Nagios Support Forum

Hello,
I have the following issue I believe is a bug. Please check.

My configuration has many services utilizing check_nrpe plugin.
In the State History Report I can see "UNKNOWN" states due to several reason:

1. When the host is unreachable or down, check_nrpe produces "CHECK_NRPE STATE UNKNOWN: Socket timeout after 10 seconds." output
2. When something is wrong with the service, but the host is still reachable, check_nrpe produces "NRPE: Unable to read output" output.
(These 1 and 2 are not Nagios problem, they are indicating problems with the services. Case 2 is when the nrpe daemon can not get data properly; again, this is not Nagios problem, in my case it's the hardware not responding)

Now the problem.
When searching for all "UNKNOWN" states, second case could never be found in the search results. It's there with the empty search field together with all other states, however.

Regards
Nick Jandieri.

Hello,

What version of Nagios XI and what OS are you on?

So you are saying that the state history report isn't showing the "NRPE: Unable to read output"?

Please provide us with your query in which you are using to search for "UNKNOWN" under state history report. Can you show us screenshots showing this?

Hello,
Please check the following screenshots:
1. In this screenshot the search string contains "NRPE". There are 2 types of events filtered: "CHECK_NRPE STATE UNKNOWN: Socket timeout after 10 seconds." and "NRPE: Unable to read output". Both type of events result an UNKNOWN state.

2.
With "UNKNOWN" in the search string, only "CHECK_NRPE STATE UNKNOWN: Socket timeout after 10 seconds." events are shown. "NRPE: Unable to read output" events are not displayed.

My system is running Nagios XI 5.4.12 (trial license) under CentOS 7.

Regards!
Nick.

Hello,
I believe the answer is simple: the search is performed on the "Information" field and does not care about the "State" field. At least this explains everything.

Nick

Thanks for showing me some examples.

I think the search is going towards either the host name, service name or Information.

Take a look at some of my examples.
If I type in a hostname, it gives all of its examples.