Page 1 of 2
NSClient++ - 0.4.3.131 debug log
Posted: Wed Jun 10, 2015 9:34 am
by michaelli
Hi,
I install nsclient agent into some of windows 2003 and windows 2008 server and use the same nsclient.ini file. All are running functionally with real time passive system event log except one windows 2008 server. The install nsclient agent success without any error. When I get the system alert, it is unable to send NSCA to nagios server.
I run nsclient in debug mode (nscp test) and below is the debug log file for refer.
Use windows command to generate alert message
Code: Select all
eventcreate /ID 9 /L system /T error /SO Myeventsource4 /D "testing system error "
nscp console debug log, what is the error listed as below. I cannot search any information in the internet.
Code: Select all
D eventlog Reading eventlog messages...
D eventlog Processing: 000000000226B650
E nsca Failed to read data: End of file
D:\source\nscp\include\socket/client.hpp:148
D nsca Retrying attempt 0 of 3
E nsca Failed to read data: End of file
D:\source\nscp\include\socket/client.hpp:148
D nsca Retrying attempt 1 of 3
E nsca Failed to read data: End of file
D:\source\nscp\include\socket/client.hpp:148
D nsca Retrying attempt 2 of 3
E nsca Failed to read data: End of file
D:\source\nscp\include\socket/client.hpp:148
D nsca Retrying failed
Re: NSClient++ - 0.4.3.131 debug log
Posted: Wed Jun 10, 2015 9:49 am
by ssax
If you look at your /etc/xinetd.d/nsca file on your XI server, is the client allowed in the only_from setting?
Re: NSClient++ - 0.4.3.131 debug log
Posted: Wed Jun 10, 2015 10:09 am
by michaelli
HI saax,
I have already comment only_from in nsca and restart xinetd. Other windows2003/2008 can send passive system log nagios with same nsclient.ini file.
Just this windows 2008 hit this problem.
Code: Select all
[root@ngonap01 log]# cat /etc/xinetd.d/nsca
# default: on
# description: NSCA (Nagios Service Check Acceptor)
service nsca
{
flags = REUSE
socket_type = stream
wait = no
user = nagios
group = nagios
server = /usr/local/nagios/bin/nsca
server_args = -c /usr/local/nagios/etc/nsca.cfg --inetd
log_on_failure += USERID
disable = no
# only_from = 127.0.0.1
Re: NSClient++ - 0.4.3.131 debug log
Posted: Wed Jun 10, 2015 1:13 pm
by ssax
Do you have any anit-virus/spyware/firewall/IPS on it or in between that server and your XI server that could be affecting it?
Re: NSClient++ - 0.4.3.131 debug log
Posted: Wed Jun 10, 2015 10:52 pm
by michaelli
Hi ssax,
We just use Symantec anti-virus with global setting.
When I generate testing error messages, I find nagios service has this log. Hope this help for problem isolation.
Code: Select all
Jun 11 11:49:23 ngonap01 xinetd[3862]: FAIL: nsca per_source_limit from=::ffff:172.31.8.166
Jun 11 11:49:23 ngonap01 xinetd[3862]: FAIL: nsca per_source_limit from=::ffff:172.31.8.166
Jun 11 11:49:23 ngonap01 xinetd[3862]: FAIL: nsca per_source_limit from=::ffff:172.31.8.166
Jun 11 11:49:23 ngonap01 xinetd[3862]: FAIL: nsca per_source_limit from=::ffff:172.31.8.166
Re: NSClient++ - 0.4.3.131 debug log
Posted: Wed Jun 10, 2015 11:01 pm
by michaelli
HI saax,
I find the error by google, but I am no right to read below link. Actually, We have subscription for Nagios XI interprise. How Can I access the customer support forum?
http://support.nagios.com/forum/viewtop ... =16&t=5958
Re: NSClient++ - 0.4.3.131 debug log
Posted: Wed Jun 10, 2015 11:38 pm
by michaelli
Hi saax,
More information for troubleshoot procedure.
1. delete all service for SDSNAP02 in CCM
2. delete host in CCM
3. create host and service in CCM
4. in client side generate error messages
5. error services can see in "Unconfigured Objects"
6. match "unconfigurd objects" to host SDSNAP02
7. generate error message for testing
8. Find nagios logged below messages in /var/log/messages
Jun 11 12:36:14 ngonap01 xinetd[3862]: FAIL: nsca per_source_limit from=::ffff:172.31.8.166
Jun 11 12:36:14 ngonap01 xinetd[3862]: FAIL: nsca per_source_limit from=::ffff:172.31.8.166
Jun 11 12:36:14 ngonap01 xinetd[3862]: FAIL: nsca per_source_limit from=::ffff:172.31.8.166
I guess some mistake we should fix in nagios server.
Re: NSClient++ - 0.4.3.131 debug log
Posted: Wed Jun 10, 2015 11:46 pm
by Box293
So when you click the "play" button on "unconfigurd objects" for the host SDSNAP02, these services get added to CCM.
Does the functionality work after this?
Re: NSClient++ - 0.4.3.131 debug log
Posted: Thu Jun 11, 2015 1:07 am
by michaelli
Hi box293 and saax,
A good news is after I reboot nagios, its work for getting all alerts and can display in nagios.
Finally, what is the root cause for this issue because we would not like this issue happening in production environment.
Re: NSClient++ - 0.4.3.131 debug log
Posted: Thu Jun 11, 2015 10:05 am
by jdalrymple
michaelli
I suspect this was your problem all along:
michaelli wrote:8. Find nagios logged below messages in /var/log/messages
Jun 11 12:36:14 ngonap01 xinetd[3862]: FAIL: nsca per_source_limit from=::ffff:172.31.8.166
Jun 11 12:36:14 ngonap01 xinetd[3862]: FAIL: nsca per_source_limit from=::ffff:172.31.8.166
Jun 11 12:36:14 ngonap01 xinetd[3862]: FAIL: nsca per_source_limit from=::ffff:172.31.8.166
add the following lines to your /etc/xinetd.d/nsca file and I think you'll be all set:
Code: Select all
per_source = UNLIMITED
instances = UNLIMITED
Make sure to restart xinetd
As for getting you access to the customer support forums - please send an E-mail to
[email protected] to make them aware of the situation.