Issue with Nagios NRPE v3.2.0 not running as nagios user

[sambaba]

First of all, thank you very much for providing us with the updated version of NRPE 3.2.0. I need some help with the same updated version of nrpe 3.2.0 configuration. In my environment, we used to have Nagios NRPE v2.15 client installed on our AIX 7.1 servers. I updated the NRPE version to 3.2.0 by following all the instructions mentioned in the README.md and also nrpe.pdf.



Configuration went fine along with make, make install, make install-groups-users, make install-config. Every time I start nrpe using the user “root”, it starts successfully but runs as root. I don’t want this to run as root rather run as the service account “nagios” . Earlier with the previous version of nrpe v2.15, even if started with root, Nagios would still run as specified nagios user.



I’ve checked the nrpe.cfg file along with permissions on all the files/folders. User ID and Group ID is set to “nagios:nagios”. There were no error during configuration and make install. Not sure where the issue is.



Server with updated version of NRPE v3.2.0

root@Server1/opt/nagios/nrpe-3.2.0 # /usr/local/nagios/bin/nrpe -c /usr/local/nagios/etc/nrpe.cfg -d

root@Server1/opt/nagios/nrpe-3.2.0 # ps -ef | grep -i nagios

root 14876710 1 0 12:11:10 - 0:00 /usr/local/nagios/bin/nrpe -c /usr/local/nagios/etc/nrpe.cfg -d

root@Server1/opt/nagios/nrpe-3.2.0 # /usr/local/nagios/libexec/check_nrpe -H 127.0.0.1

NRPE v3.2.0

root@Server1/opt/nagios/nrpe-3.2.0 #





Server with previous version of NRPE v2.15 does run as “nagios” user even after started with root and this is what I’m expecting with NRPE v3.2.0



root@Server2/ # /usr/local/nagios/bin/nrpe -c /usr/local/nagios/etc/nrpe.cfg -d

root@Server2/ # ps -ef | grep -i nagios

nagios 6291700 1 0 12:12:37 - 0:00 /usr/local/nagios/bin/nrpe -c /usr/local/nagios/etc/nrpe.cfg -d

root 16580652 10813486 1 12:12:40 pts/0 0:00 grep -i nagios

root@Server2/ # /usr/local/nagios/libexec/check_nrpe -H localhost

NRPE v2.15

root@Server2/ #







Would appreciate if you could help me in solving this issue.

[sambaba]

