Page 1 of 1

Nsclient++

Posted: Mon Feb 08, 2016 1:38 pm
by tejanagios
Hi,

Apologies for the long questionnaire. I am confused a bit too much, please read on. Thanks.
I am a complete beginner at nagiosxi, we are actively planning on implementing a monitoring solution using nagios xi,
Once after I've understood all the ins and outs of xi.
I've got some 35 windows servers in the cloud that I wish to monitor.
I've started with installing nsclient++ and using nrpe as given in the documents.
Opened ports 5666, checked external scripts option and added a few powershell scripts and returned the exit codes
To nagios.
Now, this is where it's starting to get confusing. I've tried to download and install nsclient++ today,, the Msi file has the title ncsa.msi, installing it with enabling nrpe is still making the service to listen to 12489 port instead of 5666. I have read that you can monitor log files from the built in commands of
Nsclient++, if so, is there any documentation you have please point me to that.
Also, what's up with check_nt. (I understand that it is one of the transport mechanism that's built into nsclient++ to relay status changes to nagios). Also is there any document that explains how to use wmi for logs, or is there a way to do it natively via nsclient built in checks or should I rely on powershell and port the results via nrpe to nagios..?

Other than those outdated assets documents about configuring nagios, is there more recent and clear explanations on how things work at least in nagiosxi.

Re: Nsclient++

Posted: Mon Feb 08, 2016 2:58 pm
by rkennedy
To help separate this thread, I'm going to quote this individually.
Now, this is where it's starting to get confusing. I've tried to download and install nsclient++ today,, the Msi file has the title ncsa.msi, installing it with enabling nrpe is still making the service to listen to 12489 port instead of 5666.
check_nt will use port 12489 by default, you may need to enable NRPE in your configuration file, as well as define the NRPE port. Can you post your NSClient++ configuration for us to review?
I have read that you can monitor log files from the built in commands of Nsclient++, if so, is there any documentation you have please point me to that.
What sort of log files are you looking to monitor specifically? Here's documentation on NSClient++ - https://docs.nsclient.org/
Also, what's up with check_nt. (I understand that it is one of the transport mechanism that's built into nsclient++ to relay status changes to nagios). Also is there any document that explains how to use wmi for logs, or is there a way to do it natively via nsclient built in checks or should I rely on powershell and port the results via nrpe to nagios..?
We have an exchange of plugins ( https://exchange.nagios.org ) which might have a plugin already written for you to use. Search through it and see if something works for you. I did find this plugin fairly quick, https://exchange.nagios.org/directory/P ... MI/details
Other than those outdated assets documents about configuring nagios, is there more recent and clear explanations on how things work at least in nagiosxi.
What information are you looking for exactly? I can then point you in the right direction.

Re: Nsclient++

Posted: Tue Feb 09, 2016 5:28 am
by tejanagios
HI,
Thank you for your reply; to begin with;

here is the working version of my nsc.ini file; i shall comment the lines that i am not sure of or don't understand completely.

I gather that, on nagios XI side all the monitoring plugins, can either use NCSA using 12489 or NRPE protocols for transport. the nsclient has modules that you enable for these checks to carry.

NRPE has no built in checks with-in nsclient++, the check_cpu, check_memory, check_disk plugins on nagiosxi, are carried out by ncsa ?

Like i said yesterday, i want to monitor windows log events, the built in configuration wizard, requires you to download an agent, but the agent crashes while trying to install on server 2012 R2. so, i've used powershell
scripts and piped the results via external scripts to nagios.

the library for checkeventlog.dll # how is this useful and how do I make use of it?

can i choose to run my nagios xi monitoring only through nrpe or do i need ncsa as well ?

all the built in plugins that nagios xi provides, can they work with any transport protocol.?

