arguments: [-Xms6144M, -Xmx6144M, -Dcatalina.base=/usr/share/tomcat8, -Dcatalina.home=/usr/share/tomcat8, -Djava.endorsed.dirs=, -Djava.io.tmpdir=/var/cache/tomcat8/temp, -Djava.util.logging.config.file=/usr/share/tomcat8/conf/logging.properties, -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager]
  class path: /usr/share/tomcat8/bin/bootstrap.jar:/usr/share/tomcat8/bin/tomcat-juli.jar:
  server container: Apache Tomcat/8.5.56
  active sessions: total=0|/=0'
++ awk 'BEGIN { FS = ": " } ;/^  heap memory/{print $2}'
+ TEMPDATA='max=6174015488|commited=6174015488|used=676473512'
++ printf %s 'max=6174015488|commited=6174015488|used=676473512'
++ awk 'BEGIN { FS="|" } {print $1}'
++ awk 'BEGIN { FS="=" } {print $2}'
+ MAX=6174015488
++ printf %s 'max=6174015488|commited=6174015488|used=676473512'
++ awk 'BEGIN { FS="|" } {print $2}'
++ awk 'BEGIN { FS="=" } {print $2}'
+ COMMITED=6174015488
++ printf %s 'max=6174015488|commited=6174015488|used=676473512'
++ awk 'BEGIN { FS="|" } {print $3}'
++ awk 'BEGIN { FS="=" } {print $2}'
+ USED=676473512
+ RESULT=676473512
++ echo 676473512
++ numfmt --to=iec
+ FRESULT=646M
+ PERFDATA='max=6174015488;;; commited=6174015488;;; used=676473512;;;'
+ '[' -z 676473512 ']'
+ expr 676473512 : '-\?[0-9]\+$'
+ '[' 676473512 -ge 101 ']'
+ p_critical '646M |max=6174015488;;; commited=6174015488;;; used=676473512;;;'
+ echo 'CRITICAL 646M |max=6174015488;;; commited=6174015488;;; used=676473512;;;'
CRITICAL 646M |max=6174015488;;; commited=6174015488;;; used=676473512;;;
+ exit 2
As an aside, please note that the CRITICAL response is an error; that's due to a known bug in the check_jvm script. I have a patched copy that reports correct results, but for testing purposes here i have reverted to the release version.

Re: NRPE sudo on RHEL 8

Posted: Tue Jul 07, 2020 6:39 pm
by ssax
Try changing this:

Code: Select all

TIMEOUT="timeout 7"
To this:

Code: Select all

TIMEOUT="timeout 30"
Does that help?

If not, try adding a debug line above this line:

Code: Select all

JVMDATA="$(${TIMEOUT} java -jar ${JVMINSPECTOR} ${PID} 2>&1)"
So it looks like this:

Code: Select all

echo "$JVMDATA"  # debug
JVMDATA="$(${TIMEOUT} java -jar ${JVMINSPECTOR} ${PID} 2>&1)"

Re: NRPE sudo on RHEL 8

Posted: Wed Jul 08, 2020 10:09 am
by drakedts
The extra timeout doesn't help (the check runs pretty fast, well under a second). And looks like the debug line just prints a blank. I see no uses of that variable earlier in the script though so i suppose that is expected behavior.

Code: Select all

# /usr/local/nagios/libexec/check_nrpe -H lnx-ethosapi2-test -u -t 30 -c tomcat_heap

UNKNOWN Can't connect to the JVM: 

Re: NRPE sudo on RHEL 8

Posted: Thu Jul 09, 2020 4:02 pm
by ssax
Try changing your sudoers entries to this to see if it resolves it:

Code: Select all

Defaults:tomcat8 !requiretty
Defaults:nrpe !requiretty
nrpe ALL=(ALL) NOPASSWD: ALL
nrpe ALL=(tomcat8) NOPASSWD: /usr/lib64/nagios/plugins/check_jvm *

Re: NRPE sudo on RHEL 8

Posted: Fri Jul 10, 2020 8:50 am
by drakedts
Adding the extra lines to sudoers on the Tomcat server had no effect.