Code: Select all

Adding the configuration log

checking for a BSD-compatible install... build-aux/install-sh -c
checking what the operating system is ... aix
checking what the distribution type is ... aix
checking what init system is being used ... bsd
checking what inetd is being used ... inetd
checking for which paths to use ... default
checking for which init file to use ... bsd-init
checking for which inetd files to use ... default-inetd
checking for gcc... gcc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables...
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C compiler... yes
checking whether gcc accepts -g... yes
checking for gcc option to accept ISO C89... none needed
checking whether make sets $(MAKE)... yes
checking how to run the C preprocessor... gcc -E
checking for grep that handles long lines and -e... /usr/bin/grep
checking for egrep... /usr/bin/grep -E
checking for ANSI C header files... yes
checking whether time.h and sys/time.h may both be included... yes
checking for sys/wait.h that is POSIX.1 compatible... yes
checking for sys/types.h... yes
checking for sys/stat.h... yes
checking for stdlib.h... yes
checking for string.h... yes
checking for memory.h... yes
checking for strings.h... yes
checking for inttypes.h... yes
checking for stdint.h... yes
checking for unistd.h... yes
checking ctype.h usability... yes
checking ctype.h presence... yes
checking for ctype.h... yes
checking dirent.h usability... yes
checking dirent.h presence... yes
checking for dirent.h... yes
checking errno.h usability... yes
checking errno.h presence... yes
checking for errno.h... yes
checking fcntl.h usability... yes
checking fcntl.h presence... yes
checking for fcntl.h... yes
checking getopt.h usability... no
checking getopt.h presence... no
checking for getopt.h... no
checking grp.h usability... yes
checking grp.h presence... yes
checking for grp.h... yes
checking for inttypes.h... (cached) yes
checking netdb.h usability... yes
checking netdb.h presence... yes
checking for netdb.h... yes
checking pwd.h usability... yes
checking pwd.h presence... yes
checking for pwd.h... yes
checking signal.h usability... yes
checking signal.h presence... yes
checking for signal.h... yes
checking for stdint.h... (cached) yes
checking for strings.h... (cached) yes
checking for string.h... (cached) yes
checking syslog.h usability... yes
checking syslog.h presence... yes
checking for syslog.h... yes
checking tcpd.h usability... no
checking tcpd.h presence... no
checking for tcpd.h... no
checking for unistd.h... (cached) yes
checking arpa/inet.h usability... yes
checking arpa/inet.h presence... yes
checking for arpa/inet.h... yes
checking netinet/in.h usability... yes
checking netinet/in.h presence... yes
checking for netinet/in.h... yes
checking socket.h usability... no
checking socket.h presence... no
checking for socket.h... no
checking for sys/types.h... (cached) yes
checking sys/time.h usability... yes
checking sys/time.h presence... yes
checking for sys/time.h... yes
checking sys/resource.h usability... yes
checking sys/resource.h presence... yes
checking for sys/resource.h... yes
checking for sys/wait.h... (cached) yes
checking sys/socket.h usability... yes
checking sys/socket.h presence... yes
checking for sys/socket.h... yes
checking for sys/stat.h... (cached) yes
checking paths.h usability... yes
checking paths.h presence... yes
checking for paths.h... yes
checking for an ANSI C-conforming const... yes
checking whether struct tm is in sys/time.h or time.h... time.h
checking for mode_t... yes
checking for pid_t... yes
checking for size_t... yes
checking return type of signal handlers... void
checking for uid_t in sys/types.h... yes
checking type of array argument to getgroups... gid_t
checking size of int... 4
checking size of short... 2
checking size of long... 4
checking for uint32_t... yes
checking for u_int32_t... yes
checking for int32_t... yes
checking for struct sockaddr_storage... yes
checking for seteuid... yes
checking for va_copy... yes
checking for vsnprintf... yes
checking for snprintf... yes
checking for asprintf... no
checking for vasprintf... no
checking for C99 vsnprintf... yes
checking for getopt_long... no
checking for getopt_long in -liberty... no
checking for main in -lnsl... yes
checking for socket in -lsocket... no
checking for main in -lwrap... no
checking for strdup... yes
checking for strstr... yes
checking for strtoul... yes
checking for strtok_r... yes
checking for initgroups... yes
checking for closesocket... no
checking for sigaction... yes
checking for scandir... yes
checking for socklen_t... yes
checking for type of socket size... size_t
checking for Kerberos include files... configure: WARNING: could not find include files
checking for pkg-config... no
checking for SSL headers... found in /usr/include/openssl
checking for SSL libraries... found in /usr/lib
checking whether compiling and linking against SSL works... yes
checking for openssl... /bin/openssl

*** Generating DH Parameters for SSL/TLS ***
Generating DH parameters, 2048 bit long safe prime, generator 2
This is going to take a long time
...................................+..................................................+.+.................................................................
................................
checking for perl... /usr/bin/perl
configure: creating ./config.status
config.status: creating Makefile
config.status: creating src/Makefile
config.status: creating nrpe.spec
config.status: creating uninstall
config.status: creating sample-config/nrpe.cfg
config.status: creating startup/bsd-init
config.status: creating startup/debian-init
config.status: creating startup/default-init
config.status: creating startup/default-inetd
config.status: creating startup/default-service
config.status: creating startup/default-socket
config.status: creating startup/default-socket-svc
config.status: creating startup/default-xinetd
config.status: creating startup/mac-init.plist
config.status: creating startup/mac-inetd.plist
config.status: creating startup/newbsd-init
config.status: creating startup/openbsd-init
config.status: creating startup/openrc-conf
config.status: creating startup/openrc-init
config.status: creating startup/solaris-init.xml
config.status: creating startup/solaris-inetd.xml
config.status: creating startup/tmpfile.conf
config.status: creating startup/upstart-init
config.status: creating startup/rh-upstart-init
config.status: creating include/common.h
config.status: creating include/config.h
config.status: include/config.h is unchanged


