Page 1 of 1

Problem connect to nsclient on windows 2008 to run chec

Posted: Wed Jan 03, 2018 2:28 pm
by jkelly1959
Newbie here. I am attempting to setup a monitor to Windows server where I used the Windows server wizard to create a disk check using check_nt.
nsclient is NSCP-0.5.1.44 64 bit
WIndows server is 2008
nagios xi server is 5.4.9 on Linux RHEL 7

I tried debuging using command line:
[nagios@lnxvnagth001 libexec]$ ./check_nt -H 10.224.132.161 -p 12489 -s B0az -v USEDDISKSPACE -l E -w 80 -c 90
NSClient - ERROR: No performance data from command: check_drivesize

on the client side I get:
D core NSClient++ - 0.5.1.44 2017-08-30 Started!
D core F:\Monitoring\NSClient++/modules\CommandClient.dll.dll
D core adding F:\Monitoring\NSClient++/modules\CommandClient.dll
D core Loading plugin: CommandClient...
D cli Enter command to execute, help for help or exit to exit...
D check_nt Accepting connection from: 10.224.132.32
D check_nt Real command: check_drivesize drive=E warn=free<0 crit=free<0 filte
r=type='fixed' and mounted = 1 perf-config=used(unit:B)free(unit:B)
E core Unknown command(s): check_drivesize available commands: commands {}
, plugins {}

This worked pretty easily during our POC so I am abit confused. Note I am building this on the free version to test before running on our licensed server. I also tried loading NRPE on the client and using that method with a different error.

IF I try NRPE and a check_load
[nagios@lnxvnagth001 libexec]$ ./check_nrpe -H 10.224.132.161 -c check_load
Unknown command(s): check_load

NSclient side

T :scheduler Thread pool contains: 2
D core NSClient++ - 0.5.1.44 2017-08-30 Started!
D core F:\Monitoring\NSClient++/modules\CommandClient.dll.dll
D core adding F:\Monitoring\NSClient++/modules\CommandClient.dll
D core Loading plugin: CommandClient...
D cli Enter command to execute, help for help or exit to exit...
D nrpe Accepting connection from: 10.224.132.32, count=1
E core Unknown command(s): check_load available commands: commands {}, plu
gins {}
c:\source\master\service\NSClient++.cpp:814


my nsclient.ini:
# If you want to fill this file with all available options run the following command:
# nscp settings --generate --add-defaults --load-all
# If you want to activate a module and bring in all its options use:
# nscp settings --activate-module <MODULE NAME> --add-defaults
# For details run: nscp settings --help


; in flight - TODO
[/settings/default]

; Undocumented key
password = B0az

; Undocumented key
allowed hosts = 10.224.132.32, 127.0.0.1

; in flight - TODO
[/settings/NSClient/server]
; PERFORMANCE DATA - Send performance data back to Nagios (set this to 0 to remove all performance data).
performance data = 1

; in flight - TODO
[/settings/NRPE/server]

; VERIFY MODE - Comma separated list of verification flags to set on the SSL socket.
ssl options = ADH

; Verify Mode
verify mode = none

; ALLOW INSECURE CHIPHERS and ENCRYPTION
insecure = true

; COMMAND ARGUMENT PROCESSING
allow arguments = true

; COMMAND ALLOW NASTY META CHARS
allow nasty characters = false

; in flight - TODO
[/modules]

; Undocumented key
CheckExternalScripts = disabled

; Undocumented key
CheckHelpers = disabled

; Undocumented key
CheckEventLog = disabled

; Undocumented key
CheckNSCP = disabled

; Undocumented key
CheckDisk = disabled

; Undocumented key
CheckSystem = disabled

; Undocumented key
NSClientServer = enabled

; Undocumented key
NRPEServer = enabled

I am not particular to either one but check_NT is what we used in our POC. I would just like to get a prototype working.

