NSCA Server - Debug Logging

Debug Logging

These steps explain how to enable the NSCA server to perform debug logging. This is useful for determining exactly what NSCA is doing with the check results it receives.

Before proceeding, you would have confirmed that the server is receiving NSCA check results by watching a TCP Dump and confirming that the firewall rules allow inbound traffic.

You will need to establish a terminal session to the Nagios server that has NSCA installed as a root user to perform these steps.

Editing Files

In many steps of this article you will be required to edit files. This documentation will use the vi text editor. When using the vi
editor:

To make changes press i on the keyboard first to enter insert mode
Press Esc to exit insert mode
When you have finished, save the changes in vi by typing :wq and press Enter

Enable rsyslog Debugging

The rsyslog configuration requires updating to enable debug logging. This changes required depend on your operating system.

RHEL | CentOS | Oracle Linux

Create an rsyslog config using the following command:

vi /etc/rsyslog.d/debug.conf

Add the following line:

daemon.debug     -/var/log/debug

Save the file and exit then proceed to the Restart rsyslog Service section.

Debian

Edit the /etc/rsyslog.conf file using the following command:

vi /etc/rsyslog.conf

Find the following lines:

*.=debug;\
        auth,authpriv.none;\
        news.none;mail.none     -/var/log/debug

You need to add ,daemon.debug to the first line:

*.=debug,daemon.debug;\
        auth,authpriv.none;\
        news.none;mail.none     -/var/log/debug

Save the file and exit then proceed to the Restart rsyslog Service section.

Ubuntu

Ubuntu has the debug lines commented out, you will need to edit the /etc/rsyslog.d/50-default.conf file to remove the comments:

vi /etc/rsyslog.d/50-default.conf

Find the following lines:

#*.=debug;\
#       auth,authpriv.none;\
#       news.none;mail.none     -/var/log/debug

Remove the # from the beginning of each line and add ,daemon.debug to the first line:

*.=debug,daemon.debug;\
       auth,authpriv.none;\
       news.none;mail.none     -/var/log/debug

Save the file and exit then proceed to the Restart rsyslog Service section.

Restart rsyslog Service

Restart the rsyslog service using one of the commands below:

RHEL 7+ | CentOS 7+ | Oracle Linux 7+ | Debian | Ubuntu 16/18/20

systemctl restart rsyslog.service

Enable NSCA Debugging

Edit the nsca.cfg file using the following command:

vi /usr/local/nagios/etc/nsca.cfg

Change:

debug=0

To:

debug=1

Save changes and exit the file.

You need to restart the xinetd service using one of the commands below:

RHEL 7+ | CentOS 7+ | Oracle Linux 7+ | Debian | Ubuntu 16/18/20

systemctl restart xinetd.service

NSCA debugging information is now logged in:

/var/log/debug

You can watch the debug information by running this command:

tail -f /var/log/debug | grep nsca

Which should product output like:

Mar 24 16:18:31 core-007 xinetd[1181]: START: nsca pid=1379 from=::ffff:10.25.14.2
Mar 24 16:18:31 core-007 nsca[1379]: Handling the connection...
Mar 24 16:18:32 core-007 nsca[1379]: Time difference in packet: 0 seconds for host WIN2008R2-01
Mar 24 16:18:32 core-007 nsca[1379]: SERVICE CHECK -> Host Name: 'WIN2008R2-01', Service Description: 'CPU Load', Return Code: '0', Output: 'OK CPU Load ok.|'5m'=0%;80;90 '1m'=4%;80;90 '30s'=4%;80;90'
Mar 24 16:18:32 core-007 nsca[1379]: Attempting to write to nagios command pipe
Mar 24 16:18:32 core-007 nsca[1379]: End of connection...
Mar 24 16:18:32 core-007 xinetd[1181]: EXIT: nsca status=0 pid=1379 duration=1(sec)

Final Thoughts

For any support related questions please visit the Nagios Support Forums at:

http://support.nagios.com/forum/