Code: Select all

# /usr/local/nagios/libexec/check_nrpe -H lnx-ethosapi2-test -u -t 30 -c tomcat_heap
UNKNOWN Can't connect to the JVM:

Re: NRPE sudo on RHEL 8

Posted: Fri Jul 10, 2020 2:45 pm
by tgriep
Take a look at this post to see if the suggestions that were provided will work for you.
https://support.nagios.com/forum/viewto ... 0&start=30
Adjust the paths and the username to what your server is setup with.

Re: NRPE sudo on RHEL 8

Posted: Mon Jul 13, 2020 10:21 am
by drakedts
It's still not working. I can log in as the nrpe user and copy the check command from the nrpe configuration and paste it into the command line and it works great. But when the nrpe daemon runs the command it doesn't work.

That thread mentions "if it fails, I will need to see the full /etc/sudoers file to see if there are any other entries blocking the plugin." So here's the sudoers configuration:

/etc/sudoers

Code: Select all

## Sudoers allows particular users to run various commands as
## the root user, without needing the root password.
##
## Examples are provided at the bottom of the file for collections
## of related commands, which can then be delegated out to particular
## users or groups.
## 
## This file must be edited with the 'visudo' command.

## Host Aliases
## Groups of machines. You may prefer to use hostnames (perhaps using 
## wildcards for entire domains) or IP addresses instead.
# Host_Alias     FILESERVERS = fs1, fs2
# Host_Alias     MAILSERVERS = smtp, smtp2

## User Aliases
## These aren't often necessary, as you can use regular groups
## (ie, from files, LDAP, NIS, etc) in this file - just use %groupname 
## rather than USERALIAS
# User_Alias ADMINS = jsmith, mikem


## Command Aliases
## These are groups of related commands...

## Networking
# Cmnd_Alias NETWORKING = /sbin/route, /sbin/ifconfig, /bin/ping, /sbin/dhclient, /usr/bin/net, /sbin/iptables, /usr/bin/rfcomm, /usr/bin/wvdial, /sbin/iwconfig, /sbin/mii-tool

## Installation and management of software
# Cmnd_Alias SOFTWARE = /bin/rpm, /usr/bin/up2date, /usr/bin/yum

## Services
# Cmnd_Alias SERVICES = /sbin/service, /sbin/chkconfig, /usr/bin/systemctl start, /usr/bin/systemctl stop, /usr/bin/systemctl reload, /usr/bin/systemctl restart, /usr/bin/systemctl status, /usr/bin/systemctl enable, /usr/bin/systemctl disable

## Updating the locate database
# Cmnd_Alias LOCATE = /usr/bin/updatedb

## Storage
# Cmnd_Alias STORAGE = /sbin/fdisk, /sbin/sfdisk, /sbin/parted, /sbin/partprobe, /bin/mount, /bin/umount

## Delegating permissions
# Cmnd_Alias DELEGATING = /usr/sbin/visudo, /bin/chown, /bin/chmod, /bin/chgrp 

## Processes
# Cmnd_Alias PROCESSES = /bin/nice, /bin/kill, /usr/bin/kill, /usr/bin/killall

## Drivers
# Cmnd_Alias DRIVERS = /sbin/modprobe

# Defaults specification

#
# Refuse to run if unable to disable echo on the tty.
#
Defaults   !visiblepw

#
# Preserving HOME has security implications since many programs
# use it when searching for configuration files. Note that HOME
# is already set when the the env_reset option is enabled, so
# this option is only effective for configurations where either
# env_reset is disabled or HOME is present in the env_keep list.
#
Defaults    always_set_home
Defaults    match_group_by_gid

# Prior to version 1.8.15, groups listed in sudoers that were not
# found in the system group database were passed to the group
# plugin, if any. Starting with 1.8.15, only groups of the form
# %:group are resolved via the group plugin by default.
# We enable always_query_group_plugin to restore old behavior.
# Disable this option for new behavior.
Defaults    always_query_group_plugin

Defaults    env_reset
Defaults    env_keep =  "COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS"
Defaults    env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
Defaults    env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
Defaults    env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"
Defaults    env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"

