Page 1 of 2
Alert only if service startup type is automatic
Posted: Wed Jul 20, 2016 12:00 am
by jyoti22
Hi Team,
I would like to monitor a service with NSClinet++ which alerts only if service startup type is automatic. How can I implement this kind of monitoring? Please help.
Regards,
Jyoti
Re: Alert only if service startup type is automatic
Posted: Wed Jul 20, 2016 9:16 am
by tmcdonald
This site presents a plugin which specifies this option:
Code: Select all
--startmode startmode[,startmode ...] ] ...
Specifies service start modes you want to monitor. You can supply comma separated values as well as multiple --startmode options. In addition, you may negate a start mode by prepending a ! (like !auto). Available start mode values (case insensitive):
- auto
- manual
- disabled
- boot
- system
Optional. Defaults to all start modes.
That sounds like it could be used to determine if a check is automatic or not.
This does appear to be a .exe file at least in part, so I would run it through VirusTotal or something similar to verify it before running.
Re: Alert only if service startup type is automatic
Posted: Thu Jul 21, 2016 3:31 am
by jyoti22
I do not know how to install the plugin on client machine and how to update NSC.ini accordingly. Can you please help on it.
Re: Alert only if service startup type is automatic
Posted: Thu Jul 21, 2016 4:48 am
by spurrellian
Is this for Windows?
Which version of NSCLient do you use?
Check_nrpe can monitor automatic services and alert
Code: Select all
[root@wxapsnagip01 libexec]# ./check_nrpe -H WXFPS2012R2 -c Check_Service -a show-all
OK: All 153 service(s) are ok.
I have a check that checks all automatic services, if any fail an event handler will restart them. If that is usefull I can pass on how I set it up
Re: Alert only if service startup type is automatic
Posted: Thu Jul 21, 2016 10:34 am
by mcapra
Thanks for offering to help out
@spurrellian!
jyoti22 wrote:I do not know how to install the plugin on client machine and how to update NSC.ini accordingly. Can you please help on it.
Here's a brief overview of how to do general configuration of NSClient++:
https://assets.nagios.com/downloads/nag ... ios-XI.pdf
The official NSClient++ documentation for adding external scripts:
https://docs.nsclient.org/0.4.4/howto/e ... g-a-script
Also be sure to enable the proper flags for command arguments:
https://docs.nsclient.org/0.4.4/howto/e ... #arguments
Definitely let us know if none of that documentation is able to offer any assistance!
Re: Alert only if service startup type is automatic
Posted: Mon Jul 25, 2016 6:06 am
by jyoti22
Hi,
I have copied check_winservice.pl in folder "C:\Program Files\NSClient++". However I am not able to modify NSC.ini file for this *.pl external script.
How can I modify NSC.ini go get correct output for plugin. Also on XI server, how can I configure command for this plugin? please help.
Regards,
Jyoti
Re: Alert only if service startup type is automatic
Posted: Mon Jul 25, 2016 9:55 am
by bwallace
This doc will show you how to import the plugin to XI and how to configure the command:
https://assets.nagios.com/downloads/nag ... ios-XI.pdf
What problems are you having with modifying NSC.ini file? Can you post the steps you are taking and specify at what step the problem occurs?
Re: Alert only if service startup type is automatic
Posted: Mon Jul 25, 2016 10:37 am
by mcapra
spurrellian wrote:
Which version of NSCLient do you use?
This question still needs to be answered. NSClient has slightly different configurations depending on the version.
I labbed this internally to monitor the
nscp service to make sure it's set to automatically start. If it is
not set to automatically start, a critical alert is returned.
Things I did to set this up:
- I dropped the contents of check_winservice-1.1.zip into the NSClient++\scripts directory.
- I added CheckAutoNSCP=scripts\check_winservice.exe --service nscp --startmode !auto --critical 1 to my nsclient.ini file under the external scripts definitions (this might be a different name depending on your version).
- I restarted the NSClient++ service.
