Passive check struggle

[marypoppins]

Dear All,

I have a windows server on which I installed the ncpa package. Tried to
use the passive checks, but in the log I found the following:

2018-05-28 16:11:49,403:ERROR:nrdp:no element found: line 1, column 0
Traceback (most recent call last):
File "C:\ncpa\agent\passive\nrdp.py", line 198, in submit_to_nagios
File "C:\ncpa\agent\passive\nrdp.py", line 145, in log_result
File "C:\Python27\lib\xml\dom\minidom.py", line 1928, in parseString
File "C:\Python27\lib\xml\dom\expatbuilder.py", line 940, in parseString
File "C:\Python27\lib\xml\dom\expatbuilder.py", line 223, in parseString
ExpatError: no element found: line 1, column 0

This is exactly the same error, that I found on this page:
https://support.nagios.com/kb/article/n ... p-795.html

However I checked I have installed the php56-xml, and I reload my apache24 the error remains. My server is a freebsd 11.1

My phpinfo page relevant info shows the following:
Additional .ini files parsed : /usr/local/etc/php/ext-20-xml.ini
....
*libxml*
libXML support active
libXML Compiled Version 2.9.7
libXML Loaded Version 20907
libXML streams enabled
.....
*xml*
XML Support active
XML Namespace Support active
libxml2 Version 2.9.7

Could you please somebody point me to the direction out of the darkness?

Also I would like to ask if my knowledge is right about the server client connection:
In the nagios config the host definition host_name should match the hostname in the ncpa config AND in the nagios config the service_description (in my case: Disk Usage) should match the second section (next to the %HOSTNAME% macro) in the passive checks config. Am I right?

Code: Select all

 
%HOSTNAME%|Disk Usage|3600 = disk/logical/C:|/used_percent --warning 80 --critical 90

The relevant config files:
The ncpa config:

Code: Select all

#
#   NCPA Main Config File
#   ---------------------
#

#
# -------------------------------
# General Configuration
# -------------------------------
#

[general]

#
# Check logging is on by default, you can disable it if you do not want to record
# the check requests that are coming in or checks being sent over NRDP.
# Default: check_logging = 1
#
check_logging = 1

#
# Check logging time - how long in DAYS you'd like to keep checks in the database.
# Default: 30
#
check_logging_time = 30

#
# Excluded file system types removes these fs types from the disk metrics
# (This is mostly only noteable on UNIX systems but also works on Windows if you need it)
# Default: aufs,autofs,binfmt_misc,cifs,cgroup,debugfs,devpts,devtmpfs,encryptfs,
#          efivarfs,fuse,hugelbtfs,mqueue,nfs,overlayfs,proc,pstore,rpc_pipefs,
#          securityfs,smb,sysfs,tmpfs,tracefs
#
exclude_fs_types = aufs,autofs,binfmt_misc,cifs,cgroup,debugfs,devpts,devtmpfs,encryptfs,efivarfs,fuse,hugelbtfs,mqueue,nfs,overlayfs,proc,pstore,rpc_pipefs,securityfs,smb,sysfs,tmpfs,tracefs

#
# The default unit to convert bytes (B) into if no unit is specified
# (Gi = 1024 MiB, G = 1000 MB)
#
#default_units = Gi

#
# -------------------------------
# Listener Configuration (daemon)
# -------------------------------
#

[listener]

#
# User and group to run plugins as (recommended to use nagios:nagios)
# Default: uid = nagios
# Default: gid = nagios
#
# This is for Unix only (Linux, Mac OS X, etc)
#
uid = nagios
gid = nagios

#
# IP address and port number for the Listener to use for the web GUI and API
# Default: ip = 0.0.0.0
# Default: port = 5693
#
ip = 0.0.0.0
port = 5693

#
# SSL connection and certificate config (if an SSL option is not available on some older
# operating systems it will default back to TLSv1)
# ssl_version options: TLSv1, TLSv1_1, TLSv1_2
#
ssl_version = TLSv1_2
certificate = adhoc