#
# Adding HOME to env_keep may enable a user to run unrestricted
# commands via sudo.
#
# Defaults   env_keep += "HOME"

Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin

## Next comes the main part: which users can run what software on 
## which machines (the sudoers file can be shared between multiple
## systems).
## Syntax:
##
## 	user	MACHINE=COMMANDS
##
## The COMMANDS section may have other options added to it.
##
## Allow root to run any commands anywhere 
root	ALL=(ALL) 	ALL

## Allows members of the 'sys' group to run networking, software, 
## service management apps and more.
# %sys ALL = NETWORKING, SOFTWARE, SERVICES, STORAGE, DELEGATING, PROCESSES, LOCATE, DRIVERS

## Allows people in group wheel to run all commands
%wheel	ALL=(ALL)	ALL

## Same thing without a password
# %wheel	ALL=(ALL)	NOPASSWD: ALL

## Allows members of the users group to mount and unmount the 
## cdrom as root
# %users  ALL=/sbin/mount /mnt/cdrom, /sbin/umount /mnt/cdrom

## Allows members of the users group to shutdown this system
# %users  localhost=/sbin/shutdown -h now

## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment)
#includedir /etc/sudoers.d
/etc/sudoers.d/custom

Code: Select all

%wheel  ALL=(ALL)       NOPASSWD: ALL

# For Nessus scans
audit ALL=(ALL) ALL

# Allow Banner user to manage services (Tomcat, Ethos, etc.)
banner ALL=(root) NOPASSWD:/usr/bin/systemctl

# Let NRPE run plugins via sudo
Defaults:nrpe !requiretty
Defaults:tomcat8 !requiretty
nrpe ALL=(ALL) NOPASSWD:/usr/lib64/nagios/plugins/*
nrpe ALL=(ALL) NOPASSWD: /usr/lib64/nagios/plugins/check_jvm
tomcat8 ALL=(ALL) NOPASSWD: /usr/lib64/nagios/plugins/check_jvm
The thread also asks for output of "ls -l" on paths leading up to the check_jvm command:

Code: Select all

# ls -ld /usr
drwxr-xr-x. 12 root root 144 2019-07-16 14:20:03 /usr/
# ls -ld /usr/lib64
dr-xr-xr-x. 72 root root 49152 2020-06-29 10:36:14 /usr/lib64/
# ls -ld /usr/lib64/nagios
drwxr-xr-x. 3 root root 21 2019-10-29 14:53:50 /usr/lib64/nagios/
# ls -ld /usr/lib64/nagios/plugins
drwxr-xr-x. 3 root root 4096 2020-07-13 08:41:49 /usr/lib64/nagios/plugins/
# ls -ld /usr/lib64/nagios/plugins/check_jvm
-rwxrwxrwx 1 root root 6130 2020-07-08 09:04:38 /usr/lib64/nagios/plugins/check_jvm*
# ls -l /usr/local/bin
total 0

Re: NRPE sudo on RHEL 8

Posted: Mon Jul 13, 2020 5:00 pm
by tgriep
Please run these commands and post the output here.

Code: Select all

ls -l /usr/lib64/nagios/plugins
ls -l  /usr/local/bin/J*
Edit the nrpe.cfg file on the remote RHEL 8 server and change the following from

Code: Select all

debug=0
to

Code: Select all

debug=1
Save the change and restart the NRPE agent.

Code: Select all

systemctl restart nrpe
Run the check from the nagios server and look in the /var/log/messages file and the /var/log/secure file for any errors when the command was ran and post it here.

Thanks.

