Home » Categories » General Topics » Check Library

Service Checks

Service or Daemon Checks

Service or Daemon checks are system processes that run in the background, usually configured to start when the system boots. There are several different use cases covered in this KB article:

The sections below provide examples of how to perform these checks using different methods.

 

Service - Started

Check to see if a service is started.

 

Nagios Plugins

Nagios Plugins does not include a service plugin however the linux-nrpe-agent does provide check_init_service. The plugin returns a CRITICAL state if the service is not started.

Service Name: crond

Command:

./check_init_service crond

Output:

crond (pid  1689) is running...

NCPA

NPCA includes a service module that can check if a service is running.

Service Name: Spooler

Command:

./check_ncpa.py -H 10.25.14.91 -t Str0ngT0k3n -M service -q service=Spooler,status=running

Output:

OK: Spooler is running

 

Be aware that the service module is cAsE SeNsative, you can overcome this with the match= argument.

Command:

./check_ncpa.py -H 10.25.14.91 -t Str0ngT0k3n -M service -q service=spooler,status=running,match=search

Output:

OK: Spooler is running

NSClient++ via check_nt

NSClient++ includes a service module that can check if a service is running.

Service Name: Spooler

Command:

./check_nt -H 10.25.14.10 -p 12489 -s 'Str0ngP@ssw0rd' -v SERVICESTATE -l Spooler -d SHOWALL

Output:

 Spooler: Started

NSClient++ via check_nrpe

NSClient++ includes a service module that can check if a service is running.

Service Name: Spooler

Command:

./check_nrpe -H 10.25.14.10 -c check_service -a service=spooler

Output:

OK: All 1 service(s) are ok. 

WMI

Check WMI Plus includes a service module that can check if a service is running.

Service Name: Spooler

Command:

./check_wmi_plus.pl -H 10.25.14.3 -u wmiagent -p Str0ngP@ssw0rd -m checkservice -a 'Spooler' -c _Total=1: -c 0

Output:

OK - Found 1 Services(s), 1 OK and 0 with problems (0 excluded). 'Print Spooler' (Spooler) is Running.|'Total Service Count'=1;1; 'Service Count OK State'=1; 'Service Count Problem State'=0;0; 'Excluded Service Count'=0;

SNMP

Checking if a service is running using SNMP is not very straight forward, checking a process is the best solution here, please refer to the Process Checks KB article.

 

 

Service - Stopped

Check to see if a service is stopped.

 

Nagios Plugins

Nagios Plugins does not include a service plugin however the linux-nrpe-agent does provide check_init_service. The plugin can only check if the service is started, you could however use the negate plugin to invert the returned result from the plugin (hence making "stopped" have an OK state).

Service Name: crond

Command:

./negate ./check_init_service crond

Output:

crond is stopped

NCPA

NPCA includes a service module that can check if a service is stopped.

Service Name: RemoteAccess

Command:

./check_ncpa.py -H 10.25.14.91 -t Str0ngT0k3n -M service -q service=RemoteAccess,status=stopped

Output:

OK: RemoteAccess is stopped

 

Be aware that the service module is cAsE SeNsative, you can overcome this with the match= argument.

Command:

./check_ncpa.py -H 10.25.14.91 -t Str0ngT0k3n -M service -q service=remoteaccess,status=stopped,match=search

Output:

OK: RemoteAccess is stopped

NSClient++ via check_nt

NSClient++ includes a service module that can check if a service is running. The module can only check if the service is started, you could however use the negate plugin to invert the returned result from the plugin (hence making CRITICAL an OK state).

Service Name: RemoteAccess

Command:

./negate -s ./check_nt -H 10.25.14.10 -p 12489 -s 'Str0ngP@ssw0rd' -v SERVICESTATE -l RemoteAccess

Output:

 OK: RemoteAccess: Stopped, delayed ()

NSClient++ via check_nrpe

NSClient++ includes a service module that can check if a service is stopped.

Service Name: RemoteAccess

Command:

./check_nrpe -H 10.25.14.10 -c check_service -a service=RemoteAccess "ok=state='stopped'" "warning=not state='stopped'" "critical=not state='stopped'" "perf-config=*(ignored:true)"

Output:

OK: All 1 service(s) are ok. 

WMI

Check WMI Plus includes a service module that can check if a service is stopped. The module defines a "good" service as one that is running and a "bad" service is one that is not running, so you can define critical is when more than 0 "good" services exist.