Since my arguments for the check_winservice plugin are set to get all services with the name
nscp where the start mode is
not auto, we should expect this plugin to return 0 services (since nscp is set to automatically start). Then, from the CLI of the Nagios XI server:
Code: Select all
[root@localhost libexec]# ./check_nrpe -H 192.168.3.170 -c CheckAutoNSCP
SERVICE OK - 0 service(s).|'services'=0;;1
I then configured that CLI command as a Nagios XI command.
Code: Select all
$USER1$/check_nrpe -H $HOSTADDRESS$ -c CheckAutoNSCP
And used that Command definition in a Service definition:

Re: Alert only if service startup type is automatic
Posted: Tue Jul 26, 2016 6:26 am
by jyoti22
Hi,
I am using NSClient++ 0.4.3.143 2015-04-29 on client machine
and configured the service like below in NSC.ini
Code: Select all
# If you want to fill this file with all avalible options run the following command:
# nscp settings --generate --add-defaults --load-all
# If you want to activate a module and bring in all its options use:
# nscp settings --activate-module <MODULE NAME> --add-defaults
# For details run: nscp settings --help
; Undocumented section
[/settings/default]
; ALLOWED HOSTS - A comaseparated list of allowed hosts. You can use netmasks (/ syntax) or * to create ranges.
allowed hosts = 10.161.4.180
; Undocumented section
[/modules]
; CheckSystem - Various system related checks, such as CPU load, process state, service state memory usage and PDH counters.
CheckSystem = 1
; NSClientServer - A server that listens for incoming check_nt connection and processes incoming requests.
NSClientServer = 1
; CheckExternalScripts - Execute external scripts
CheckExternalScripts = 1
; CheckHelpers - Various helper function to extend other checks.
CheckHelpers = 1
; CheckEventLog - Check for errors and warnings in the event log.
CheckEventLog = 1
CheckEventLog=enabled
realtime = enabled
; CheckDisk - CheckDisk can check various file and disk related things.
CheckDisk = 1
; CheckNSCP - Use this module to check the healt and status of NSClient++ it self
CheckNSCP = 1
; A list of templates for wrapped scripts.
%SCRIPT% will be replaced by the actual script an %ARGS% will be replaced by any given arguments.
[/settings/external scripts/wrappings]
; POWERSHELL WRAPPING -
ps1 = cmd /c echo scripts\\%SCRIPT% %ARGS%; exit($lastexitcode) | powershell.exe -command -
CheckAutoBrowser=scripts\check_winservice.exe --service Browser --startmode auto --critical 0
; BATCH FILE WRAPPING -
bat = scripts\\%SCRIPT% %ARGS%
; VISUAL BASIC WRAPPING -
vbs = cscript.exe //T:30 //NoLogo scripts\\lib\\wrapper.vbs %SCRIPT% %ARGS%
; A list of aliases available.
An alias is an internal command that has been predefined to provide a single command without arguments. Be careful so you don't create loops (ie check_loop=check_a, check_a=check_loop)
[/settings/external scripts/alias]
; alias_volumes_loose - Alias for alias_volumes_loose. To configure this item add a section called: /settings/external scripts/alias/alias_volumes_loose
alias_volumes_loose = check_drivesize
; alias_volumes - Alias for alias_volumes. To configure this item add a section called: /settings/external scripts/alias/alias_volumes
alias_volumes = check_drivesize
; alias_up - Alias for alias_up. To configure this item add a section called: /settings/external scripts/alias/alias_up
alias_up = check_uptime
; alias_sched_all - Alias for alias_sched_all. To configure this item add a section called: /settings/external scripts/alias/alias_sched_all
alias_sched_all = check_tasksched show-all "syntax=${title}: ${exit_code}" "crit=exit_code ne 0"
; alias_service - Alias for alias_service. To configure this item add a section called: /settings/external scripts/alias/alias_service
alias_service = check_service
; alias_process_stopped - Alias for alias_process_stopped. To configure this item add a section called: /settings/external scripts/alias/alias_process_stopped
alias_process_stopped = check_process "process=$ARG1$" "crit=state != 'stopped'"
; alias_process_hung - Alias for alias_process_hung. To configure this item add a section called: /settings/external scripts/alias/alias_process_hung
