Page 1 of 2
nsclient cannot display full event log
Posted: Sun Jun 07, 2015 12:04 pm
by michaelli
Hi,
I am using nsclient CheckEventLog for monitoring windows system log.
But sometime, It cannot display the full error messages in nagiosxi.
Any parameter setting or syntax how to configure in nsclient.ini for display long log description?
Re: nsclient cannot display full event log
Posted: Mon Jun 08, 2015 9:48 am
by jdalrymple
It's probably getting truncated by the 1024K limit built into NRPE. You can change this in nsclient.ini as a config option:
Code: Select all
[/settings/NRPE/server]
payload length = 1024
But you have to recompile NRPE for them to talk at that point.
Change the following 2 lines in the include/common.h file in the NRPE source code then recompile.
Code: Select all
#define MAX_INPUT_BUFFER 1024 /* max size of most buffers we use */
#define MAX_PACKETBUFFER_LENGTH 1024 /* max amount of data we'll send in one query/response */
You specifically only need check_nrpe, and I'd rename it to check_nrpe_long and keep your original so you don't have to configure all of your other nrpe services in your environment at once:
Re: nsclient cannot display full event log
Posted: Wed Jun 10, 2015 5:47 am
by michaelli
Hi jdalrymple,
Just to clarify is this setting work on nsclient bulid-in real time windows system checking?
Re: nsclient cannot display full event log
Posted: Wed Jun 10, 2015 10:54 am
by jolson
Michaelli,
This will not work for real time windows system checking, since that is handled by NSCA and not NRPE.
To adjust the setting you're looking for, check out the following documentation:
http://docs.nsclient.org/reference/NSCAClient.html
/settings/NSCA/client/targets/default payload length 512 PAYLOAD LENGTH
So ultimately you'll want the following in your nsclient.ini file:
Code: Select all
/settings/NSCA/client/targets/default
payload length = 2048
Re: nsclient cannot display full event log
Posted: Wed Jun 10, 2015 10:14 pm
by michaelli
Hi jolson,
If I set the payload length under below path and create a error event but nagios cannot display the error event.
Code: Select all
[/settings/NSCA/n2]
channel = NSCA2
[/settings/NSCA/n2/targets/default]
payload length = 1024
host=172.31.4.40
encryption=none
password=P@ssw0rd
Moreover, There has a log in nagios server when I generate the error event. (IP 172.31.8.63 is nsclient host). This seems that nagios cannot display when payload set to 1024.
Code: Select all
Jun 11 11:10:17 ngonap01 xinetd[3862]: START: nsca pid=11100 from=::ffff:172.31.8.63
Jun 11 11:10:18 ngonap01 xinetd[3862]: EXIT: nsca status=0 pid=11100 duration=1(sec)
Re: nsclient cannot display full event log
Posted: Thu Jun 11, 2015 10:08 am
by jdalrymple
Just like with nrpe, you'd have to recompile nsca to handle the additional payload. This is fairly trivial. Download it and change the following line in include/common.h:
Code: Select all
#define MAX_PLUGINOUTPUT_LENGTH 512
The client and server numbers will always have to match up otherwise there is a CRC error. This means that you'll have to adjust any other systems sending data to that particular nsca daemon. It might be desirable to start a 2nd daemon on another port.
Re: nsclient cannot display full event log
Posted: Thu Jun 11, 2015 9:22 pm
by michaelli
Hi jdalrymple,
Do you mean we need to re-compile the nsca in nagios server side? Or is it possible set the payload in nsca configuration file?
As we install the Nagios XI by fullinstall. So could you please provide a source and procedure for us?
Re: nsclient cannot display full event log
Posted: Fri Jun 12, 2015 11:02 am
by jolson
To recompile nsca, follow these instructions.