#
# Listener logging file level, location, and the PID location
# Default: loglevel = info (debug, info, warning, error)
# Default: logfile = var/log/ncpa_listener.log
# Default: pidfile = var/run/ncpa_listener.pid (leave listener in pid file name)
#
loglevel = info
logfile = var/log/ncpa_listener.log
pidfile = var/run/ncpa_listener.pid

#
# Delay the listener (API & web GUI) from starting in seconds
# Default: 0
#
# delay_start = 30

#
# Allow admin functionality in the web GUI. When this is set to 0, the admin section will not
# be displayed in the header and will not be available to be accessed.
# Default: 1
#
admin_gui_access = 1

#
# Admin password for the admin section in the web GUI, by default there is no admin
# password and the admin section of the GUI can be accessed by anyone if admin_gui_access is set to 1.
# Default: None
#
# Note: Setting this value to 'None' will automatically log you in, setting it empty will allow you to
# log in using a blank password.
#
admin_password = None

#
# Require admin password to access ALL of the web GUI.
# This does not affect API access via token (community_string).
# Default: 0
#
admin_auth_only = 0

#
# Comma separated list of allowed hosts that can access the API (and GUI)
# Exmaple: 192.168.23.15
# Example subnet: 192.168.0.0/28
#
# allowed_hosts =

#
# -------------------------------
# Listener Configuration (API)
# -------------------------------
#

[api]

#
# The token that will be used to log into the basic web GUI (API browser, graphs, top charts, etc)
# and to authenticate requests to the API and requests through check_ncpa.py
#
community_string = MyToken

#
# -------------------------------
# Passive Configuration (daemon)
# -------------------------------
#

[passive]

#
# Handlers are a comma separated list of what you would like the passive agent to run
# Default: None
# Options:
#   nrds, nrdp
#
# Example:
# handlers = nrds,nrdp
#
handlers = nrdp

#
# User and group to run passive checks as (recommended to use nagios:nagios)
# Default: uid = nagios
# Default: gid = nagios
#
# This is for Unix only (Linux, Mac OS X, etc)
#
uid = nagios
gid = nagios

#
# Passive check interval - the amount in seconds to wait between each passive check by default,
# this can be overwritten by adding on a "|<duration>" in seconds to the passive check config
# Default: 300 (5 minutes)
#
sleep = 300

#
# Passive logging file level, location, and the PID location
# Default: loglevel = info (debug, info, warning, error)
# Default: logfile = var/log/ncpa_passive.log
# Default: pidfile = var/run/ncpa_passive.pid (leave passive in pid file name)
#
loglevel = info
logfile = var/log/ncpa_passive.log
pidfile = var/run/ncpa_passive.pid

#
# Delay passive checks from starting in seconds
# Default: 0
#
# delay_start = 30

#
# -------------------------------
# Passive Configuration (NRDP)
# -------------------------------
#

[nrdp]

#
# Connection settings to the NRDP server
# parent = NRDP server location (ex: http://<address>/nrdp)
# token = NRDP server token used to send NRDP results
#
parent = http://192.168.0.221/nrdp
token = MyToken

#
# The hostname that will replace %HOSTNAME% in the check definitions and will be
# sent to NRDP with the check name as the service description (service name)
#
hostname = Apollonia

#
# -------------------------------
# Passive Configuration (NRDS)
# -------------------------------
#

[nrds]

#
# NRDS CONFIGURATION DOES NOT WORK YET. MORE TO COME IN VERSION 2.1.0.
#

#
# NRDS connection information
#
url = 
token = 
config_name = 
config_version = 
update_config = 1
update_plugins = 1

#
# -------------------------------
# Plugin Configuration
# -------------------------------
#

[plugin directives]