Thanks
JK

Re: Problem connect to nsclient on windows 2008 to run chec

Posted: Wed Jan 03, 2018 4:22 pm
by npolovenko
I tried debuging using command line:
[nagios@lnxvnagth001 libexec]$ ./check_nt -H 10.224.132.161 -p 12489 -s B0az -v USEDDISKSPACE -l E -w 80 -c 90
NSClient - ERROR: No performance data from command: check_drivesize
Please try this command with the following syntax:

Code: Select all

./check_nt -H 10.224.132.161 -s "B0az" -p 12489 -v USEDDISKSPACE -l C -w 80 -c 90
If that command fails please consider using the following configuration for your nsclient.ini file. This configuration has a few extra options that need to be enabled:

Code: Select all

# If you want to fill this file with all available options run the following command:
#   nscp settings --generate --add-defaults --load-all
# If you want to activate a module and bring in all its options use:
#   nscp settings --activate-module <MODULE NAME> --add-defaults
# For details run: nscp settings --help
; TODO
[/settings/default]
; Undocumented key
password = B0az 
; Undocumented key
allowed hosts = 127.0.0.1,::1,10.224.132.32
; CACHE ALLOWED HOSTS - If host names (DNS entries) should be cached, improves speed and security somewhat but won't allow you to have dynamic IPs for your Nagios server.
cache allowed hosts = 1
; TIMEOUT - Timeout when reading packets on incoming sockets. If the data has not arrived within this time we will bail out.
timeout = 30
; TODO
[/modules]
; Undocumented key
CheckHelpers = 1
; Undocumented key
CheckEventLog = 1
; Undocumented key
CheckNSCP = 1
; Undocumented key
CheckSystem = 1
; Undocumented key
NSClientServer = 1
; NRPEServer - A server that listens for incoming NRPE connection and processes incoming requests.
NRPEServer = 1
; CheckExternalScripts - Execute external scripts
CheckExternalScripts = 1
; CheckDisk - CheckDisk can check various file and disk related things.
CheckDisk = 1
; A set of options to configure the real time checks
[/settings/system/windows/real-time]
; Configure which services has to be in which state
[/settings/system/windows/service mapping]
; TODO
[/settings/system/windows/counters/default]
; TODO
[/settings/system/windows/counters]
; TODO
[/settings/log/file]
; TODO
[/settings/log]
; LOG LEVEL - Log level to use. Available levels are error,warning,info,debug,trace
level = debug
; DATEMASK - The size of the buffer to use when getting messages this affects the speed and maximum size of messages you can recieve.
date format = %Y-%m-%d %H:%M:%S
; FILENAME - The file to write log data to. Set this to none to disable log to file.
file name = ${exe-path}/nsclient.log
; TODO
[/settings/system/windows]
; DEFAULT LENGTH - Used to define the default interval for range buffer checks (ie. CPU).
default buffer length = 1h
; TODO
[/settings/external scripts/scripts/default]
; IGNORE PERF DATA - Do not parse performance data from the output
ignore perfdata = 1
; A list of wrapped scripts (ie. scruts using a template mechanism). The template used will be defined by the extension of the script.
[/settings/external scripts/wrapped scripts]
; TODO
[/settings/external scripts/alias]
; TODO
[/settings/eventlog/real-time/filters/default]
; EMPTY MESSAGE - The message to display if nothing matches the filter (generally considered the ok state).
empty message = eventlog found no records
; MAGIMUM AGE - How long before reporting "ok". If this is set to "false" no periodic ok messages will be reported only errors.
maximum age = 5m
; A set of filters to use in real-time mode
