check_proc services - why attached to windows group?

[wyoder]

Hello:

We've grouped our servers into various hostgroups and have started attaching relevant services to each.

For example, to our 'windows_baseline' hostgroup, we've attached several custom services:

WINDOWS-LOGON-ERRORS.cfg
WINDOWS-PAGE-FILE-SERVICE.cfg
WINDOWS-SERVER-WORK-QUEUES.cfg
WINDOWS-STANDARD-C-DRIVE.cfg
WINDOWS-STANDARD-CPU-SERVICE.cfg
WINDOWS-STANDARD-MEMORY-SERVICE.cfg
WINDOWS-UPTIME.cfg

Each of these services is based on a pre-defined setting. Well and good.

What's not good is that Nagios XI shows that each host in this windows-baseline has a phantom service which is checking unsuccessfuly, namely, a Linux service, "check_proc".

I've examined all the cfg files under /usr/local/nagios/etc and 'check_proc' appears as it should, in:
commands.cfg
nrpe.cfg
services/REDHAT-STANDARD-PROCESSES.cfg
services/UBUNTU-PROCESS-CHECK.cfg

I don't understand why Nagios is trying to apply check_proc to our Windows servers.

Attached is a system profile for examination.

One note: Every 5 minutes a cronjob runs and produces the same email message to root. Example:

To: [email protected]
Subject: Cron <root@nagios03> LANG=C LC_ALL=C /usr/bin/mrtg /etc/mrtg/mrtg.cfg --lock-file /var/lock/mrtg/mrtg_l --confcache-file /var/lib/mrtg/mrtg.ok
Date: Wed, 18 May 2016 14:35:01 -0400 (EDT)

ERROR: unable to open include file: conf.d/*.cfg

Could this ERROR be related?

Thanks in advance for helping us get rid of the spurious process checks on the Windows servers.

--Bill

[tgriep]

In the REDHAT-STANDARD-PROCESSES config, you have an * in the host_name field which is applying that service check to all hosts and that could be the reason you are seeing that service check on windows hosts.
Edit that check and remove the * from the host name, save and apply the config.
Did that fix it for you?

The MRTG emails you are receiving, can you run the following on the XI server as root and post the output?

Code: Select all

LANG=C LC_ALL=C /usr/bin/mrtg

[wyoder]

Bingo, tgriep! Getting rid of that rogue '*' did the trick. Would never have figured it out. Thanks a bunch!

Concerning the 5-minute emails, the output from mrtg isn't too helpful:

Code: Select all

# LANG=C LC_ALL=C /usr/bin/mrtg
Usage: mrtg <config-file>

mrtg-2.16.2 - Multi Router Traffic Grapher

etc. 

Running the whole enchilada isn't much better:

Code: Select all

# LANG=C LC_ALL=C /usr/bin/mrtg /etc/mrtg/mrtg.cfg --lock-file /var/lock/mrtg/mrtg_l --confcache-file /var/lib/mrtg/mrtg.ok
ERROR: unable to open include file: conf.d/*.cfg

That's it. Am I running the command correctly?

--Bill

[tgriep]

No, you are running the command correctly. I needed to get the version of MRTG that you are running.
The include file option was added to a newer version of MRTG than you are running, can you upgrade to the latest version of MRTG on your server?

[wyoder]

Hello, tgriep:

Some good news:

I downloaded mrtg-2.17.4 from Tobi's website, configured, built, and installed it in /usr/bin/mrtg. Now we see:

Code: Select all

# LANG=C LC_ALL=C /usr/bin/mrtg 
Usage: mrtg <config-file>

mrtg-2.17.4 - Multi Router Traffic Grapher

Immediately afterwards, we see no more email complaints! Your solution works. Thanks very much. You can close this Post.

--Bill