#
# Plugin path where all plugins will be ran from.
#
plugin_path = plugins/

#
# Plugin execution timeout in seconds. Different than the check_ncpa.py timeout, which is
# normally for network connection issues. Will return a CRITICAL value and error when the plugin
# reaches the defined max execution timeout and kills the process.
# Default: 60
#
# plugin_timeout = 60

#
# Comma separated list of plugins to run through sudo. Note: You will need to update your sudoers
# configuration for these plugins to work when called with sudo.
#
# Example: check_special,check_root_files
# (Command line: sudo /<plugin_absolute_path>/check_special <arguments>)
#
# run_with_sudo =

#
# Extensions for plugins
# ----------------------
# The extension for the plugin denotes how NCPA will try to run the plugin. Use this
# for setting how you want to run the plugin in the command line.
#
# NOTE: Plugins without an extension will be ran in the cmdline as follows:
#       $plugin_name $plugin_args
#
# Defaults:
# .sh = /bin/sh $plugin_name $plugin_args
# .py = python $plugin_name $plugin_args
# .ps1 = powershell -ExecutionPolicy Bypass -File $plugin_name $plugin_args
# .vbs = cscript $plugin_name $plugin_args //NoLogo
# .bat = cmd /c $plugin_name $plugin_args
#
# Since windows NCPA is 32-bit, if you need to use 64-bit powershell, try the following for
# the powershell plugin definition:
# .ps1 = c:\windows\sysnative\windowspowershell\v1.0\powershell.exe -ExecutionPolicy Unrestricted -File $plugin_name $plugin_args
#

# Linux / Mac OS X
.sh = /bin/sh $plugin_name $plugin_args
.py = python $plugin_name $plugin_args

# Windows
.ps1 = powershell -ExecutionPolicy Bypass -File $plugin_name $plugin_args
.vbs = cscript $plugin_name $plugin_args //NoLogo
.bat = cmd /c $plugin_name $plugin_args

The passive checks config

Code: Select all

[passive checks]

%HOSTNAME%|__HOST__ = system/agent_version
%HOSTNAME%|Disk Usage|3600 = disk/logical/C:|/used_percent --warning 80 --critical 90

The nagios template and objects:

Code: Select all

define host{
        use                             generic-host
        name                            passive-host    ; The name of this host template
        active_checks_enabled           0
        passive_checks_enabled          1
        flap_detection_enabled          0
        check_period                    24x7
        max_check_attempts              1
        check_interval                  5
        retry_interval                  1
        check_freshness                 0
        check_command                   check_dummy!0
        notification_interval           60
        notification_period             24x7
        notification_options            d,u,r
        notifications_enabled           1               ; Host notifications are enabled
        register                        0               ; DONT REGISTER THIS DEFINITION - ITS NOT A REAL HOST, JUST A TEMPLATE!
        }


define service {
        use                             generic-service
        name                        passive_service
        active_checks_enabled        0
        passive_checks_enabled        1
        flap_detection_enabled        0
        check_period                24x7
        max_check_attempts        1
        check_interval            5
        retry_interval            1
        check_freshness            0
        contact_groups            admins
        check_command            check_dummy!0
        notification_interval    60
        notification_period        24x7
        notification_options        w,u,c,r
        register                    0
}

define host{
        use             passive-host    ; Inherit default values from a template
        host_name       Apollonia       ; The name we're giving to this host
        address         192.168.0.32    ; IP address of the host
        hostgroups      windows-servers
        }

define hostgroup{
        hostgroup_name  windows-servers ; The name of the hostgroup
        alias           Windows Servers ; Long name of the group
        }


define service{
        use                     passive_service
        service_description     Disk Usage
        host_name               Apollonia
        max_check_attempts              3
        normal_check_interval           20
        retry_check_interval            3
        notification_interval           60
}

Thank you very much
mary

[scottwilkerson]

Can you start by verifying that NRDP is working on you server by going to the url /nrdp/ on your server and submitting a passive check?