Re: NRPE sudo on RHEL 8

Posted: Tue Jul 14, 2020 9:42 am
by drakedts
Here's the ls output:

Code: Select all

# ls -l /usr/lib64/nagios/plugins
total 2652
-rwxr-xr-x. 1 root root     2346 2020-05-24 16:03:31 check_breeze*
-rwxr-xr-x. 1 root root    64248 2020-05-24 16:03:34 check_by_ssh*
lrwxrwxrwx. 1 root root        9 2020-05-24 16:03:31 check_clamd -> check_tcp*
-rwxr-xr-x. 1 root root    47080 2020-05-24 16:03:34 check_cluster*
-rwxr-xr-x. 1 root root    37424 2017-02-14 18:19:13 check_cups_jobs*
-rwsr-x---. 1 root nagios  59760 2020-05-24 16:03:34 check_dhcp*
-rwxr-xr-x. 1 root root    59792 2020-05-24 16:03:34 check_dig*
-rwxr-xr-x. 1 root root    94120 2020-05-24 16:03:34 check_disk*
-rwxr-xr-x. 1 root root    10134 2020-05-24 16:03:31 check_disk_smb*
-rwxr-xr-x. 1 root root    67968 2020-05-24 16:03:34 check_dns*
-rwxr-xr-x. 1 root root    34136 2020-05-24 16:03:34 check_dummy*
-rwxr-xr-x. 1 root root     5066 2020-05-24 16:03:31 check_file_age*
-rwxr-xr-x. 1 root root     6504 2020-05-24 16:03:31 check_flexlm*
-rwsr-x---. 1 root nagios  59784 2020-05-24 16:03:34 check_fping*
lrwxrwxrwx. 1 root root        9 2020-05-24 16:03:31 check_ftp -> check_tcp*
-rwxr-xr-x. 1 root root    55416 2020-05-24 16:03:34 check_hpjd*
-rwxr-xr-x. 1 root root   110312 2020-05-24 16:03:34 check_http*
-rwsr-x---. 1 root nagios  75784 2020-05-24 16:03:34 check_icmp*
-rwsr-x---. 1 root nagios  47304 2020-05-24 16:03:34 check_ide_smart*
lrwxrwxrwx. 1 root root        9 2020-05-24 16:03:31 check_imap -> check_tcp*
-r-xr-xr-x. 1 root root    18032 2020-02-14 12:04:26 check_iostat*
-rwxr-xr-x. 1 root root     6985 2020-05-24 16:03:31 check_ircd*
lrwxrwxrwx. 1 root root        9 2020-05-24 16:03:31 check_jabber -> check_tcp*
-r-xr-xr-x. 1 root root     2708 2020-02-14 12:04:28 check_jobsub*
-r-xr-xr-x  1 root root     6130 2020-07-08 09:04:38 check_jvm*
-rwxr-xr-x. 1 root root     6130 2020-02-14 12:04:30 check_jvm.orig*
-rwxr-xr-x  1 root root     6133 2020-07-06 13:36:09 check_jvm.orig-debug*
-rwxr-xr-x. 1 root root    64216 2020-05-24 16:03:34 check_ldap*
lrwxrwxrwx. 1 root root       10 2020-05-24 16:03:31 check_ldaps -> check_ldap*
-rwxr-xr-x. 1 root root    55312 2020-05-24 16:03:34 check_load*
-rwxr-xr-x. 1 root root     7068 2020-05-24 16:03:31 check_log*
-rwxr-xr-x. 1 root root    25575 2020-05-24 16:03:31 check_mailq*
-r-xr-xr-x. 1 root root     2729 2020-02-14 12:04:33 check_mem*
-r-xr-xr-x. 1 root root     4543 2020-02-14 12:04:36 check_mount*
-r-xr-xr-x. 1 root root    15186 2020-02-14 12:04:38 check_mountpoints*
-rwxr-xr-x. 1 root root    47168 2020-05-24 16:03:34 check_mrtg*
-rwxr-xr-x. 1 root root    51192 2020-05-24 16:03:34 check_mrtgtraf*
-rwxr-xr-x. 1 root root    59944 2020-05-24 16:03:34 check_mysql*
-rwxr-xr-x. 1 root root    55632 2020-05-24 16:03:34 check_mysql_query*
-rwxr-xr-x. 1 root root    51168 2020-05-24 16:03:34 check_nagios*