Service Name: RemoteAccess

Command:

./check_wmi_plus.pl -H 10.25.14.3 -u wmiagent -p Str0ngP@ssw0rd -m checkservice -a 'RemoteAccess' -c _NumGood=0

Output:

OK - Found 1 Services(s), 0 OK and 1 with problems (0 excluded). 'Routing and Remote Access' (RemoteAccess) is Stopped.|'Total Service Count'=1; 'Service Count OK State'=0;0; 'Service Count Problem State'=1; 'Excluded Service Count'=0; 


Here is the output when the RemoteAccess service was started:

CRITICAL - [Triggered by _NumGood>0] - Found 1 Services(s), 1 OK and 0 with problems (0 excluded). 'Routing and Remote Access' (RemoteAccess) is Running.|'Total Service Count'=1; 'Service Count OK State'=1;0; 'Service Count Problem State'=0; 'Excluded Service Count'=0;

 

SNMP

Checking if a service is stopped using SNMP is not very straight forward, checking a process is the best solution here, please refer to the Process Checks KB article.

 

 

Multiple Services

Some methods support checking multiple services at once.

 

Nagios Plugins

The check_init_service plugin does not support checking multiple services.

NCPA

NPCA allows you to check multiple services, here is an example that checks for some services that are running and some that are stopped.

Service Name: Spooler (running)
Service Name: EventLog (running)
Service Name: RemoteAccess (stopped)

Command:

./check_ncpa.py -H 10.25.14.91 -t Str0ngT0k3n -M service -q service=Spooler,service=EventLog,status=running,service=RemoteAccess,status=stopped

Output:

OK: Spooler is running, RemoteAccess is stopped, EventLog is running 

NSClient++ via check_nt

NSClient++ allows you to check multiple services, here is an example that checks for two services that are running.

Service Name: Spooler (running)
Service Name: EventLog (running)

Command:

./check_nt -H 10.25.14.10 -p 12489 -s 'Str0ngP@ssw0rd' -v SERVICESTATE -l Spooler,EventLog -d SHOWALL

Output:

 Spooler: Started, EventLog: Started

NSClient++ via check_nrpe

NSClient++ allows you to check multiple services, here is an example that checks for two services that are running.

Service Name: Spooler (running)
Service Name: EventLog (running)

Command:

./check_nrpe -H 10.25.14.10 -c check_service -a service=Spooler service=EventLog

Output:

OK: All 2 service(s) are ok.

WMI

Check WMI Plus allows you to check multiple services, here is an example that checks for two services that are running.

Service Name: Spooler (running)
Service Name: EventLog (running)

Command:

./check_wmi_plus.pl -H 10.25.14.3 -u wmiagent -p Str0ngP@ssw0rd -m checkservice -a 'Spooler|EventLog' -c _Total=1: -c 0

Output:

OK - Found 2 Services(s), 2 OK and 0 with problems (0 excluded). 'Windows Event Log' (eventlog) is Running, 'Print Spooler' (Spooler) is Running.|'Total Service Count'=2;1; 'Service Count OK State'=2; 'Service Count Problem State'=0;0; 'Excluded Service Count'=0;

SNMP

Checking a service using SNMP is not very straight forward, checking a process is the best solution here, please refer to the Process Checks KB article.

 

 

Final Thoughts

For any support related questions please visit the Nagios Support Forums at:

http://support.nagios.com/forum/

0 (0)
Article Rating (No Votes)
Rate this article
  • Icon PDFExport to PDF
  • Icon MS-WordExport to MS Word
Attachments Attachments
There are no attachments for this article.
Related Articles RSS Feed
Process Checks
Viewed 6249 times since Thu, Nov 23, 2017
Printer Checks
Viewed 741 times since Tue, Nov 28, 2017
Uptime Checks
Viewed 2733 times since Sun, Nov 26, 2017
Performance Counter Checks
Viewed 1759 times since Wed, Nov 15, 2017
Log Checks
Viewed 2125 times since Tue, Nov 28, 2017
Health Checks
Viewed 1540 times since Wed, Nov 29, 2017
Disk Space Checks
Viewed 11302 times since Thu, Nov 9, 2017
CPU Usage Checks
Viewed 4513 times since Sun, Nov 12, 2017
Agent Checks
Viewed 919 times since Tue, Nov 14, 2017
Operating System Checks
Viewed 1543 times since Tue, Nov 14, 2017