[marypoppins]

Thank you for answering.
The page itself works, however if I try to submit the bellow, nothing happen.

Code: Select all

<?xml version='1.0'?>
<checkresults>
	<checkresult type='host'>
		<hostname>Apollonia</hostname>
		<state>0</state>
		<output>Everything looks okay! | perfdata=1;</output>
	</checkresult>
	<checkresult type='service'>
		<hostname>Apollonia</hostname>
		<servicename>Disk Usage</servicename>
		<state>1</state>
		<output>WARNING: Danger Will Robinson! | perfdata=1;</output>
	</checkresult>
</checkresults>

If I change the token something to a false one, it shows: ""bad token"
The /var/spool/nagios/checkresults folder empty, also the /var/spool/nagios/archive does not include relevant data.

[scottwilkerson]

however if I try to submit the bellow, nothing happen.

this leads me to believe that there is an error.

Can you watch the httpd error_log on the server when you submit the page again and report the errors.

My guess would be that there is a missing php function from addon, but seeing the error in the logs will help

[marypoppins]

The httpd-access.log shows:
192.168.11.100 - - [29/May/2018:23:24:11 +0200] "POST /nrdp/ HTTP/1.1" 500 -

The httpd-error.log shows nothing when I send "submit json check result", however when I restart the apache24 the log shows this:
[Tue May 29 23:23:55.714631 2018] [mpm_prefork:notice] [pid 6040] AH00163: Apache/2.4.33 (FreeBSD) PHP/5.6.35 configured -- resuming normal operations
[Tue May 29 23:23:55.714670 2018] [core:notice] [pid 6040] AH00094: Command line: '/usr/local/sbin/httpd -D NOHTTPACCEPT'


I tried to search to the access log error and I realised that there were misconfigured values in the nrdp config.inc.php. Now the following two lines point to the right path,
$cfg["command_file"] = "/var/spool/nagios/rw/nagios.cmd";
$cfg["check_results_dir"] = "/var/spool/nagios/checkresults";

In nagios.conf:
command_file=/var/spool/nagios/rw/nagios.cmd
check_result_path=/var/spool/nagios/checkresults

I also add the group nagcmd to the /etc/group
$cfg["nagios_command_group"] = "nagcmd";

Now I have this two relevant line in the group file:
nagios:*:181:www
nagcmd:*nagios,www

However the error remains
Any help appreciated!
Thank you

[scottwilkerson]

lets see permissions on this

Code: Select all

ls -al /var/spool/nagios/checkresults

Also, is selinux enabled?

Code: Select all

getenforce

[marypoppins]

# ls -al /var/spool/nagios/checkresults
total 8
drwxrwsr-x 2 nagios nagios 512 May 29 22:42 .
drwxrwxr-x 5 nagios nagios 512 May 30 11:41 ..


As I know there is no selinux. It a freebsd version 11.1


Does the "...POST /nrdp/ HTTP/1.1" 500 -' means an error? I'm trying to search about that, but I don't know the direction is right...


Thank you
(sorry for bad english)

[scottwilkerson]

Does the "...POST /nrdp/ HTTP/1.1" 500 -'

Yes it does 500 is an error code.

You may meed to enable error logging in php.ini or something so you can see the error. Once you have the actual error we will have the information needed to fix the problem.

[marypoppins]

As you suggested:
display_errors = On
log_errors = On
error_log = /var/log/php-errors.log

and make this:
touch /var/log/php-errors.log
chown www:www /var/log/php-errors.log


And when I submit the the test, below the page appears a blue line, but there is no text in it. After 2-3 seconds it dissapear.

The php-error.log file is completely empty. However strangely now the httpd-access.log shows this:
"POST /nrdp/ HTTP/1.1" 200 -

[scottwilkerson]

I'm baffled, you should be getting output on the screen saying how many items were received.

I guess it makes sense you aren't getting the error log entries if it is now returning 200....