[/settings/eventlog/real-time/filters]
; TODO
[/settings/eventlog/real-time]
; STARTUP AGE - The initial age to scan when starting NSClient++
startup age = 30m
; REAL TIME CHECKING - Spawns a background thread which detects issues and reports them back instantly.
enabled = 0
; LOGS TO CHECK - Comma separated list of logs to check
log = application,system
; DEBUG - Log missed records (useful to detect issues with filters) not useful in production as it is a bit of a resource hog.
debug = 0
; A list of scripts available to run from the CheckExternalScripts module. Syntax is: <command>=<script> <arguments>
[/settings/external scripts/scripts]
; TODO
[/settings/external scripts/alias/default]
; TODO
[/settings/shared session]
; TODO
[/settings/crash]
; RESTART SERVICE NAME - The url to submit crash reports to
restart target = NSCP
; CRASH ARCHIVE LOCATION - The folder to archive crash dumps in
archive folder = ${crash-folder}
; RESTART - Submit crash reports to nsclient.org (or your configured submission server)
restart = true
; SUBMISSION URL - The url to submit crash reports to
submit url = https://crash.nsclient.org/post
; ARCHIVE CRASHREPORTS - Archive crash reports in the archive folder
archive = true
; A set of filters to use in real-time mode
[/settings/system/windows/real-time/checks]
; TODO
[/settings/NSClient/server]
; ENABLE SSL ENCRYPTION - This option controls if SSL should be enabled.
use ssl = 0
; PORT NUMBER - Port to use for check_nt.
port = 12489
; PERFORMANCE DATA - Send performance data back to Nagios (set this to 0 to remove all performance data).
performance data = 1
; TODO
[/settings/external scripts]
; COMMAND TIMEOUT - The maximum time in seconds that a command can execute. (if more then this execution will be aborted). NOTICE this only affects external commands not internal ones.
timeout = 80
; COMMAND ARGUMENT PROCESSING - This option determines whether or not the we will allow clients to specify arguments to commands that are executed.
allow arguments = true
; COMMAND ALLOW NASTY META CHARS - This option determines whether or not the we will allow clients to specify nasty (as in |`&><'"\[]{}) characters in arguments.
allow nasty characters = true
; TODO
[/paths]
; Path for shared-path - 
shared-path = C:\Program Files\NSClient++
; Path for module-path - 
module-path = ${shared-path}/modules
; Path for crash-folder - 
crash-folder = ${shared-path}/crash-dumps
; Path for exe-path - 
exe-path = C:\Program Files\NSClient++
; Path for certificate-path - 
certificate-path = ${shared-path}/security
; Path for base-path - 
base-path = C:\Program Files\NSClient++
; Files to be included in the configuration
[/includes]
; TODO
[/settings/eventlog]
; DEBUG - Log more information when filtering (useful to detect issues with filters) not useful in production as it is a bit of a resource hog.
debug = 0
; LOOKUP NAMES - Lookup the names of eventlog files
lookup names = 1
; BUFFER_SIZE - The size of the buffer to use when getting messages this affects the speed and maximum size of messages you can recieve.
buffer size = 131072
; TODO
[/settings/external scripts/wrappings]
; BATCH FILE WRAPPING - 
bat = scripts\\%SCRIPT% %ARGS%
; VISUAL BASIC WRAPPING - 
vbs = cscript.exe //T:30 //NoLogo scripts\\lib\\wrapper.vbs %SCRIPT% %ARGS%
; POWERSHELL WRAPPING - 
ps1 = cmd /c echo If (-Not (Test-Path "scripts\%SCRIPT%") ) { Write-Host "UNKNOWN: Script `"%SCRIPT%`" not found."; exit(3) }; scripts\%SCRIPT% $ARGS$; exit($lastexitcode) | powershell.exe /noprofile -command -
; TODO