*** Configuration summary for nrpe 3.2.0 2017-06-27 ***:

 General Options:
 -------------------------
 NRPE port:    5666
 NRPE user:    nagios
 NRPE group:   nagios
 Nagios user:  nagios
 Nagios group: nagios


Review the options above for accuracy.  If they look okay,
type 'make all' to compile the NRPE daemon and client
or type 'make' to get a list of make options.

root@Server1/opt/nagios/nrpe-3.2.0 # cd /opt/nagios/nrpe-3.2.0
root@Server1/opt/nagios/nrpe-3.2.0 # make all
        cd ./src/; make
        gcc -g -O2 -I/usr/include/openssl -DHAVE_CONFIG_H -I ../include -I ./../include -o nrpe ./nrpe.c ./utils.c ./acl.c -L/usr/lib  -lssl -lcrypto -lnsl  ./snprintf.o
./nrpe.c: In function 'init_ssl':
./nrpe.c:289:7: warning: assignment discards 'const' qualifier from pointer target type [enabled by default]
  meth = SSLv23_server_method();
       ^
./nrpe.c:322:8: warning: assignment discards 'const' qualifier from pointer target type [enabled by default]
   meth = SSLv3_server_method();
        ^
./nrpe.c:325:8: warning: assignment discards 'const' qualifier from pointer target type [enabled by default]
   meth = TLSv1_server_method();
        ^
./nrpe.c:328:8: warning: assignment discards 'const' qualifier from pointer target type [enabled by default]
   meth = TLSv1_1_server_method();
        ^
./nrpe.c:331:8: warning: assignment discards 'const' qualifier from pointer target type [enabled by default]
   meth = TLSv1_2_server_method();
        ^
./nrpe.c: In function 'handle_conn_ssl':
./nrpe.c:1957:5: warning: assignment discards 'const' qualifier from pointer target type [enabled by default]
   c = SSL_get_current_cipher(ssl);
     ^
        gcc -g -O2 -I/usr/include/openssl -DHAVE_CONFIG_H -I ../include -I ./../include -o check_nrpe ./check_nrpe.c ./utils.c -L/usr/lib  -lssl -lcrypto -lnsl ./snprintf.o
./check_nrpe.c: In function 'setup_ssl':
./check_nrpe.c:833:8: warning: assignment discards 'const' qualifier from pointer target type [enabled by default]
   meth = SSLv23_client_method();
        ^
./check_nrpe.c:841:9: warning: assignment discards 'const' qualifier from pointer target type [enabled by default]
    meth = SSLv3_client_method();
         ^
./check_nrpe.c:844:9: warning: assignment discards 'const' qualifier from pointer target type [enabled by default]
    meth = TLSv1_client_method();
         ^
./check_nrpe.c:847:9: warning: assignment discards 'const' qualifier from pointer target type [enabled by default]
    meth = TLSv1_1_client_method();
         ^
./check_nrpe.c:850:9: warning: assignment discards 'const' qualifier from pointer target type [enabled by default]
    meth = TLSv1_2_client_method();
         ^
./check_nrpe.c: In function 'connect_to_remote':
./check_nrpe.c:1091:20: warning: initialization discards 'const' qualifier from pointer target type [enabled by default]
    SSL_CIPHER *c = SSL_get_current_cipher(ssl);
                    ^
Target "all" is up to date.

*** Compile finished ***

You can now continue with the installation or upgrade process.

Read the PDF documentation (docs/NRPE.pdf) for information on the next
steps you should take to complete the installation or upgrade.