-r-xr-xr-x. 1 root root     1606 2020-02-14 12:04:41 check_namedconf*
lrwxrwxrwx. 1 root root        9 2020-05-24 16:03:31 check_nntp -> check_tcp*
lrwxrwxrwx. 1 root root        9 2020-05-24 16:03:31 check_nntps -> check_tcp*
-rwxr-xr-x  1 root root    55488 2020-04-29 17:38:15 check_nrpe*
-rwxr-xr-x. 1 root root    63768 2020-05-24 16:03:34 check_nt*
-rwxr-xr-x. 1 root root    63920 2020-05-24 16:03:34 check_ntp*
-rwxr-xr-x. 1 root root    59952 2020-05-24 16:03:34 check_ntp_peer*
-rwxr-xr-x. 1 root root    59840 2020-05-24 16:03:34 check_ntp_time*
-rwxr-xr-x. 1 root root    71840 2020-05-24 16:03:34 check_nwstat*
-rwxr-xr-x. 1 root root     9468 2020-05-24 16:03:31 check_oracle*
-rwxr-xr-x. 1 root root    55416 2020-05-24 16:03:34 check_overcr*
-rwxr-xr-x. 1 root root    59960 2020-05-24 16:03:34 check_pgsql*
-rwxr-xr-x. 1 root root    63912 2020-05-24 16:03:34 check_ping*
lrwxrwxrwx. 1 root root        9 2020-05-24 16:03:31 check_pop -> check_tcp*
-rwxr-xr-x. 1 root root    64112 2020-05-24 16:03:34 check_procs*
-rwxr-xr-x. 1 root root    55536 2020-05-24 16:03:34 check_real*
-r-xr-xr-x. 1 root root     4051 2020-02-14 12:04:42 check_ro_mounts*
-rwxr-xr-x. 1 root root     9679 2020-05-24 16:03:31 check_rpc*
-rwxr-xr-x. 1 root root     1630 2020-05-24 16:03:31 check_sensors*
lrwxrwxrwx. 1 root root        9 2020-05-24 16:03:31 check_simap -> check_tcp*
-rwxr-xr-x. 1 root root    72560 2020-05-24 16:03:34 check_smtp*
-rwxr-xr-x. 1 root root    81096 2020-05-24 16:03:34 check_snmp*
lrwxrwxrwx. 1 root root        9 2020-05-24 16:03:31 check_spop -> check_tcp*
-rwxr-xr-x. 1 root root    51440 2020-05-24 16:03:34 check_ssh*
lrwxrwxrwx. 1 root root        9 2020-05-24 16:03:31 check_ssmtp -> check_tcp*
-rwxr-xr-x. 1 root root    47048 2020-05-24 16:03:34 check_swap*
-r-xr-xr-x. 1 root root     1541 2020-02-14 12:04:45 check_systemd_service*
-rwxr-xr-x. 1 root root    68344 2020-05-24 16:03:34 check_tcp*
-rwxr-xr-x. 1 root root    51368 2020-05-24 16:03:34 check_time*
lrwxrwxrwx. 1 root root        9 2020-05-24 16:03:31 check_udp -> check_tcp*
-rwxr-xr-x. 1 root root    59640 2020-05-24 16:03:34 check_ups*
-rwxr-xr-x. 1 root root    42840 2020-05-24 16:03:34 check_users*
-rwxr-xr-x. 1 root root     3270 2020-05-24 16:03:31 check_wave*
drwxr-xr-x. 2 root root        6 2019-08-29 14:14:50 eventhandlers/
-rwxr-xr-x. 1 root root    42744 2020-05-24 16:03:34 negate*
-rwxr-xr-x. 1 root root      527 2020-07-02 09:18:48 script*
-rwxr-xr-x. 1 root root    42520 2020-05-24 16:03:34 urlize*
-rw-r--r--. 1 root root     2088 2020-05-24 16:03:31 utils.pm
-rwxr-xr-x. 1 root root     2791 2020-05-24 16:03:31 utils.sh*
# ls -l  /usr/local/bin/J*
ls: cannot access '/usr/local/bin/J*': No such file or directory
# ls -l  /usr/local/bin/j*
ls: cannot access '/usr/local/bin/j*': No such file or directory
# ls -l  /usr/local/bin/
total 0
I turned on debugging and ran the check that fails. Here's the nrpe log:

