NCPA 3.0 Beta Client Install on Red Hat 8

[jcgrayjr]

Hello,

We are in the process of migrating our Nagios Core installation to a new Nagios XI setup. We are also switching from using the old Nagios Core NRPE client connection to using the NCPA client. All of our servers are required by regulations to run with FIPS mode enabled, so we initially ran into the issue of the NCPA Client 2.4.1 failing to start on our Red Hat 8 servers, due to the OpenSSL issue.

After some research and digging, I discovered the NCPA 3.0 BETA downloads and decided to give those a try. I did a test install of the BETA NPCA client on one of our DEV Red Hat 8 servers and I managed to get the RPM to install manually. After the installation was done, everything initially seemed to work fine. I did notice that the manual RPM install didn't seem to automatically setup the services for the NCPA Listener and Passive components, but I was able to figure out how to manually start them for testing purposes. After getting the client started, I was able to connect to it from the Nagios XI server and add all of the initial, default Linux server checks.

However, when I went to add our additional custom plugin checks, the custom plugins checks failed with the logs showing a bunch of Python errors (see log output below). The custom plugins are simple bash scripts that I wrote and put into the "plugins" folder for the NPCA client. These custom plugin checks work fine with the NCPA 2.4.1 client on our Red Hat 7 servers, but show the following errors in the "ncpa_listener.log" file on the Red Hat 8 servers:

Code: Select all

2023-10-31 16:05:28,499 listener INFO before_request() - request.url: https://<ip removed>:5693/api/plugins/check_uvscan
2023-10-31 16:05:28,502 listener.server ERROR Exception on /api/plugins/check_uvscan [GET]
Traceback (most recent call last):
  File "configparser.py", line 805, in get
  File "collections/__init__.py", line 1004, in __getitem__
  File "collections/__init__.py", line 996, in __missing__
KeyError: ''

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "listener/pluginnodes.py", line 66, in get_plugin_instructions
  File "configparser.py", line 808, in get
configparser.NoOptionError: No option '' in section: 'plugin directives'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "flask/app.py", line 2190, in wsgi_app
  File "flask/app.py", line 1486, in full_dispatch_request
  File "flask/app.py", line 1484, in full_dispatch_request
  File "flask/app.py", line 1469, in dispatch_request
  File "listener/server.py", line 289, in token_auth_decoration
  File "listener/server.py", line 1093, in api
  File "listener/pluginnodes.py", line 54, in walk
  File "listener/pluginnodes.py", line 83, in execute_plugin
  File "listener/pluginnodes.py", line 67, in get_plugin_instructions

I was wondering if this is a known issue with the NCPA 3.0 BETA plugin checks or if it was something specifically wrong with our installation. If it should be working, what would I need to do to get my bash check scripts working with the NCPA 3.0 BETA client?

Also, is there any documentation available for the proper way to install the NCPA 3.0 BETA client, where it automatically creates the listener and passive services? I looked, but I could not find any documentation on the support site that was specific to the NCPA 3.0 BETA client installations.

Thank you in advance for any help towards this issue!

Thanks,
John

[jmichaelson]

John, I'm not seeing anything on the issue tracker for NCPA here: https://github.com/NagiosEnterprises/ncpa/issues.

Feel free to create issues for both problems, and attach your custom plugin script if you're comfortable. Otherwise you can send it to me with a private message to look at.

[bbahn]

Hello jcgrayjr,

Can you post your check commands here with any passed parameters? Based on the code around your error message, it looks like your plugin isn't a .sh/.py/.pl/.php/.ps1/.vbs/.wsf/.bat file. Is this correct? I just did some testing on Linux and was having issues with plugins that didn't have an extension. I'm not getting those errors in the log, but it's not working until I give it an extension. I'll throw up an issue for this. Let me know if this is not the issue you're running into.

[jcgrayjr]

Hello bbahn,

You are correct that the bash script file does not have a .sh at the end of it. When I originally created the custom check, we were using Nagios Core with NRPE, so I created the custom bash script and put it in the "libexec" folder for the NRPE checks. The other bash scripts and python scripts in that "libexec" folder did not have extensions, so I kept my scripts the same and did not add one either. I will test out adding the .sh extension later today and let you know if that fixed my issue, but from your post, I have a feeling it will.

jmichaelson, thank you for the link. If the above test of adding .sh to my script doesn't fix my issue, I will look into opening an issue on the issue tracker. If I can't figure out how to open an issue, I will definitely shoot you a PM with my logs and my script.

Thanks again for the replies and help,
John

[jcgrayjr]

Awesome! So, I just tested adding the .sh extension to my custom bash check scripts in the "plugins" folder for the NCPA 3.0 BETA client and it completely fixed the issue. The custom checks are now working without issue.

Thank you again for the quick help in getting it figured out!

Thanks,
John

[jcgrayjr]

I do have one other quick question about the files in the plugins folder. Are these the only acceptable extensions that will work for the plugins files?

.sh/.py/.pl/.php/.ps1/.vbs/.wsf/.bat

Is there any way to get an ELF file to work as a plugin?

One the reasons I ask is that one of the old NRPE libexec checks that we use on every Red Hat server is the "check_uptime" check, but it is an ELF file and not a script. I tried looking through the list of default checks for Nagiox XI, but I could not find anything that monitored the server uptime (unless I completely missed the check in the "_commands" area of the Core Config Manager section of Nagios XI.

So far, this is the only check in the plugins folder I have not been able to get to work on with the NCPA 3.0 BETA client. The "check_uptime" works perfectly with the NCPA 2.4.1 clients on our Red Hat 7 servers.

Thanks,
John

[jsimon]

Hi John,

I believe you should be able to get that ELF file to work by just removing the file type, actually. If you don't manage to get this to work, you could also probably write a small extension in a supported format that calls that script itself and passes the output to NCPA, but I believe removing the file type should work here on a Linux OS.

Let us know if that doesn't work for you, or if you have any other questions!

[bbahn]

As can be seen in the Help->Configuration section of the NCPA interface and https://www.nagios.org/ncpa/help.php#configuration, you can add plugin directives under the [plugin directives] section of your configuration file (/usr/local/ncpa/etc/ncpa.cfg or C:\Program Files\Nagios\NCPA\etc\ncpa.cfg). There you can specify how your NCPA instance will handle different file extensions. It SHOULD be using the automatic directive of running plugin_name plugin_options from a terminal, but as said before it's bugged and you'll have to add a new directive for each file extension for now.

[jcgrayjr]

First off, thank you jsimon and bbahn for the suggestions on how to get an ELF file to work. I ended up trying all of the methods that you two suggested.

So, I first tried just removing the .sh extension as you suggested jsimon, but it still produced an error when trying the run the check from the Nagios XI server. I then wrote a small bash script that called the ELF file and passed it output and exit status to NCPA to return to the Nagios server. This ended up working perfectly fine and I was about to post back here that I had manageto get it to work using this script.

Then I saw bbahn's post about setting the [plugin directives] in the "/usr/local/ncpa/etc/ncpa.cfg" file, so I decided to give that a try (since it would make running any future ELF type file easier than having to create a custom mini bash script to run them). I ended up add this to my ncpa.cfg file:

Code: Select all

.elf = $plugin_name $plugin_args

I then renamed the "check_uptime" ELF file to "check_uptime.elf" and modified the NCPA check in the Nagios XI Core Config Manager - Service management check to point to the .elf file in the $ARG1$ section and it worked like a charm.

Thank you again for the help!
John