root@Server1/opt/nagios/nrpe-3.2.0 # make install
        cd ./src/; make install
        make install-plugin
        ../build-aux/install-sh -c -m 755 -d /usr/local/nagios/bin
        ../build-aux/install-sh -c -m 755 ../uninstall /usr/local/nagios/bin/nrpe-uninstall
        ../build-aux/install-sh -c -m 775 -o nagios -g nagios -d /usr/local/nagios/libexec
        ../build-aux/install-sh -c -m 775 -o nagios -g nagios -d /usr/local/nagios/libexec
        ../build-aux/install-sh -c -m 775 -o nagios -g nagios check_nrpe /usr/local/nagios/libexec
        make install-daemon
        ../build-aux/install-sh -c -m 755 -d /usr/local/nagios/bin
        ../build-aux/install-sh -c -m 755 ../uninstall /usr/local/nagios/bin/nrpe-uninstall
        ../build-aux/install-sh -c -m 755 nrpe /usr/local/nagios/bin
root@Server1/opt/nagios/nrpe-3.2.0 # make install-config
        build-aux/install-sh -c -m 775 -o nagios -g nagios -d /usr/local/nagios/etc
        build-aux/install-sh -c -m 644 -o nagios -g nagios sample-config/nrpe.cfg /usr/local/nagios/etc
root@Server1/opt/nagios/nrpe-3.2.0 #

[bolson]

Can you please post the output of:

Code: Select all

cat nrpe.cfg

[sambaba]

Code: Select all

#############################################################################
#
#  Sample NRPE Config File
#
#  Notes:
#
#  This is a sample configuration file for the NRPE daemon.  It needs to be
#  located on the remote host that is running the NRPE daemon, not the host
#  from which the check_nrpe client is being executed.
#
#############################################################################


# LOG FACILITY
# The syslog facility that should be used for logging purposes.

log_facility=daemon



# LOG FILE
# If a log file is specified in this option, nrpe will write to
# that file instead of using syslog.

#log_file=/usr/local/nagios/var/nrpe.log



# DEBUGGING OPTION
# This option determines whether or not debugging messages are logged to the
# syslog facility.
# Values: 0=debugging off, 1=debugging on

debug=0



# PID FILE
# The name of the file in which the NRPE daemon should write it's process ID
# number.  The file is only written if the NRPE daemon is started by the root
# user and is running in standalone mode.

pid_file=/usr/local/nagios/var/nrpe.pid



# PORT NUMBER
# Port number we should wait for connections on.
# NOTE: This must be a non-privileged port (i.e. > 1024).
# NOTE: This option is ignored if NRPE is running under either inetd or xinetd

server_port=5666



# SERVER ADDRESS
# Address that nrpe should bind to in case there are more than one interface
# and you do not want nrpe to bind on all interfaces.
# NOTE: This option is ignored if NRPE is running under either inetd or xinetd

#server_address=127.0.0.1



# LISTEN QUEUE SIZE
# Listen queue size (backlog) for serving incoming connections.
# You may want to increase this value under high load.

#listen_queue_size=5



# NRPE USER
# This determines the effective user that the NRPE daemon should run as.
# You can either supply a username or a UID.
#
# NOTE: This option is ignored if NRPE is running under either inetd or xinetd

nrpe_user=nagios



# NRPE GROUP
# This determines the effective group that the NRPE daemon should run as.
# You can either supply a group name or a GID.
#
# NOTE: This option is ignored if NRPE is running under either inetd or xinetd

nrpe_group=nagios



# ALLOWED HOST ADDRESSES
# This is an optional comma-delimited list of IP address or hostnames
# that are allowed to talk to the NRPE daemon. Network addresses with a bit mask
# (i.e. 192.168.1.0/24) are also supported. Hostname wildcards are not currently
# supported.
#
# Note: The daemon only does rudimentary checking of the client's IP
# address.  I would highly recommend adding entries in your /etc/hosts.allow
# file to allow only the specified host to connect to the port
# you are running this daemon on.
#
# NOTE: This option is ignored if NRPE is running under either inetd or xinetd

allowed_hosts=127.0.0.1,sdssmond6781



# COMMAND ARGUMENT PROCESSING
# This option determines whether or not the NRPE daemon will allow clients
# to specify arguments to commands that are executed.  This option only works
# if the daemon was configured with the --enable-command-args configure script
# option.
#
# *** ENABLING THIS OPTION IS A SECURITY RISK! ***
# Read the SECURITY file for information on some of the security implications
# of enabling this variable.
#
# Values: 0=do not allow arguments, 1=allow command arguments

