Nagios Support Forum

I have noticed that we are logging multiple nrpe start and exit messages each minute on the client machines. I have confirmed we have the dont_blame_nagios set to 1. I restarted the xinetd service. I confirmed the nagios server IP address in defined properly in the /etc/xinetd.d/nrpe file's only_from setting. Nagios is monitoring the hosts. I just wonder about all of these messages in the log.

grep dont_blame_nrpe /usr/local/nagios/etc/nrpe.cfg
dont_blame_nrpe=1
grep only_from /etc/xinetd.d/nrpe
only_from = 10.201.32.11

Here are some of the messages from one of our servers. They appear on all of our rhel servers that we are monitoring.
Mar 11 21:13:00 edcxlinuxutil xinetd[21631]: START: nrpe pid=15634 from=10.201.32.11
Mar 11 21:13:00 edcxlinuxutil xinetd[21631]: EXIT: nrpe status=0 pid=15634 duration=0(sec)
Mar 11 21:13:12 edcxlinuxutil xinetd[21631]: START: nrpe pid=15637 from=10.201.32.11
Mar 11 21:13:12 edcxlinuxutil xinetd[21631]: EXIT: nrpe status=0 pid=15637 duration=0(sec)
Mar 11 21:13:21 edcxlinuxutil xinetd[21631]: START: nrpe pid=15640 from=10.201.32.11
Mar 11 21:13:21 edcxlinuxutil xinetd[21631]: START: nrpe pid=15641 from=10.201.32.11
Mar 11 21:13:21 edcxlinuxutil xinetd[21631]: EXIT: nrpe status=0 pid=15641 duration=0(sec)
Mar 11 21:13:21 edcxlinuxutil xinetd[21631]: EXIT: nrpe status=0 pid=15640 duration=0(sec)
Mar 11 21:14:30 edcxlinuxutil xinetd[21631]: START: nrpe pid=15722 from=10.201.32.11
Mar 11 21:14:30 edcxlinuxutil xinetd[21631]: EXIT: nrpe status=0 pid=15722 duration=0(sec)
Mar 11 21:14:42 edcxlinuxutil xinetd[21631]: START: nrpe pid=15725 from=10.201.32.11
Mar 11 21:14:42 edcxlinuxutil xinetd[21631]: EXIT: nrpe status=0 pid=15725 duration=0(sec)
Mar 11 21:14:46 edcxlinuxutil xinetd[21631]: START: nrpe pid=15728 from=10.201.32.11
Mar 11 21:14:46 edcxlinuxutil xinetd[21631]: EXIT: nrpe status=0 pid=15728 duration=0(sec)
Mar 11 21:15:01 edcxlinuxutil xinetd[21631]: START: nrpe pid=15740 from=10.201.32.11
Mar 11 21:15:01 edcxlinuxutil xinetd[21631]: EXIT: nrpe status=0 pid=15740 duration=0(sec)
Mar 11 21:15:05 edcxlinuxutil xinetd[21631]: START: nrpe pid=15772 from=10.201.32.11
Mar 11 21:15:05 edcxlinuxutil xinetd[21631]: EXIT: nrpe status=0 pid=15772 duration=0(sec)
Mar 11 21:15:06 edcxlinuxutil xinetd[21631]: START: nrpe pid=15785 from=10.201.32.11
Mar 11 21:15:06 edcxlinuxutil xinetd[21631]: EXIT: nrpe status=0 pid=15785 duration=0(sec)

a45634 wrote:I have noticed that we are logging multiple nrpe start and exit messages each minute on the client machines.

It looks more like a bunch of checks, run every 5 minutes. This is wai, including the start/stops as they should be logged every time an active check is received.

Just to be clear. You are indicating the messages are expected behavior. Are you saying that running checks every 5 minutes is not a typical strategy? I am also unclear what the term WAI means.

WAI = Working As Intended.

Everything appears to be normal in those logs. Checking every 5 minutes is standard.

Thank you for the confirmation!

We're going to go ahead and lock this thread up, let us know if you have further questions on this!