Finally, do i have to manually configure my windows firewall to enable ports 5666 or does the installer does it for me

here is my sample nsc.ini file (this is working for me, even though i haven't configured port 12489, looks like enabling ncs library was enough for it talk).

version (0.3.9) ; a lot of things changed when i checked the 0.4.4.15, so if you could point me towards the missing or upgraded functionality bits please. Much appreciated

Code: Select all

[modules]
NRPEListener.dll
NSClientListener.dll
FileLogger.dll
CheckSystem.dll
CheckDisk.dll
CheckEventLog.dll
CheckHelpers.dll
FileLogger.dll
CheckSystem.dll
CheckDisk.dll
NSClientListener.dll
NRPEListener.dll
SysTray.dll
CheckEventLog.dll
CheckHelpers.dll
CheckWMI.dll
CheckNSCP.dll

 Script to check external scripts and/or internal aliases.
CheckExternalScripts.dll= 1  ; Needs to be enabled to check external scripts
;
; NSCA Agent if you enable this NSClient++ will talk to NSCA hosts repeatedly (so dont enable unless you want to use NSCA)
NSCAAgent.dll
;
; LUA script module used to write your own "check deamon".
;LUAScript.dll
;
; RemoteConfiguration IS AN EXTREM EARLY IDEA SO DONT USE FOR PRODUCTION ENVIROMNEMTS!
;RemoteConfiguration.dll
; Check other hosts through NRPE extreme beta and probably a bit dangerous! :)
;NRPEClient.dll
; Extreamly early beta of a task-schedule checker
;CheckTaskSched.dll

[crash]
; Archive crash dump files if a crash is detected
;archive=1

; Submit crash reports to a crash report server (this overrrides archive)
;submit=0

; Restart service if a crash is detected
;restart=1

[Settings]
;# OBFUSCATED PASSWORD
;  This is the same as the password option but here you can store the password in an obfuscated manner.
;  *NOTICE* obfuscation is *NOT* the same as encryption, someone with access to this file can still figure out the 
;  password. Its just a bit harder to do it at first glance.
;obfuscated_password=Jw0KAUUdXlAAUwASDAAB
;
;# PASSWORD
;  This is the password (-s) that is required to access NSClient remotely. If you leave this blank everyone will be able to access the daemon remotly.
;password=secret-password
;
;# ALLOWED HOST ADDRESSES
;  This is a comma-delimited list of IP address of hosts that are allowed to talk to the all daemons.
;  If leave this blank anyone can access the deamon remotly (NSClient still requires a valid password).
;  The syntax is host or ip/mask so 192.168.0.0/24 will allow anyone on that subnet access
;allowed_hosts=127.0.0.1/32
;
;# USE THIS FILE
;  Use the INI file as opposed to the registry if this is 0 and the use_reg in the registry is set to 1 
;  the registry will be used instead.
use_file=1
allowed_hosts=172.24.48.16
password=2willpass
;
; # USE SHARED MEMORY CHANNELS
;  This is the "new" way for using the system tray based on an IPC framework on top shared memmory channels and events.
;  It is brand new and (probably has bugs) so dont enable this unless for testing!
;  If set to 1 shared channels will be created and system tray icons created and such and such...
;shared_session=0


[log]
;# LOG DEBUG
;  Set to 1 if you want debug message printed in the log file (debug messages are always printed to stdout when run with -test)
;debug=1
;
;# LOG FILE
;  The file to print log statements to
;file=nsclient.log
;
;# LOG DATE MASK
;  The format to for the date/time part of the log entry written to file.
;date_mask=%Y-%m-%d %H:%M:%S
;
;# LOG ROOT FOLDER
;  The root folder to use for logging.
;  exe = the folder where the executable is located
;  local-app-data = local application data (probably a better choice then the old default)
;root_folder=exe


[NSClient]
;# ALLOWED HOST ADDRESSES
;  This is a comma-delimited list of IP address of hosts that are allowed to talk to NSClient deamon.
;  If you leave this blank the global version will be used instead.
;allowed_hosts=
;
;# NSCLIENT PORT NUMBER
;  This is the port the NSClientListener.dll will listen to.
;port=12489
;
;# BIND TO ADDRESS
;  Allows you to bind server to a specific local address. This has to be a dotted ip adress not a hostname.
;  Leaving this blank will bind to all avalible IP adresses.
;bind_to_address=
;
;# SOCKET TIMEOUT
;  Timeout when reading packets on incoming sockets. If the data has not arrived withint this time we will bail out.
;socket_timeout=30