dont_blame_nrpe=0



# BASH COMMAND SUBSTITUTION
# This option determines whether or not the NRPE daemon will allow clients
# to specify arguments that contain bash command substitutions of the form
# $(...).  This option only works if the daemon was configured with both
# the --enable-command-args and --enable-bash-command-substitution configure
# script options.
#
# *** ENABLING THIS OPTION IS A HIGH SECURITY RISK! ***
# Read the SECURITY file for information on some of the security implications
# of enabling this variable.
#
# Values: 0=do not allow bash command substitutions,
#         1=allow bash command substitutions

allow_bash_command_substitution=0



# COMMAND PREFIX
# This option allows you to prefix all commands with a user-defined string.
# A space is automatically added between the specified prefix string and the
# command line from the command definition.
#
# *** THIS EXAMPLE MAY POSE A POTENTIAL SECURITY RISK, SO USE WITH CAUTION! ***
# Usage scenario:
# Execute restricted commmands using sudo.  For this to work, you need to add
# the nagios user to your /etc/sudoers.  An example entry for allowing
# execution of the plugins from might be:
#
# nagios          ALL=(ALL) NOPASSWD: /usr/lib/nagios/plugins/
#
# This lets the nagios user run all commands in that directory (and only them)
# without asking for a password.  If you do this, make sure you don't give
# random users write access to that directory or its contents!

# command_prefix=/usr/bin/sudo


# MAX COMMANDS
# This specifies how many children processes may be spawned at any one
# time, essentially limiting the fork()s that occur.
# Default (0) is set to unlimited
# max_commands=0



# COMMAND TIMEOUT
# This specifies the maximum number of seconds that the NRPE daemon will
# allow plugins to finish executing before killing them off.

command_timeout=60



# CONNECTION TIMEOUT
# This specifies the maximum number of seconds that the NRPE daemon will
# wait for a connection to be established before exiting. This is sometimes
# seen where a network problem stops the SSL being established even though
# all network sessions are connected. This causes the nrpe daemons to
# accumulate, eating system resources. Do not set this too low.

connection_timeout=300



# WEAK RANDOM SEED OPTION
# This directive allows you to use SSL even if your system does not have
# a /dev/random or /dev/urandom (on purpose or because the necessary patches
# were not applied). The random number generator will be seeded from a file
# which is either a file pointed to by the environment valiable $RANDFILE
# or $HOME/.rnd. If neither exists, the pseudo random number generator will
# be initialized and a warning will be issued.
# Values: 0=only seed from /dev/[u]random, 1=also seed from weak randomness

#allow_weak_random_seed=1



# SSL/TLS OPTIONS
# These directives allow you to specify how to use SSL/TLS.

# SSL VERSION
# This can be any of: SSLv2 (only use SSLv2), SSLv2+ (use any version),
#        SSLv3 (only use SSLv3), SSLv3+ (use SSLv3 or above), TLSv1 (only use
#        TLSv1), TLSv1+ (use TLSv1 or above), TLSv1.1 (only use TLSv1.1),
#        TLSv1.1+ (use TLSv1.1 or above), TLSv1.2 (only use TLSv1.2),
#        TLSv1.2+ (use TLSv1.2 or above)
# If an "or above" version is used, the best will be negotiated. So if both
# ends are able to do TLSv1.2 and use specify SSLv2, you will get TLSv1.2.
# If you are using openssl 1.1.0 or above, the SSLv2 options are not available.

#ssl_version=SSLv2+

# SSL USE ADH
# This is for backward compatibility and is DEPRECATED. Set to 1 to enable
# ADH or 2 to require ADH. 1 is currently the default but will be changed
# in a later version.

#ssl_use_adh=1

# SSL CIPHER LIST
# This lists which ciphers can be used. For backward compatibility, this
# defaults to 'ssl_cipher_list=ALL:!MD5:@STRENGTH' for < OpenSSL 1.1.0,
# and 'ssl_cipher_list=ALL:!MD5:@STRENGTH:@SECLEVEL=0' for OpenSSL 1.1.0 and
# greater.