[/settings/NRPE/server]

; VERIFY MODE - Comma separated list of verification flags to set on the SSL socket.  default-workarounds  Various workarounds for what I understand to be broken ssl implementations no-sslv2  Do not use the SSLv2 protocol. no-sslv3  Do not use the SSLv3 protocol. no-tlsv1  Do not use the TLSv1 protocol. single-dh-use  Always create a new key when using temporary/ephemeral DH parameters. This option must be used to prevent small subgroup attacks, when the DH parameters were not generated using "strong" primes (e.g. when using DSA-parameters).   
ssl options = 

; VERIFY MODE - Comma separated list of verification flags to set on the SSL socket.  none  The server will not send a client certificate request to the client, so the client will not send a certificate. peer  The server sends a client certificate request to the client and the certificate returned (if any) is checked. fail-if-no-cert  if the client did not return a certificate, the TLS/SSL handshake is immediately terminated. This flag must be used together with peer. peer-cert  Alias for peer and fail-if-no-cert. workarounds  Various bug workarounds. single  Always create a new key when using tmp_dh parameters. client-once  Only request a client certificate on the initial TLS/SSL handshake. This flag must be used together with verify-peer   
verify mode = none

; ALLOW INSECURE CHIPHERS and ENCRYPTION - Only enable this if you are using legacy check_nrpe client.
insecure = true
allow arguments = true
allow nasty characters = true

; ENABLE SSL ENCRYPTION - This option controls if SSL should be enabled.
use ssl = 1

; PORT NUMBER - Port to use for NRPE.
port = 5666


PS: If you have to modify the ini file, don't forget to restart the nsclient service from the services menu. Otherwise, the config will not get reloaded.

Re: Problem connect to nsclient on windows 2008 to run chec

Posted: Thu Jan 04, 2018 10:00 am
by jkelly1959
Thank you for responding.
I attempted the different command with the same results.
I then replaced my nsclient.ini with yours(completely replaced), restarted the nsclient service and tried again. On the server making the call to nsclient I get

nagios@lnxvnagth001 libexec]$ ./check_nt -H 10.224.132.161 -s "B0az" -p 12489 -v USEDDISKSPACE -l C -w 80 -c 90
connect to address 10.224.132.161 and port 12489: Connection refused
could not fetch information from server
[nagios@lnxvnagth001 libexec]$


and see nothing in the log on where nsclient is running.

Re: Problem connect to nsclient on windows 2008 to run chec

Posted: Thu Jan 04, 2018 10:02 am
by jkelly1959
and a netstat shows 12489 not listening on nsclient machine

Re: Problem connect to nsclient on windows 2008 to run chec

Posted: Thu Jan 04, 2018 10:37 am
by lmiltchev
[/modules]

; Undocumented key
CheckExternalScripts = disabled

; Undocumented key
CheckHelpers = disabled

; Undocumented key
CheckEventLog = disabled

; Undocumented key
CheckNSCP = disabled

; Undocumented key
CheckDisk = disabled

; Undocumented key
CheckSystem = disabled
You have all of these modules (see above) disabled... Modify the nsclient.ini file by changing "disabled" to "enabled", save, exit, and restart the nsclient service. Try your check again. If it still doesn't work, post the entire nsclient.ini file, and the nsclient.log files.

Re: Problem connect to nsclient on windows 2008 to run chec

Posted: Thu Jan 04, 2018 1:43 pm
by jkelly1959
The check_nt is now working. Check_nrpe still has some issues. but this got me going in the right direction. Thanks for the help.

I think there may have been some issues in the ini file. like modulename = 1 didn't work well but modulename = enabled did. Will slowly put the updates you suggested in(the enabled modules fixed check_nt. ) to see if that will get check_nrpe going.

I will poke around but if you know a good document that dicusses whats all in the nsclient ini file please send link.

Re: Problem connect to nsclient on windows 2008 to run chec

Posted: Thu Jan 04, 2018 2:24 pm
by npolovenko
@jkelly1959, What kind of issues are you having with nrpe? You could change some settings in your nrpe section:

Code: Select all

[/settings/NRPE/server]

; VERIFY MODE - Comma separated list of verification flags to set on the SSL socket.
ssl options = 

; Verify Mode
verify mode = none

; ALLOW INSECURE CHIPHERS and ENCRYPTION
insecure = true

; COMMAND ARGUMENT PROCESSING
allow arguments = true 

; COMMAND ALLOW NASTY META CHARS
allow nasty characters =true

port = 5666
I will poke around but if you know a good document that dicusses whats all in the nsclient ini file please send link.
You could navigate to the NSClient folder and run the following command:

Code: Select all

#   nscp settings --generate --add-defaults --load-all
This will populate your ini file with all required fields that you may be missing right now. After, you can lookup the individual values and find explanations on their official website: https://docs.nsclient.org