syslog messages indicate nrpe is restarting continously

[davehu]

Hi, I installed the Nagios XI Linux Agent (the latest one that supports Amazon Linux) on 2 Amazon Linux instances and am able to monitor those from Nagios XI. I then installed Nagios Log Server and started getting a syslog feed from these two servers. I am seeing the following messages which imply that nrpe is restarting continously on the monitored servers:

@timestamp host type message
2015-04-08T13:36:12.000-07:00 xx.xx.xx.153 syslog START: nrpe pid=6825 from=::ffff:xxx.xx.6.214
2015-04-08T13:36:10.000-07:00 yy.yy.yy.230 syslog START: nrpe pid=12855 from=::ffff:xxx.xx.6.214
2015-04-08T13:36:10.000-07:00 yy.yy.yy.230 syslog EXIT: nrpe status=0 pid=12855 duration=0(sec)
2015-04-08T13:36:09.000-07:00 xx.xx.xx.153 syslog EXIT: nrpe status=0 pid=6821 duration=0(sec)
2015-04-08T13:36:09.000-07:00 xx.xx.xx.153 syslog START: nrpe pid=6821 from=::ffff:xxx.xx.6.214
2015-04-08T13:36:07.000-07:00 yy.yy.yy.230 syslog START: nrpe pid=12842 from=::ffff:xxx.xx.6.214
2015-04-08T13:36:07.000-07:00 yy.yy.yy.230 syslog EXIT: nrpe status=0 pid=12842 duration=0(sec)
2015-04-08T13:36:04.000-07:00 xx.xx.xx.153 syslog EXIT: nrpe status=0 pid=6818 duration=0(sec)
2015-04-08T13:36:04.000-07:00 xx.xx.xx.153 syslog START: nrpe pid=6818 from=::ffff:xxx.xx.6.214
2015-04-08T13:35:56.000-07:00 yy.yy.yy.230 syslog EXIT: nrpe status=0 pid=12837 duration=1(sec)
2015-04-08T13:35:55.000-07:00 yy.yy.yy.230 syslog START: nrpe pid=12837 from=::ffff:xxx.xx.6.214
2015-04-08T13:35:51.000-07:00 xx.xx.xx.153 syslog START: nrpe pid=6802 from=::ffff:xxx.xx.6.214
2015-04-08T13:35:51.000-07:00 xx.xx.xx.153 syslog EXIT: nrpe status=0 pid=6802 duration=0(sec)

I have just obfuscated the IP addresses here. are these normal messages, or is something wrong?

Dave.

[jdalrymple]

Normal if NRPE is running from xinetd. Is it?

[davehu]

Yes, the Nagios XI Linux Agent installs nrpe under xinetd. So I guess nothing to worry about then? Other an a LOT of messages on syslog.

[jolson]

If everything is functioning as it should, this kind of logging is normal as jdalrymple said. You could check out the following resources if you're interested in turning logging off, though you may lose valuable troubleshooting information:

http://www.centos.org/docs/4/html/rhel- ... onfig.html
http://www.redhat.com/archives/redhat-l ... 03601.html