Code: Select all

Jul 14 09:33:44 lnx-ethosapi2-test.test.drake.edu nrpe[76062]: CONN_CHECK_PEER: checking if host is allowed: 10.10.3.0 port 52388
Jul 14 09:33:44 lnx-ethosapi2-test.test.drake.edu nrpe[76062]: Connection from 10.10.3.0 port 52388
Jul 14 09:33:44 lnx-ethosapi2-test.test.drake.edu nrpe[76062]: is_an_allowed_host (AF_INET): is host >10.10.3.0< an allowed host >10.10.3.0<
Jul 14 09:33:44 lnx-ethosapi2-test.test.drake.edu nrpe[76062]: is_an_allowed_host (AF_INET): test match host >10.10.3.0< for allowed host >lnx-dns3-prod.drake.edu<
Jul 14 09:33:44 lnx-ethosapi2-test.test.drake.edu nrpe[76062]: is_an_allowed_host (AF_INET): test match host >10.10.3.0< for allowed host >lnx-dns3-prod.drake.edu<
Jul 14 09:33:44 lnx-ethosapi2-test.test.drake.edu nrpe[76062]: is_an_allowed_host (AF_INET): test match host >10.10.3.0< for allowed host >lnx-dns3-prod.drake.edu<
Jul 14 09:33:44 lnx-ethosapi2-test.test.drake.edu nrpe[76062]: is_an_allowed_host (AF_INET): test match host >10.10.3.0< for allowed host >lnx-dns4-prod.drake.edu<
Jul 14 09:33:44 lnx-ethosapi2-test.test.drake.edu nrpe[76062]: is_an_allowed_host (AF_INET): test match host >10.10.3.0< for allowed host >lnx-dns4-prod.drake.edu<
Jul 14 09:33:44 lnx-ethosapi2-test.test.drake.edu nrpe[76062]: is_an_allowed_host (AF_INET): test match host >10.10.3.0< for allowed host >lnx-dns4-prod.drake.edu<
Jul 14 09:33:44 lnx-ethosapi2-test.test.drake.edu nrpe[76062]: is_an_allowed_host (AF_INET): test match host >10.10.3.0< for allowed host >lnx-nagios-prod.drake.edu<
Jul 14 09:33:44 lnx-ethosapi2-test.test.drake.edu nrpe[76062]: is_an_allowed_host (AF_INET): host is in allowed host list!
Jul 14 09:33:44 lnx-ethosapi2-test.test.drake.edu nrpe[76062]: Host address is in allowed_hosts
Jul 14 09:33:44 lnx-ethosapi2-test.test.drake.edu nrpe[76062]: Error: (use_ssl == true): Request packet version was invalid!
Jul 14 09:33:44 lnx-ethosapi2-test.test.drake.edu nrpe[76062]: Could not read request from client 10.10.3.0, bailing out...
Jul 14 09:33:44 lnx-ethosapi2-test.test.drake.edu nrpe[76062]: INFO: SSL Socket Shutdown.
Jul 14 09:33:44 lnx-ethosapi2-test.test.drake.edu nrpe[76062]: Connection from 10.10.3.0 closed.
Jul 14 09:33:44 lnx-ethosapi2-test.test.drake.edu nrpe[76064]: CONN_CHECK_PEER: checking if host is allowed: 10.10.3.0 port 52900
Jul 14 09:33:44 lnx-ethosapi2-test.test.drake.edu nrpe[76064]: Connection from 10.10.3.0 port 52900
Jul 14 09:33:44 lnx-ethosapi2-test.test.drake.edu nrpe[76064]: is_an_allowed_host (AF_INET): is host >10.10.3.0< an allowed host >10.10.3.0<
Jul 14 09:33:44 lnx-ethosapi2-test.test.drake.edu nrpe[76064]: is_an_allowed_host (AF_INET): test match host >10.10.3.0< for allowed host >lnx-dns3-prod.drake.edu<
Jul 14 09:33:44 lnx-ethosapi2-test.test.drake.edu nrpe[76064]: is_an_allowed_host (AF_INET): test match host >10.10.3.0< for allowed host >lnx-dns3-prod.drake.edu<
Jul 14 09:33:44 lnx-ethosapi2-test.test.drake.edu nrpe[76064]: is_an_allowed_host (AF_INET): test match host >10.10.3.0< for allowed host >lnx-dns3-prod.drake.edu<
