NCPA Passive service crash

[ignacio.sanchez]

Hello.

We are facing an issue in one particular server (Windows 2016 Datacenter) after installing the NCPA client (passive mode)
Once installed and configured, the service NCPA Passive stops with a crash, and if we try to start it manually, the service stop after 2-3 minutes.
In the Event Viewer, we can see this information:

Code: Select all

Faulting application name: ncpa_passive.exe, version: 2.2.2.0, time stamp: 0x549debde
Faulting module name: gevent.libev.corecext.pyd, version: 0.0.0.0, time stamp: 0x59354673
Exception code: 0x40000015
Fault offset: 0x00009c5a
Faulting process id: 0xe64
Faulting application start time: 0x01d731fa1183220e
Faulting application path: C:\Program Files (x86)\Nagios\NCPA\ncpa_passive.exe
Faulting module path: C:\Program Files (x86)\Nagios\NCPA\gevent.libev.corecext.pyd
Report Id: b746aba9-c159-4add-a574-4727f49076b9
Faulting package full name: 
Faulting package-relative application ID: 

In the logs, we only see a single line, regardless of the logging level we set in the ncpa.cfg file

Code: Select all

win32service_ncpapassive.log
[04048] 2021/04/15 14:20:14.141 starting logging at level ERROR

Is there a way to find out the reason why the service is not starting properly?


Thank you.

[vtrac]

Hi,
Hope you are having a good day ...

Could you please upload these files (below)?

Code: Select all

C:\Program Files (x86)\Nagios\NCPA\etc\ncpa.cfg
C:\Program Files (x86)\Nagios\NCPA\etc\ncpa.cfg.d\ncpa.cfg
C:\Program Files (x86)\Nagios\NCPA\var\log\ncpa_passive.log
C:\Program Files (x86)\Nagios\NCPA\var\log\ncpa_listener.log

Hopefully there more info in the "ncpa_passive.log".

Also, can you open your NCPA's webpage below:
https://x.x.x.x:5693

NOTE: x.x.x.x is the IP of your NCPA's agent.
Also, use your "community_string" defined in the "API" section of your ncpa.cfg to login


Best Regards,
Vinh

[ignacio.sanchez]

Hello Vinh.

Attached all the requested files.

The access to https://x.x.x.x:5693 is not working.

[vtrac]

Hi Ignacio,
Hope you are having a great day!!

Is this a brand new install?

I noticed the contains inside the log was from "2019-11-22".

First, could you please "reboot" your Windows VM (machine)?
Click the Start menu > Power button > Restart.


Once rebooted, if you are still can not open "https://x.x.x.x:5693", which means your agent is NOT running.

Can you please check that "ncpalistnener" and "ncpapassive" are running?

M1.png

Also, can you please test by changing the ncpa.cfg file:
From:

Code: Select all

# allowed_sources = 
ip=10.0.0.1
port=5693

To:

Code: Select all

# allowed_sources = 
ip=0.0.0.0
port=5693

Restart NCPA services:

Code: Select all

net stop ncpalistener
net start ncpalistener
net stop ncpapassive
net start ncpapassive

If all of the above step failed, please re-install NCPA agent again.
https://assets.nagios.com/downloads/ncp ... g-NCPA.pdf


Once your NCPA agent is up and running, please run the below command from your Nagios XI prompt.
We want to see if you can communicate with the NCPA agent from Nagios XI:
NOTE: "x.x.x.x" is your remote NCPA's agent IP address.

Code: Select all

nmap -Pn -p 5693 x.x.x.x

Example:
# nmap -Pn -p 5693 192.168.254.158

Code: Select all

Starting Nmap 6.47 ( http://nmap.org ) at 2021-04-19 09:44 CDT
Nmap scan report for 192.168.254.158
Host is up (0.024s latency).
PORT     STATE SERVICE
5693/tcp open  unknown
MAC Address: F8:0B:CB:27:F4:00 (Unknown)

Nmap done: 1 IP address (1 host up) scanned in 2.24 seconds

If port "5693" is listed as "open", then please see if you can open the URL below:
Please use the "token / community_string" defined inside your "ncpa.cfg" file to login.
https://x.x.x.x:5693


Best Regards,
Vinh

[ignacio.sanchez]

Hi Ignacio,
Hope you are having a great day!!

Is this a brand new install? Is a brand new install.

I noticed the contains inside the log was from "2019-11-22". Those lines from 2019 in the log are coming directly from NCPA installer.

First, could you please "reboot" your Windows VM (machine)? Already tested.
Click the Start menu > Power button > Restart.