#ssl_cipher_list=ALL:!MD5:@STRENGTH
#ssl_cipher_list=ALL:!MD5:@STRENGTH:@SECLEVEL=0
#ssl_cipher_list=ALL:!aNULL:!eNULL:!SSLv2:!LOW:!EXP:!RC4:!MD5:@STRENGTH

# SSL Certificate and Private Key Files

#ssl_cacert_file=/etc/ssl/servercerts/ca-cert.pem
#ssl_cert_file=/etc/ssl/servercerts/nagios-cert.pem
#ssl_privatekey_file=/etc/ssl/servercerts/nagios-key.pem

# SSL USE CLIENT CERTS
# This options determines client certificate usage.
# Values: 0 = Don't ask for or require client certificates (default)
#         1 = Ask for client certificates
#         2 = Require client certificates

#ssl_client_certs=0

# SSL LOGGING
# This option determines which SSL messages are send to syslog. OR values
# together to specify multiple options.

# Values: 0x00 (0)  = No additional logging (default)
#         0x01 (1)  = Log startup SSL/TLS parameters
#         0x02 (2)  = Log remote IP address
#         0x04 (4)  = Log SSL/TLS version of connections
#         0x08 (8)  = Log which cipher is being used for the connection
#         0x10 (16) = Log if client has a certificate
#         0x20 (32) = Log details of client's certificate if it has one
#         -1 or 0xff or 0x2f = All of the above

#ssl_logging=0x00



# NASTY METACHARACTERS
# This option allows you to override the list of characters that cannot
# be passed to the NRPE daemon.

# nasty_metachars="|`&><'\\[]{};\r\n"


# INCLUDE CONFIG FILE
# This directive allows you to include definitions from an external config file.

#include=<somefile.cfg>



# INCLUDE CONFIG DIRECTORY
# This directive allows you to include definitions from config files (with a
# .cfg extension) in one or more directories (with recursion).

#include_dir=<somedirectory>
#include_dir=<someotherdirectory>



# COMMAND DEFINITIONS
# Command definitions that this daemon will run.  Definitions
# are in the following format:
#
# command[<command_name>]=<command_line>
#
# When the daemon receives a request to return the results of <command_name>
# it will execute the command specified by the <command_line> argument.
#
# Unlike Nagios, the command line cannot contain macros - it must be
# typed exactly as it should be executed.
#
# Note: Any plugins that are used in the command lines must reside
# on the machine that this daemon is running on!  The examples below
# assume that you have plugins installed in a /usr/local/nagios/libexec
# directory.  Also note that you will have to modify the definitions below
# to match the argument format the plugins expect.  Remember, these are
# examples only!


# The following examples use hardcoded command arguments...
# This is by far the most secure method of using NRPE

#command[check_users]=/usr/local/nagios/libexec/check_users -w 5 -c 10
#command[check_load]=/usr/local/nagios/libexec/check_load -r -w .15,.10,.05 -c .30,.25,.20
#command[check_hda1]=/usr/local/nagios/libexec/check_disk -w 20% -c 10% -p /dev/hda1
#command[check_zombie_procs]=/usr/local/nagios/libexec/check_procs -w 5 -c 10 -s Z
#command[check_total_procs]=/usr/local/nagios/libexec/check_procs -w 150 -c 200


# The following examples allow user-supplied arguments and can
# only be used if the NRPE daemon was compiled with support for
# command arguments *AND* the dont_blame_nrpe directive in this
# config file is set to '1'.  This poses a potential security risk, so
# make sure you read the SECURITY file before doing this.

### MISC SYSTEM METRICS ###
#command[check_users]=/usr/local/nagios/libexec/check_users $ARG1$
#command[check_load]=/usr/local/nagios/libexec/check_load $ARG1$
#command[check_disk]=/usr/local/nagios/libexec/check_disk $ARG1$
#command[check_swap]=/usr/local/nagios/libexec/check_swap $ARG1$
#command[check_cpu_stats]=/usr/local/nagios/libexec/check_cpu_stats.sh $ARG1$
#command[check_mem]=/usr/local/nagios/libexec/custom_check_mem -n $ARG1$

### GENERIC SERVICES ###
#command[check_init_service]=sudo /usr/local/nagios/libexec/check_init_service $ARG1$
#command[check_services]=/usr/local/nagios/libexec/check_services -p $ARG1$

### SYSTEM UPDATES ###
#command[check_yum]=/usr/local/nagios/libexec/check_yum
#command[check_apt]=/usr/local/nagios/libexec/check_apt

