NRDP in logs but not registering

[clickityclack]

Hi All,

I'm attempting to setup distributed monitoring between a Nagios Core server and a Nagios XI server, with the core server sending updates on to the XI server. The Nagios XI server is Cent OS 7, and the Nagios Core is AWS Linux. I have got to the point that data is being sent as I can see it in the debug log in /usr/local/nrdp/server, looking like the below.

[Fri, 21 Jan 2022 14:57:19 +1100] nagioscorecmd_process_request(cbtype = PROCESS_REQUEST, args[cmd] = submitcheck
[Fri, 21 Jan 2022 14:57:19 +1100] nagioscorecmd_process_request() had no registered callbacks, returning
[Fri, 21 Jan 2022 14:57:19 +1100] nagioscorepassivecheck_process_request(cbtype = PROCESS_REQUEST, args[cmd] = submitcheck
[Fri, 21 Jan 2022 14:57:19 +1100] REQUEST: [token] t0ken
[Fri, 21 Jan 2022 14:57:19 +1100] REQUEST: [cmd] submitcheck
[Fri, 21 Jan 2022 14:57:19 +1100] REQUEST: [xml] <?xml version='1.0'?>
<checkresults>

<checkresult type='host' checktype='1'>
<hostname>testhost</hostname>
<state>0</state>
<output>PING OK - Packet loss = 0%, RTA = 59.76 ms</output>
</checkresult>

</checkresults>
[Fri, 21 Jan 2022 14:57:19 +1100] no xmldata or jsondata, bailing


I'm not sure if the fact it's being sent with XML escape characters is the issue, and I don't know how to fix it. I've checked permissions on the scripts, replaced the send_nrdp.php script with a fresh version from the github, but I'm not well versed in php so wouldn't know how to modify the script. If I copy of the data directly from the log, replaced the < and > with < and > then copy it into the XML check results on at http://hostname.com/nrdp/ it works and appears in the unconfigured objects area.

Any help would be greatly appreciated, I'm feeling pretty stuck.

[pbroste]

Hello @clickityclack

Thanks for reaching out, want to get the php version on the core and the System Profile from you Nagios XI.

Code: Select all

rpm -qa | grep php-
php -v
/usr/local/nrdp/clients/send_nrdp.php -i > /tmp/send_nrdp.txt
python --version

To send us your system profile.

• Login to the Nagios XI GUI using a web browser.
• Click the "Admin" > "System Profile" Menu
• Click the "Download Profile" button
• Save the profile.zip file and share

or

Code: Select all

rm -rf /usr/local/nagiosxi/var/components/profile.zip
/usr/local/nagiosxi/scripts/components/getprofile.sh SUPPORT

Then send the resulting /usr/local/nagiosxi/var/components/profile.zip and /tmp/send_nrdp.txt file via Private Message.

Thanks,
Perry

[clickityclack]

Hi Perry,

I don't think I have the ability to send a personal message, when I go to the user control panel attempt to compose a message it says "We are sorry, but you are not authorised to use this feature. You may have just registered here and may need to participate more to be able to use this feature.".

The output from the commands around PHP are below, if you can give me the ability to compose a message I'll send the other nagios information over as you've instructed .

rpm -qa | grep php-
php-pdo-5.4.16-48.el7.x86_64
php-pgsql-5.4.16-48.el7.x86_64
php-pecl-ssh2-0.12-1.el7.x86_64
php-imap-5.4.16-9.el7.x86_64
php-devel-5.4.16-48.el7.x86_64
php-mssql-5.4.16-9.el7.x86_64
php-common-5.4.16-48.el7.x86_64
php-cli-5.4.16-48.el7.x86_64
php-mysql-5.4.16-48.el7.x86_64
php-ldap-5.4.16-48.el7.x86_64
php-pear-1.9.4-22.el7.noarch
php-snmp-5.4.16-48.el7.x86_64
php-mbstring-5.4.16-48.el7.x86_64
php-5.4.16-48.el7.x86_64
php-xml-5.4.16-48.el7.x86_64
php-process-5.4.16-48.el7.x86_64
php-gd-5.4.16-48.el7.x86_64

php -v
PHP 5.4.16 (cli) (built: Apr 1 2020 04:07:17)
Copyright (c) 1997-2013 The PHP Group
Zend Engine v2.4.0, Copyright (c) 1998-2013 Zend Technologies

python --version
Python 2.7.5

Kind regards,
Dom aka Clickity Clack

[clickityclack]

Hi Perry,

Unfortunately it doesn't appear that I have access to send personal messages, if it could be arranged for me to have that ability I'm more than happy to send the additional information requested.