Jul 14 09:33:44 lnx-ethosapi2-test.test.drake.edu nrpe[76064]: is_an_allowed_host (AF_INET): test match host >10.10.3.0< for allowed host >lnx-dns4-prod.drake.edu<
Jul 14 09:33:44 lnx-ethosapi2-test.test.drake.edu nrpe[76064]: is_an_allowed_host (AF_INET): test match host >10.10.3.0< for allowed host >lnx-dns4-prod.drake.edu<
Jul 14 09:33:44 lnx-ethosapi2-test.test.drake.edu nrpe[76064]: is_an_allowed_host (AF_INET): test match host >10.10.3.0< for allowed host >lnx-dns4-prod.drake.edu<
Jul 14 09:33:44 lnx-ethosapi2-test.test.drake.edu nrpe[76064]: is_an_allowed_host (AF_INET): test match host >10.10.3.0< for allowed host >lnx-nagios-prod.drake.edu<
Jul 14 09:33:44 lnx-ethosapi2-test.test.drake.edu nrpe[76064]: is_an_allowed_host (AF_INET): host is in allowed host list!
Jul 14 09:33:44 lnx-ethosapi2-test.test.drake.edu nrpe[76064]: Host address is in allowed_hosts
Jul 14 09:33:44 lnx-ethosapi2-test.test.drake.edu nrpe[76064]: Host 10.10.3.0 is asking for command 'tomcat_heap' to be run...
Jul 14 09:33:44 lnx-ethosapi2-test.test.drake.edu nrpe[76064]: Running command: /usr/bin/sudo -u tomcat8 /usr/lib64/nagios/plugins/check_jvm -n org.apache.catalina.startup.Bootstrap -p heap -w 90 -c 101
Jul 14 09:33:44 lnx-ethosapi2-test.test.drake.edu nrpe[76065]: WARNING: my_system() seteuid(0): Operation not permitted
Jul 14 09:33:44 lnx-ethosapi2-test.test.drake.edu sudo[76066]:     nrpe : TTY=unknown ; PWD=/ ; USER=tomcat8 ; COMMAND=/usr/lib64/nagios/plugins/check_jvm -n org.apache.catalina.startup.Bootstrap -p heap -w 90 -c 101
Jul 14 09:33:44 lnx-ethosapi2-test.test.drake.edu nrpe[76064]: Command completed with return code 3 and output: UNKNOWN Can't connect to the JVM:
Jul 14 09:33:44 lnx-ethosapi2-test.test.drake.edu nrpe[76064]: Return Code: 3, Output: UNKNOWN Can't connect to the JVM:
Jul 14 09:33:44 lnx-ethosapi2-test.test.drake.edu nrpe[76064]: Connection from 10.10.3.0 closed.
And here's what i found in /var/log/secure:

Code: Select all

Jul 14 09:33:44 lnx-ethosapi2-test sudo[76066]:    nrpe : TTY=unknown ; PWD=/ ; USER=tomcat8 ; COMMAND=/usr/lib64/nagios/plugins/check_jvm -n org.apache.catalina.startup.Bootstrap -p heap -w 90 -c 101
Jul 14 09:33:44 lnx-ethosapi2-test systemd[76068]: pam_unix(systemd-user:session): session opened for user tomcat8 by (uid=0)
Jul 14 09:33:44 lnx-ethosapi2-test sudo[76066]: pam_unix(sudo:session): session opened for user tomcat8 by (uid=0)
Jul 14 09:33:44 lnx-ethosapi2-test sudo[76066]: pam_unix(sudo:session): session closed for user tomcat8
Thank you!

Re: NRPE sudo on RHEL 8

Posted: Wed Jul 15, 2020 4:21 pm
by tgriep
In the other post, to get the plugin to run, I had to put the JvmInspector.jar file in the /usr/local/bin folder so it can be found in the search path.
Try doing that as I did not see in on your server in that folder.
Also, can you post the full check_jvm plugin here so we can view it?
There are different versions of that plugin and I would like to see it.
Thanks.