### PROCESSES ###
#command[check_all_procs]=/usr/local/nagios/libexec/custom_check_procs
#command[check_procs]=/usr/local/nagios/libexec/check_procs $ARG1$

### OPEN FILES ###
#command[check_open_files]=/usr/local/nagios/libexec/check_open_files.pl $ARG1$

### NETWORK CONNECTIONS ###
#command[check_netstat]=/usr/local/nagios/libexec/check_netstat.pl -p $ARG1$ $ARG2$

### ASTERISK ###
#command[check_asterisk]=/usr/local/nagios/libexec/check_asterisk.pl $ARG1$
#command[check_sip]=/usr/local/nagios/libexec/check_sip $ARG1$
#command[check_asterisk_sip_peers]=sudo /usr/local/nagios/libexec/check_asterisk_sip_peers.sh $ARG1$
#command[check_asterisk_version]=/usr/local/nagios/libexec/nagisk.pl -c version
#command[check_asterisk_peers]=/usr/local/nagios/libexec/nagisk.pl -c peers
#command[check_asterisk_channels]=/usr/local/nagios/libexec/nagisk.pl -c channels
#command[check_asterisk_zaptel]=/usr/local/nagios/libexec/nagisk.pl -c zaptel
#command[check_asterisk_span]=/usr/local/nagios/libexec/nagisk.pl -c span -s 1


#####OS Commands#####

command[check_load]=/opt/nagios/libexec/check_load -w 15,10,5 -c 30,25,20 --percpu
command[check_aix_disk_io]=/opt/nagios/libexec/check_aix_disk_io -d hdisk0 -w 80 -c 90
command[check_fs_verbose]=/opt/nagios/libexec/check_fs_aix -w 80 -c 90 -p jfs -e "/backup /medesbin /mnt" -v
command[check_aix_paging]=/opt/nagios/libexec/check_aix_paging.sh -w 80 -c 90
command[check_aix_hdisk]=/opt/nagios/libexec/check_aix_hdisk.sh -w 80 -c 90
command[custom_check_mem]=/opt/nagios/libexec/custom_check_mem -w 20 -c 10
command[check_version]=/opt/nagios/libexec/check_version
command[check_uptime3]=/opt/nagios/libexec/check_uptime3
command[check_errpt]=/opt/nagios/libexec/check_errpt

[bolson]

This appears to be an issue specific to AIX. As a workaround, invoke the daemon with this command string:

Code: Select all

sudo -u nagios /usr/local/nagios/bin/nrpe -c /usr/local/nagios/etc/nrpe.cfg -d

Let me know if this runs the daemon as the nagios user.

[sambaba]

Code: Select all

root@Server1/ # sudo -u nagios /usr/local/nagios/bin/nrpe -c /usr/local/nagios/etc/nrpe.cfg -d
root@sdsswasd6633 / # ps -ef | grep -i nagios
  nagios  8323150        1   0 15:43:30      -  0:00 /usr/local/nagios/bin/nrpe -c /usr/local/nagios/etc/nrpe.cfg -d
root@Server1/ #

Its running with nagios as the user using the command you provided. I was initially able to run it as nagios by switching user to "nagios" and running the command. But my concern is, its the same AIX OS level that doesn't require sudo to have nrpe run as nagios user on the other server.

[bolson]

This does appear to be the result of a change in the code base. The challenge is that you leapfrogged over several versions so it will be time consuming to find out where the change took place. I've engaged our developers. Just to clarify... are you saying that you have two servers, same OS version, same NRPE version, different behavior?

[sambaba]

Thank you so much.

Confirming - The two servers are on same AIX OS level, but with different NRPE version. On the other server with old NRPE version, no issue with nrpe running with nagios user even when started as root. But on the server with updated NRPE version of 3.2.0, that's where the issue is with NRPE not running as nagios user when started with root as a user.

[sambaba]

Forgot to mention, I tried updating the old NRPE v2.15 to NRPE 3.1.1 on one of the server in our environment. Its the same issue with 3.1.1 as that of 3.2.0 where nrpe is not running from nagios user when started as root.

[bolson]

Thanks for the info. I'll pass it on to the developer who is working on this.