Unknown command: $ in using check_eventlog with check_nrpe

[raydx]

I'm having an issue with check_eventlog with check_nrpe. The Nagios console displays:
Unknown command(s): $

From nagios.log:
[1544688000] CURRENT SERVICE STATE: per320-01;Applications errors;UNKNOWN;HARD;3;Unknown command(s): $

Service I'm using:
define service{
use generic-service
host_name per320-01,per320-02,svicsdlver01,svicsdlver03,svicsdlver04,
service_description Applications errors
check_command check_nrpe!check_eventlog -a "filter=provider = 'Application Error' and id = 1000 and message like 'Spacelabs.SLNIService.exe'"
}

nrpe.cfg and commands.cfg are attached.

Thanks!

[danjoh]

In commands.cfg you have

Code: Select all

# 'check_nrpe' command definition
define command{
	command_name    check_nrpe
	command_line    $USER1$/check_nrpe -H $HOSTADDRESS$ -t 120 -c $ARGS$
	}

I think that should be:

Code: Select all

# 'check_nrpe' command definition
define command{
	command_name    check_nrpe
	command_line    $USER1$/check_nrpe -H $HOSTADDRESS$ -t 120 -c $ARG1$ -a $ARG2$
	}

and the check should look like this:

Code: Select all

define service{
        use generic-service
        host_name per320-01,per320-02,svicsdlver01,svicsdlver03,svicsdlver04,
        service_description Applications errors
        check_command check_nrpe!check_eventlog!"filter=provider = 'Application Error' and id = 1000 and message like 'Spacelabs.SLNIService.exe'"
}

And looking through your nrpe.cfg I do not see any command definition for "check_eventlog" .

[scottwilkerson]

In addition to what @danjoh mentioned about the service definition, the service you have defined looks like something you would be running against a windows machine running nsclient++

Can you share the nsclient.ini from the windows machine?

[raydx]

Thank you @danjoh and @scottwilkerson for your assistance.

I up-dated commands.cfg and ICS.cfg. NRPE Plugin for Nagios is now displayed.

/usr/local/nagios/libexec does not contain check_eventlog

nsclient.ini is attached.

[scottwilkerson]

I up-dated commands.cfg and ICS.cfg. NRPE Plugin for Nagios is now displayed.

Is it now working as expected?

/usr/local/nagios/libexec does not contain check_eventlog

It would not be in /usr/local/nagios/libexec, it is part of nsclient++

[raydx]

It is not working as expected.

What should I check on the windows machine that has NSClient++?

[scottwilkerson]

After making the change to the commands.cfg did you restart nagios?

what error are you getting in the UI after that? before it was this which was related to the error in the check_nrpe command

Code: Select all

Unknown command(s): $

[raydx]

After making the changes to commands.cfg and ICS.cfg, nagios was re-started and
NRPE Plugin for Nagios was displayed in the Nagios console.

I reverted the changes and Unknown command(s): $ is displayed for all the check_eventlogs.

In checking the web for solutions, I did see that someone ran in
/usr/local/nagios/libexec$ ./check_nrpe - H 10.11.96.130 -t 30 -c check_event_log -a "file=security" "filetr=written 1t -2d" and NRPE: Command 'check_event_log' not defined is returned.

I am having difficulty with getting the correct command for nrpe.cfg.

[scottwilkerson]

Please show in your next post what you have configured for check_nrpe in the GUI

Also, the command you were trying to run before is different than what you are trying to run now from the CLI, try

Code: Select all

./check_nrpe - H 10.11.96.130 -t 30 -c check_eventlog -a "filter=provider = 'Application Error' and id = 1000 and message like 'Spacelabs.SLNIService.exe'" 

[raydx]

In re to "what you have configured for check_nrpe in the GUI", which file are you referring to?

In the CLI, in /usr/local/nagios/libexec$, I ran the command and CHECK_NRPE: Receive header underflow - only 0 bytes received (4 expected).