Monitoring Windows Event Logs

[centwisit]

Getting closer, now get:

Code: Select all

Unknown argument: filter-generated 

[slansing]

You have allow_arguments set to 1 within that configuration file correct? This must be enabled for any commands which require arguments to communicate back and forth between Nagios and NSClient++. I did also find this:

http://nsclient.org/nscp/discussion/topic/747

Which seems to be related to the NSClient++ systemtray, I believe if you are using a newer version than 3.8.x that problem should be resolved.

[centwisit]

Yup, I've got both arguments and nasty characters set to true.

Code: Select all

; Section for NRPE (NRPEServer.dll) (check_nrpe) protocol options.
[/settings/NRPE/server]

; COMMAND ARGUMENT PROCESSING - This option determines whether or not the we will allow clients to specify arguments to commands that are executed.
allow arguments = true

; COMMAND ALLOW NASTY META CHARS - This option determines whether or not the we will allow clients to specify nasty (as in |`&><'"\[]{}) characters in arguments.
allow nasty characters = true

PORT NUMBER - Port to use for NRPE.
port = 5666

Running version NSCP-0.4.1.90.

[slansing]

I have verified this result when I check the command against a NSClient++ 0.4.1.90 installation, this could be a bug in the current version, I would recommend using NSClient++ version 0.3.9x and be sure that the correct architecture version is installed in reference to your system "32/64-bit." This could also be an issue with checking against different versions of Windows, what version are you trying to check this on?

Edit: It appears I am able to get this to work on my system, but a co-worker can not though we are both checking against the same Windows system.. we are digging into this a bit more right now..

[centwisit]

This specific server is 2003 R2 x64. Most of our servers are 2008R2 x64. I'll add one of those servers and see what results I get.

[slansing]

Sounds good.. here is the edit I made to my last post, it looks like I made the change when you were already on the page:

Edit: It appears I am able to get this to work on my system, but a co-worker can not though we are both checking against the same Windows system.. we are digging into this a bit more right now..

[centwisit]

I've installed NSClient++-0.3.9-x64 on the 2008 R2 x64 server, modified the .ini file as we have been discussing, and get a different error:

Code: Select all

Could not construct return packet in NRPE handler check client side (nsclient.log) logs... 

I'm wrapping up for the day and will see what Google has to say tomorrow but just in case you find something in the meantime...

[lmiltchev]

Sure. Please, post the nsclient.log whenever you have a chance.

[centwisit]

Code: Select all

2013-03-19 12:42:44: e:..\..\..\..\trunk\modules\NRPEServer\handler_impl.cpp:15: Request contained arguments (not currently allowed, check the allow arguments option).
2013-03-19 12:52:44: e:..\..\..\..\trunk\modules\NRPEServer\handler_impl.cpp:15: Request contained arguments (not currently allowed, check the allow arguments option).
2013-03-19 13:02:44: e:..\..\..\..\trunk\modules\NRPEServer\handler_impl.cpp:15: Request contained arguments (not currently allowed, check the allow arguments option).
2013-03-19 13:12:44: e:..\..\..\..\trunk\modules\NRPEServer\handler_impl.cpp:15: Request contained arguments (not currently allowed, check the allow arguments option).
2013-03-19 13:22:44: e:..\..\..\..\trunk\modules\NRPEServer\handler_impl.cpp:15: Request contained arguments (not currently allowed, check the allow arguments option).
2013-03-19 13:32:44: e:..\..\..\..\trunk\modules\NRPEServer\handler_impl.cpp:15: Request contained arguments (not currently allowed, check the allow arguments option).
2013-03-19 13:35:20: e:..\..\..\..\trunk\modules\NRPEServer\handler_impl.cpp:15: Request contained arguments (not currently allowed, check the allow arguments option).
2013-03-19 13:42:01: e:..\..\..\..\trunk\modules\NRPEServer\handler_impl.cpp:15: Request contained arguments (not currently allowed, check the allow arguments option).
2013-03-19 13:42:42: e:..\..\..\..\trunk\modules\NRPEServer\handler_impl.cpp:25: Request arguments contained illegal metachars!
2013-03-19 13:42:44: e:..\..\..\..\trunk\modules\NRPEServer\handler_impl.cpp:25: Request arguments contained illegal metachars!
2013-03-19 13:52:44: e:..\..\..\..\trunk\modules\NRPEServer\handler_impl.cpp:25: Request arguments contained illegal metachars!
2013-03-19 14:02:44: e:..\..\..\..\trunk\modules\NRPEServer\handler_impl.cpp:25: Request arguments contained illegal metachars!
2013-03-19 14:12:44: e:..\..\..\..\trunk\modules\NRPEServer\handler_impl.cpp:25: Request arguments contained illegal metachars!

[slansing]

Can you upload a copy of your NSC/NSClient.ini file? You can blank out IP's and passwords, but please leave something there so we know that those lines have been supplied with the correct information.

Looks like you did not allow arguments or nasty_meta_characters on your new NSClient.ini file like you did the old one.