alias_process_hung = check_process "filter=is_hung" "crit=count>0"
; alias_process_count - Alias for alias_process_count. To configure this item add a section called: /settings/external scripts/alias/alias_process_count
alias_process_count = check_process "process=$ARG1$" "warn=count > $ARG2$" "crit=count > $ARG3$"
; alias_process - Alias for alias_process. To configure this item add a section called: /settings/external scripts/alias/alias_process
alias_process = check_process "process=$ARG1$" "crit=state != 'started'"
; alias_mem - Alias for alias_mem. To configure this item add a section called: /settings/external scripts/alias/alias_mem
alias_mem = check_memory
; alias_file_size - Alias for alias_file_size. To configure this item add a section called: /settings/external scripts/alias/alias_file_size
alias_file_size = check_files "path=$ARG1$" "crit=size > $ARG2$" "top-syntax=${list}" "detail-syntax=${filename] ${size}" max-dir-depth=10
; alias_service_ex - Alias for alias_service_ex. To configure this item add a section called: /settings/external scripts/alias/alias_service_ex
alias_service_ex = check_service "exclude=Net Driver HPZ12" "exclude=Pml Driver HPZ12" exclude=stisvc
; alias_event_log - Alias for alias_event_log. To configure this item add a section called: /settings/external scripts/alias/alias_event_log
alias_event_log = check_eventlog
; alias_disk - Alias for alias_disk. To configure this item add a section called: /settings/external scripts/alias/alias_disk
alias_disk = check_drivesize
; alias_cpu_ex - Alias for alias_cpu_ex. To configure this item add a section called: /settings/external scripts/alias/alias_cpu_ex
alias_cpu_ex = check_cpu "warn=load > $ARG1$" "crit=load > $ARG2$" time=5m time=1m time=30s
; alias_file_age - Alias for alias_file_age. To configure this item add a section called: /settings/external scripts/alias/alias_file_age
alias_file_age = check_files "path=$ARG1$" "crit=written > $ARG2$" "top-syntax=${list}" "detail-syntax=${filename] ${written}" max-dir-depth=10
; alias_cpu - Alias for alias_cpu. To configure this item add a section called: /settings/external scripts/alias/alias_cpu
alias_cpu = check_cpu
; alias_sched_task - Alias for alias_sched_task. To configure this item add a section called: /settings/external scripts/alias/alias_sched_task
alias_sched_task = check_tasksched show-all "filter=title eq '$ARG1$'" "detail-syntax=${title} (${exit_code})" "crit=exit_code ne 0"
; alias_sched_long - Alias for alias_sched_long. To configure this item add a section called: /settings/external scripts/alias/alias_sched_long
alias_sched_long = check_tasksched "filter=status = 'running'" "detail-syntax=${title} (${most_recent_run_time})" "crit=most_recent_run_time < -$ARG1$"
; alias_disk_loose - Alias for alias_disk_loose. To configure this item add a section called: /settings/external scripts/alias/alias_disk_loose
alias_disk_loose = check_drivesize
[/settings/NRPE/server]
port=5666
allow_arguments=1
allow_nasty_meta_chars=1
use_ssl=1
while testing command from XI serevr, get below error
[root@auscrpmonprd00 libexec]# ./check_nrpe -H 10.164.133.13 -c CheckAutoBrowser
CHECK_NRPE: Socket timeout after 10 seconds.
Re: Alert only if service startup type is automatic
Posted: Tue Jul 26, 2016 9:03 am
by mcapra
You seem to have
CheckAutoBrowser defined under your script wrappings. This means that NSClient is going to wrap the *.CheckAutoBrowsers scripts with the
scripts\check_winservice.exe --service Browser --startmode auto --critical 0 script. I don't think this will give you the result you want.
You should define CheckAutoBrowser under the following directive:
Code: Select all
[/settings/external scripts/scripts]
CheckAutoBrowser=scripts\check_winservice.exe --service Browser --startmode auto --critical 0
Since your NRPE server is configured to use port 5666, you may need to tell
check_nrpe to use that port. Can you share the output of:
Code: Select all
./check_nrpe -H 10.164.133.13 -p 5666
And if that fails, the output of:
Code: Select all
./check_nrpe -H 10.164.133.13 -p 5666 -n