[NRPE]
;# NRPE PORT NUMBER
;  This is the port the NRPEListener.dll will listen to.
port=5666
;
;# COMMAND TIMEOUT
;  This specifies the maximum number of seconds that the NRPE daemon will allow plug-ins to finish executing before killing them off.
command_timeout=60
;
;# COMMAND ARGUMENT PROCESSING
;  This option determines whether or not the NRPE daemon will allow clients to specify arguments to commands that are executed.
allow_arguments=1
;
;# COMMAND ALLOW NASTY META CHARS
;  This option determines whether or not the NRPE daemon will allow clients to specify nasty (as in |`&><'"\[]{}) characters in arguments.
;allow_nasty_meta_chars=0
;
;# USE SSL SOCKET
;  This option controls if SSL should be used on the socket.
;use_ssl=1
;
;# BIND TO ADDRESS
;  Allows you to bind server to a specific local address. This has to be a dotted ip adress not a hostname.
;  Leaving this blank will bind to all avalible IP adresses.
; bind_to_address=
;
;# ALLOWED HOST ADDRESSES
;  This is a comma-delimited list of IP address of hosts that are allowed to talk to NRPE deamon.
;  If you leave this blank the global version will be used instead.
;allowed_hosts=
;
;# SCRIPT DIRECTORY
;  All files in this directory will become check commands.
;  *WARNING* This is undoubtedly dangerous so use with care!
;script_dir=scripts\
;
;# SOCKET TIMEOUT
;  Timeout when reading packets on incoming sockets. If the data has not arrived withint this time we will bail out.
;socket_timeout=30

[Check System]
;# CPU BUFFER SIZE
;  Can be anything ranging from 1s (for 1 second) to 10w for 10 weeks. Notice that a larger buffer will waste memory 
;  so don't use a larger buffer then you need (ie. the longest check you do +1).
;CPUBufferSize=1h
;
;# CHECK RESOLUTION
;  The resolution to check values (currently only CPU).
;  The value is entered in 1/10:th of a second and the default is 10 (which means ones every second)
;CheckResolution=10
;
;# CHECK ALL SERVICES
;  Configure how to check services when a CheckAll is performed.
;  ...=started means services in that class *has* to be running.
;  ...=stopped means services in that class has to be stopped.
;  ...=ignored means services in this class will be ignored.
;check_all_services[SERVICE_BOOT_START]=ignored
;check_all_services[SERVICE_SYSTEM_START]=ignored
;check_all_services[SERVICE_AUTO_START]=started
;check_all_services[SERVICE_DEMAND_START]=ignored
;check_all_services[SERVICE_DISABLED]=stopped

[External Script]
;# COMMAND TIMEOUT
;  This specifies the maximum number of seconds that the NRPE daemon will allow plug-ins to finish executing before killing them off.
command_timeout=60
;
;# COMMAND ARGUMENT PROCESSING
;  This option determines whether or not the NRPE daemon will allow clients to specify arguments to commands that are executed.
;allow_arguments=0
;
;# COMMAND ALLOW NASTY META CHARS
;  This option determines whether or not the NRPE daemon will allow clients to specify nasty (as in |`&><'"\[]{}) characters in arguments.
;allow_nasty_meta_chars=0
;
;# SCRIPT DIRECTORY
;  All files in this directory will become check commands.
;  *WARNING* This is undoubtedly dangerous so use with care!
;script_dir=c:\my\script\dir

[Script Wrappings]
vbs=cscript.exe //T:30 //NoLogo scripts\lib\wrapper.vbs %SCRIPT% %ARGS%
ps1=cmd /c echo scripts\%SCRIPT% %ARGS%; exit($lastexitcode) | powershell.exe -command -
bat=scripts\%SCRIPT% %ARGS%

[External Scripts]
;check_es_long=scripts\long.bat
;check_es_ok=scripts\ok.bat
;check_es_nok=scripts\nok.bat
;check_vbs_sample=cscript.exe //T:30 //NoLogo scripts\check_vb.vbs
;check_powershell_warn=cmd /c echo scripts\powershell.ps1 | powershell.exe -command -
;script1
check_updates=cmd /c echo scripts\check-updates.ps1;exit $LastExitCode | powershell.exe -command - 
check_winevents=cmd /c echo scripts\eventlog.ps1;exit $LastExitCode | powershell.exe -command -    