The output from the commands you requested is below.

rpm -qa | grep php-
php-pdo-5.4.16-48.el7.x86_64
php-pgsql-5.4.16-48.el7.x86_64
php-pecl-ssh2-0.12-1.el7.x86_64
php-imap-5.4.16-9.el7.x86_64
php-devel-5.4.16-48.el7.x86_64
php-mssql-5.4.16-9.el7.x86_64
php-common-5.4.16-48.el7.x86_64
php-cli-5.4.16-48.el7.x86_64
php-mysql-5.4.16-48.el7.x86_64
php-ldap-5.4.16-48.el7.x86_64
php-pear-1.9.4-22.el7.noarch
php-snmp-5.4.16-48.el7.x86_64
php-mbstring-5.4.16-48.el7.x86_64
php-5.4.16-48.el7.x86_64
php-xml-5.4.16-48.el7.x86_64
php-process-5.4.16-48.el7.x86_64
php-gd-5.4.16-48.el7.x86_64

php -v
PHP 5.4.16 (cli) (built: Apr 1 2020 04:07:17)
Copyright (c) 1997-2013 The PHP Group
Zend Engine v2.4.0, Copyright (c) 1998-2013 Zend Technologies

python --version
2.7.5

The output from the send_nrdp.txt did not appear to contain any distinguishing information, the output from the file is below.

send_nrdp - NRDP Host and Service Check Client
Copyright (c) 2010-2016 - Nagios Enterprises, LLC
Portions Copyright (c) others - see source code
License: BSD

Usage: /usr/local/nrdp/clients/send_nrdp.php --url=<url> --token=<token> --host=<hostname> [--service=<servicename>] --state=<state> --output=<output> [--usestdin] [--delim=\t]

<url> = The URL used to access the remote NRDP agent.
<token> = The secret token used to access the remote NRDP agent.
<hostname> = The name of the host associated with the passive host/service check result.
<servicename> = For service checks, the name of the service associated with the passive check result.
<state> = An integer indicating the current state of the host or service.
<output> = Text output to be sent as the passive check result. Newlines should be encoded with encoded newlines (\n).
<usestdin> = Accept check result data from STDIN instead of --host,--service,--state,--output flags
Each line contains a check result in the format of:
host[DELIM]state[DELIM]output[DELIM]
or
host[DELIM]service[DELIM]state[DELIM]output[DELIM]
<delim> = The delimeter (DELIM above) to use when processing from STDIN. The default is \t (TAB)

Send a passive host or service check result to a remote Nagios instance using the NRDP agent.

Thanks in advance for any help!

[pbroste]

Hello @clickityclack

Thanks for following up with the details. The 3rd reply on this post will be enough to activate a Private Message correspondence.

• Login to the Nagios XI GUI using a web browser.
• Click the "Admin" > "System Profile" Menu
• Click the "Download Profile" button
• Save the profile.zip file and share

or

Code: Select all

rm -rf /usr/local/nagiosxi/var/components/profile.zip
/usr/local/nagiosxi/scripts/components/getprofile.sh SUPPORT

Then send the resulting /usr/local/nagiosxi/var/components/profile.zip and /tmp/send_nrdp.txt file via Private Message.

Thanks,
Perry

[pbroste]

Hello @clickityclack

Thanks for sending over the System Profile, in review looks like debug is enabled and want to take a look and want to fix that.

file_put_contents(/usr/local/nrdp/server/debug.log): failed to open stream: Permission denied in /usr/local/nrdp/server/includes/utils.inc.php on line

Verify that '/usr/local/nrdp/server/config.inc.php, and find $cfg["debug"] = false;, and change that to true.

Let's go ahead and create it and apply:

Code: Select all

touch /usr/local/nrdp/server/debug.log
chown nagios:nagios /usr/local/nrdp/server/debug.log

Then PM me /usr/local/nrdp/server/debug.log, and I'll take a look at them.

Thanks,
Perry

[clickityclack]

Hi Perry,

Thanks for taking the time to help!
I've sent you the logs from the 25th, let me know if there's anything else I can send to help.

Kind regards,
ClickityClack

[pbroste]

Hello @clickityclack

Thanks for sending over the info, in review we don't see any defining but want to check on several issues we see listed:

We see the following logged that we would like to bring to your attention:

certificate configured for ip-1yourhostaddresshere:443 does NOT include an ID which matches the server name

Also want to verify that you are able to execute the api from the web console:

• nrdp_inbound.png

• nrdp_api.png

Let's have you run through a couple of commands to push service notifications:

Code: Select all

cd /usr/local/nrdp/clients/

Code: Select all

./send_nrdp.sh -u http://yourhostaddresshere/nrdp/ -t yourtoken -H anotherhost -S 0 -o "The host is up and OK"

The results will be logged in:

Code: Select all

/var/log/messages

Also grab the traffic too:

Code: Select all

tcpdump port 80 -w /tmp/network.pcap

Thanks,
Perry

[clickityclack]

Hi Perry,

It looks like it is receiving the commands but the commands I input failed. I have one host with a critical, which I submitted an acknowledge commands to. The output is below.

Jan 27 08:29:53 servername nagios: Error: External command failed -> ACKNOWLEDGE_HOST_PROBLEM;host
Jan 27 08:29:53 servername nagios: External command [1643232593] ACKNOWLEDGE_HOST_PROBLEM;host returned error Command failed

Using the shell script I was able to send the information from the server to itself, and checking in the debug logs it was presented as correctly formated XML as opposed to XML with escape characters. The messages log shows "Error: Got host checkresult for 'centos02', but no such host can be found". I'm also seeing it in the Unconfigured objects, which is all great signs!

I'll try copying over the shell script running that from the core server to see if it's just the php script causing problems. I'll send you a copy of the pcap in a message.

Kind regards,
ClickityClack

[clickityclack]

Hi Perry,

Absolutely happy to report that this seemed to be an issue with the php script I was using.
Switching to the shell script and changing the associated send_nrdp commands in the commands.cfg folder fixed it straight up and I'm seeing it populate into Unconfigured Objects perfectly.

Thank you for the help!

Kind regards,
ClickityClack