Once rebooted, if you are still can not open "https://x.x.x.x:5693", which means your agent is NOT running. That's the point, we cannot reach that port because the service is stopped and we cannot keep it running.

Can you please check that "ncpalistnener" and "ncpapassive" are running? NCPA Passive is the first one to stop, and after some time, NCPA Listener too.

M1.png

Also, can you please test by changing the ncpa.cfg file: I changed it to upload the logs to the forum. In that field is the IP of the server where NCPA is installed.

From:

Code: Select all

# allowed_sources = 
ip=10.0.0.1
port=5693

To:

Code: Select all

# allowed_sources = 
ip=0.0.0.0
port=5693

Restart NCPA services:

Code: Select all

net stop ncpalistener
net start ncpalistener
net stop ncpapassive
net start ncpapassive

If all of the above step failed, please re-install NCPA agent again. Already done, with no luck.
https://assets.nagios.com/downloads/ncp ... g-NCPA.pdf


Once your NCPA agent is up and running, please run the below command from your Nagios XI prompt.
We want to see if you can communicate with the NCPA agent from Nagios XI:
NOTE: "x.x.x.x" is your remote NCPA's agent IP address.

Code: Select all

nmap -Pn -p 5693 x.x.x.x

Example:
# nmap -Pn -p 5693 192.168.254.158

Code: Select all

Starting Nmap 6.47 ( http://nmap.org ) at 2021-04-19 09:44 CDT
Nmap scan report for 192.168.254.158
Host is up (0.024s latency).
PORT     STATE SERVICE
5693/tcp open  unknown
MAC Address: F8:0B:CB:27:F4:00 (Unknown)

Nmap done: 1 IP address (1 host up) scanned in 2.24 seconds

If port "5693" is listed as "open", then please see if you can open the URL below:
Please use the "token / community_string" defined inside your "ncpa.cfg" file to login.
https://x.x.x.x:5693


Best Regards,
Vinh

Hello Vinh.

My replies in red above.

[vtrac]

Hi,
I noticed from your older replied, you are running "2.2.2" version.

Could you please try install the latest released "2.3.x"?
https://assets.nagios.com/downloads/ncp ... -2.3.1.exe

https://www.nagios.org/ncpa/archive.php

If that still not working, could you please try downgrade to "2.2.1" or "2.2.0".

Do you have other NCPA agent running some where else beside this one?

Sorry, but I'm not sure what else are installed on this Windows machine.

Can you start with a fresh VM? ..... just want to see if it installed and runs.


Best Regards,
Vinh

[ignacio.sanchez]

Hello Vinh.

The thing is that NCPA 2.2.2 is working in all machines in our environment, the problem is just with that concrete server.

We tried installing the latest version 2.3.0, and older versions (2.2.0), without success, the service goes down after some minutes.

Code: Select all

Faulting application name: ncpa_passive.exe, version: 2.3.1.0, time stamp: 0x549debde
Faulting module name: gevent.libev.corecext.pyd, version: 0.0.0.0, time stamp: 0x59354673
Exception code: 0x40000015
Fault offset: 0x00009c5a
Faulting process id: 0xa14
Faulting application start time: 0x01d7369172eb514b
Faulting application path: C:\Program Files (x86)\Nagios\NCPA\ncpa_passive.exe
Faulting module path: C:\Program Files (x86)\Nagios\NCPA\gevent.libev.corecext.pyd
Report Id: 6bd4edec-96d1-4573-9a56-8a9c84883d08
Faulting package full name:
Faulting package-relative application ID:

Code: Select all

Faulting application name: ncpa_passive.exe, version: 2.2.0.0, time stamp: 0x549debde
Faulting module name: gevent.libev.corecext.pyd, version: 0.0.0.0, time stamp: 0x59354673
Exception code: 0x40000015
Fault offset: 0x00009c5a
Faulting process id: 0x1bd0
Faulting application start time: 0x01d736922b79a44a
Faulting application path: C:\Program Files (x86)\Nagios\NCPA\ncpa_passive.exe
Faulting module path: C:\Program Files (x86)\Nagios\NCPA\gevent.libev.corecext.pyd
Report Id: b5e8ec82-58b6-4a2d-9956-06706f266ced
Faulting package full name:
Faulting package-relative application ID:

We will check all other installed software on that particular server and I'll let you know if we find something.

[vtrac]

Hi,
I checked with our dev and support teams, but they have not yet seen this error.

I also asked about python, but they said:

NCPA has its own python interpreter bundled with it

Do you have python installed on this Windows machine?

I checked my remote NCPA agent and did not see python installed.

Please compare your GOOD (NCPA working) with this one and see what softwares are installed.


Best Regards,
Vinh