[External Alias]
alias_cpu=checkCPU warn=80 crit=90 time=5m time=1m time=30s
alias_cpu_ex=checkCPU warn=$ARG1$ crit=$ARG2$ time=5m time=1m time=30s
alias_mem=checkMem MaxWarn=80% MaxCrit=90% ShowAll=long type=physical type=virtual type=paged type=page
alias_up=checkUpTime MinWarn=1d MinWarn=1h

alias_disk=CheckDriveSize MinWarn=10% MinCrit=5% CheckAll FilterType=FIXED
alias_disk_loose=CheckDriveSize MinWarn=10% MinCrit=5% CheckAll FilterType=FIXED ignore-unreadable
alias_volumes=CheckDriveSize MinWarn=10% MinCrit=5% CheckAll=volumes FilterType=FIXED
alias_volumes_loose=CheckDriveSize MinWarn=10% MinCrit=5% CheckAll=volumes FilterType=FIXED ignore-unreadable 

alias_service=checkServiceState CheckAll
alias_service_ex=checkServiceState CheckAll "exclude=Net Driver HPZ12" "exclude=Pml Driver HPZ12" exclude=stisvc
alias_process=checkProcState "$ARG1$=started"
alias_process_stopped=checkProcState "$ARG1$=stopped"
alias_process_count=checkProcState MaxWarnCount=$ARG2$ MaxCritCount=$ARG3$ "$ARG1$=started"
alias_process_hung=checkProcState MaxWarnCount=1 MaxCritCount=1 "$ARG1$=hung"

alias_event_log=CheckEventLog file=application file=system MaxWarn=1 MaxCrit=1 "filter=generated gt -2d AND severity NOT IN ('success', 'informational') AND source != 'SideBySide'" truncate=800 unique descriptions "syntax=%severity%: %source%: %message% (%count%)"

alias_file_size=CheckFiles "filter=size > $ARG2$" "path=$ARG1$" MaxWarn=1 MaxCrit=1 "syntax=%filename% %size%" max-dir-depth=10
alias_file_age=checkFile2 filter=out "file=$ARG1$" filter-written=>1d MaxWarn=1 MaxCrit=1 "syntax=%filename% %write%"

alias_sched_all=CheckTaskSched "filter=exit_code ne 0" "syntax=%title%: %exit_code%" warn=>0
alias_sched_long=CheckTaskSched "filter=status = 'running' AND most_recent_run_time < -$ARG1$" "syntax=%title% (%most_recent_run_time%)" warn=>0
alias_sched_task=CheckTaskSched "filter=title eq '$ARG1$' AND exit_code ne 0" "syntax=%title% (%most_recent_run_time%)" warn=>0

alias_updates=check_updates -warning 0 -critical 0

check_ok=CheckOK Everything is fine!

[Wrapped Scripts]
;check_test_vbs=check_test.vbs /arg1:1 /arg2:1 /variable:1
;check_test_ps1=check_test.ps1 arg1 arg2
;check_test_bat=check_test.bat arg1 arg2
;check_battery=check_battery.vbs
;check_printer=check_printer.vbs
;check_updates=check_updates.vbs


; [includes]
;# The order when used is "reversed" thus the last included file will be "first"
;# Included files can include other files (be carefull only do basic recursive checking)
;
; myotherfile.ini
; real.ini