Code: Select all
cp nsca.cfg /root/nsca.cfg (backup nsca.cfg)
cd /tmp
wget http://downloads.sourceforge.net/project/nagios/nsca-2.x/nsca-2.9.1/nsca-2.9.1.tar.gz?r=http%3A%2F%2Fsourceforge.net%2Fprojects%2Fnagios%2Ffiles%2Fnsca-2.x%2Fnsca-2.9.1%2F&ts=1434124312&use_mirror=iweb
mv nsca* nagnsca
tar zxf nagnsca
cd nsca-2.9.1/
vi include/common.h (change #define MAX_PLUGINOUTPUT_LENGTH 512 to #define MAX_PLUGINOUTPUT_LENGTH 1024)
./configure
make all
cp src/nsca /usr/local/nagios/bin/nsca
Re: nsclient cannot display full event log
Posted: Fri Jun 12, 2015 10:47 pm
by michaelli
Hi jolson,
Hi Jolson,
My existing nsca version is 2.9.1 which same as you provided in URL.
Code: Select all
[root@nagiosxi bin]# pwd
/usr/local/nagios/bin
[root@nagiosxi bin]# ./nsca
NSCA - Nagios Service Check Acceptor
Copyright (c) 2009 Nagios Core Development Team and Community Contributors
Copyright (c) 2000-2009 Ethan Galstad
Version: 2.9.1
Last Modified: 01-27-2012
License: GPL v2
Encryption Routines: AVAILABLE
Usage: ./nsca -c <config_file> [mode]
In your source nsca 2.9.1, the original MAX_PLUGINOUTPUT_LENGTH 4096
Code: Select all
[root@nagiosxi include]# pwd
/var/tmp/nsca-2.9.1/include
[root@nagiosxi include]# grep MAX_PLUGINOUTPUT common.h
#define MAX_PLUGINOUTPUT_LENGTH 4096
#define OLD_PACKET_LENGTH (( sizeof( data_packet) - ( MAX_PLUGINOUTPUT_LENGTH - OLD_PLUGINOUTPUT_LENGTH)))
char plugin_output[MAX_PLUGINOUTPUT_LENGTH];
Therefore I do not re-compile nsca and I adjust the payload length to 4096 in client side
Code: Select all
[/settings/NSCA/n1/targets/default]
host=172.31.4.166
encryption=none
password=P@ssw0rd
payload length = 4096
And generate a error messages, but result are same. It cannot show long description. Attached nsclient debug log for reference.
What is payload length units? is it in characters or bytes?
Because our operation team do not accept this behavior. if error occurs, they can not read the error message completely and need to login host for detail. This is very inconvienance for our daily operation.
Any alternative way or plugin to solve this issue in nagiosxi?
Re: nsclient cannot display full event log
Posted: Sun Jun 14, 2015 11:35 pm
by Box293
We also need to adjust the database to allow more data.
Execute these four commands at a command line on your Nagios XI host (each command is one long line):
Code: Select all
echo "use nagios;alter table nagios_servicestatus modify output varchar(65535) not null;alter table nagios_servicestatus modify long_output varchar(65535) not null;alter table nagios_servicestatus modify perfdata varchar(65535) not null;" | mysql -pnagiosxi
echo "use nagios;alter table nagios_hoststatus modify output varchar(65535) not null;alter table nagios_hoststatus modify long_output varchar(65535) not null;alter table nagios_hoststatus modify perfdata varchar(65535) not null;" | mysql -pnagiosxi
echo "use nagios;alter table nagios_servicechecks modify output varchar(65535) not null;alter table nagios_servicechecks modify long_output varchar(65535) not null;alter table nagios_servicechecks modify perfdata varchar(65535) not null;" | mysql -pnagiosxi
echo "use nagios;alter table nagios_hostchecks modify output varchar(65535) not null;alter table nagios_hostchecks modify long_output varchar(65535) not null;alter table nagios_hostchecks modify perfdata varchar(65535) not null;" | mysql -pnagiosxi
The next time a service is updated it should show the full output.