Page 1 of 3

Nagios XI https Deny TCP every now and then

Posted: Thu Jan 28, 2016 6:37 am
by michal.nastaly
Hi,

I have multiple Nagios XI servers withing the environments and a centralized Nagios Fusion serve that pulls information from all the XI servers.
Up to now the connection between the Nagios XI and Nagios Fusion has been http, but we want to change it to https for fairly obvious reasons.
I have used the following guide to set it all up https://assets.nagios.com/downloads/nag ... s%20XI.pdf.

I can browse the Nagios XI server using https, Nagios Fusion can talk to it as well but when monitoring the traffic between two boxes on my asa 5505 i can see that every now and then i get the following message: "Deny TCP (no connection) from <-NagiosXi->:443 to <-NagiosFusion->:<-RandomPort-> flags ACK in interfcae inside"

So from what i can understand is that the Nagios XI box is trying to send packet for a transaction that the firewall already closed.

Can anyone help with this please?

Regard
Michal

Re: Nagios XI https Deny TCP every now and then

Posted: Thu Jan 28, 2016 3:44 pm
by scottwilkerson
It's possible that Fusion was trying to poll data from the XI server but reached the timeout and closed the connection

Re: Nagios XI https Deny TCP every now and then

Posted: Tue Feb 02, 2016 11:52 am
by michal.nastaly
Just got it working, It dint work in a first place because the active checks were disabled on the hosts.

Cheers

Re: Nagios XI https Deny TCP every now and then

Posted: Tue Feb 02, 2016 3:57 pm
by hsmith
That'll certainly do it. :) I'll close this topic. Thanks for letting us know.

Re: Nagios XI https Deny TCP every now and then

Posted: Wed Feb 03, 2016 9:08 am
by hsmith
Post unlocked at user's request.

Re: Nagios XI https Deny TCP every now and then

Posted: Fri Mar 04, 2016 8:14 am
by michal.nastaly
Sorry for the confusion, this is still ongoing issue.

I have changed the timeout from 60 to 120 without any result.

I have included a firewall output of what i can see when using HTTPS instead of HTTP for the fused servers.
NagiosFusionFirewall.JPG
This is the output from firewall close to the Nagios XI server(192.168.6.10).

The address of Nagios Fusion is 10.27.40.4

Does anyone know why that is?

Regards
Michal N

Re: Nagios XI https Deny TCP every now and then

Posted: Tue Mar 15, 2016 2:57 am
by michal.nastaly
Anyone? Any ideas?

Re: Nagios XI https Deny TCP every now and then

Posted: Tue Mar 15, 2016 7:32 pm
by Box293
On the Fusion server, is anything logged in /var/log/httpd/error_log when the timeout occurs?

Re: Nagios XI https Deny TCP every now and then

Posted: Wed Mar 16, 2016 4:00 am
by michal.nastaly
[Wed Mar 16 09:42:19 2016] [error] [client 10.64.110.18] PHP Warning: Invalid argument supplied for foreach() in /usr/local/nagiosfusion/html/includes/dashlets/servicegroup/servicegroup.inc.php on line 177, referer: http://10.64.110.20/nagiosfusion/dashbo ... ?id=rq7k65
[Wed Mar 16 09:42:43 2016] [error] [client 10.64.110.18] PHP Warning: Invalid argument supplied for foreach() in /usr/local/nagiosfusion/html/includes/dashlets/servicegroup/servicegroup.inc.php on line 177, referer: http://10.64.110.20/nagiosfusion/dashbo ... ?id=55edc9
[Wed Mar 16 09:42:51 2016] [error] [client 10.64.110.18] PHP Warning: Invalid argument supplied for foreach() in /usr/local/nagiosfusion/html/includes/dashlets/servicegroup/servicegroup.inc.php on line 177, referer: http://10.64.110.20/nagiosfusion//dashb ... ?id=rq7k65
[Wed Mar 16 09:43:15 2016] [error] [client 10.64.98.47] PHP Warning: Invalid argument supplied for foreach() in /usr/local/nagiosfusion/html/includes/dashlets/servicegroup/servicegroup.inc.php on line 177, referer: http://10.64.110.20/nagiosfusion/dashbo ... ?id=rq7k65
[Wed Mar 16 09:43:18 2016] [error] [client 10.64.110.18] PHP Warning: Invalid argument supplied for foreach() in /usr/local/nagiosfusion/html/includes/dashlets/servicegroup/servicegroup.inc.php on line 177, referer: http://10.64.110.20/nagiosfusion/dashbo ... ?id=rq7k65
[Wed Mar 16 09:43:44 2016] [error] [client 10.64.110.18] PHP Warning: Invalid argument supplied for foreach() in /usr/local/nagiosfusion/html/includes/dashlets/servicegroup/servicegroup.inc.php on line 177, referer: http://10.64.110.20/nagiosfusion/dashbo ... ?id=55edc9

this are the errors i get in error_log file. it logs few lines per minute.

Re: Nagios XI https Deny TCP every now and then

Posted: Wed Mar 16, 2016 5:04 pm
by rkennedy
When this happens, do you notice anything on the error_log with the XI machine?

Are these systems on the same LAN?