[NSCA Agent]
;# CHECK INTERVALL (in seconds)
;   How often we should run the checks and submit the results.
;interval=5
;
;# ENCRYPTION METHOD
;   This option determines the method by which the send_nsca client will encrypt the packets it sends 
;   to the nsca daemon. The encryption method you choose will be a balance between security and 
;   performance, as strong encryption methods consume more processor resources.
;   You should evaluate your security needs when choosing an encryption method.
;
; Note: The encryption method you specify here must match the decryption method the nsca daemon uses 
;       (as specified in the nsca.cfg file)!!
; Values:
;	0 = None	(Do NOT use this option)
;	1 = Simple XOR  (No security, just obfuscation, but very fast)
;   2 = DES
;   3 = 3DES (Triple DES)
;	4 = CAST-128
;	6 = xTEA
;	8 = BLOWFISH
;	9 = TWOFISH
;	11 = RC2
;	14 = RIJNDAEL-128 (AES)
;	20 = SERPENT
;encryption_method=14
;
;# ENCRYPTION PASSWORD
;  This is the password/passphrase that should be used to encrypt the sent packets. 
;password=
;
;# BIND TO ADDRESS
;  Allows you to bind server to a specific local address. This has to be a dotted ip adress not a hostname.
;  Leaving this blank will bind to "one" local interface.
; -- not supported as of now -- 
;bind_to_address=
;
;# LOCAL HOST NAME
;  The name of this host (if empty "computername" will be used.
;hostname=
;
;# NAGIOS SERVER ADDRESS
;  The address to the nagios server to submit results to.
;nsca_host=192.168.0.1
;
;# NAGIOS SERVER PORT
;  The port to the nagios server to submit results to.
;nsca_port=5667
;

;# CHECK COMMAND LIST
;  The checks to run everytime we submit results back to nagios
;  Any command(alias/key) starting with a host_ is sent as HOST_COMMAND others are sent as SERVICE_COMMANDS
;  where the alias/key is used as service name.
;
[NSCA Commands]
;my_cpu_check=checkCPU warn=80 crit=90 time=20m time=10s time=4
;my_mem_check=checkMem MaxWarn=80% MaxCrit=90% ShowAll type=page
;my_svc_check=checkServiceState CheckAll exclude=wampmysqld exclude=MpfService
;host_check=check_ok

;# REMOTE NRPE PROXY COMMANDS
;  A list of commands that check other hosts.
;  Used by the NRPECLient module
[NRPE Client Handlers]
check_other=-H 192.168.0.1 -p 5666 -c remote_command -a arguments

;# LUA SCRIPT SECTION
;  A list of all Lua scripts to load.
;[LUA Scripts]
;scripts\test.lua

Re: Nsclient++

Posted: Tue Feb 09, 2016 3:42 pm
by bwallace
On the topic of monitoring Windows event logs, it would be far easier to use Nagios log Server (NLS) for this. NLS was built specifically for this function. The install / configuration is rather straight forward and quick.

https://assets.nagios.com/downloads/nag ... itions.pdf
https://library.nagios.com/library/prod ... /downloads


As for XI and NSClient, some basic notes:
Use NSClient version 4.x - this is more secure, more stable on Win 2012, and better equipped for NRPE than 3.x
All corresponding ports must be manually opened on any firewalls, the install script will not do this for you.
NRPE listens on 5666 (check_nrpe)
NSClient = 12489 (check_nt)
NSCA - 5667


If NLS won't work for you and you need to monitor Windows Event logs via XI, the two most common approaches are to use NSClient with either NRPE or NSCA.
An excellent doc on monitoring Windows Event logs via NSCA is found here:
https://outsideit.net/real-time-eventlog-monitoring/

Refer to this doc on using NRPE to monitor Windows event logs:
https://www.medin.name/blog/2012/03/20/ ... -nsclient/

General monitoring:
NSClient++ provides ready-to-use commands through its modules (check_nt). So for the most common checks you do not need to configure external scripts. However, these common checks may not meet your needs as there are a limited number available - now this is ok to get started with, but even the NSCLient++ developers recommend using NRPE instead:
http://docs.nsclient.org/tutorial/nagios/check_nt.html
http://docs.nsclient.org/tutorial/nagios/nrpe.html

Regarding external scripts

The NSCLient .ini file already contains checks for CPU, memory. Look for 'alias_cpu' or 'alias_mem' - you reference those in your command. Here is a sample check command:

Code: Select all

/usr/local/nagios/libexec/check_nrpe -H 10.11.12.13 -c alias_cpu
CheckExternalScripts reference
http://docs.nsclient.org/reference/chec ... ripts.html


I hope this helps, definitely let us know if you have other questions.