;)
;)
;)
;)
;)
;)
Service or Daemon Checks
Service or Daemon checks are system processes that run in the background, usually configured to start when the system boots. There are several different use cases covered in this KB article:
The sections below provide examples of how to perform these checks using different methods.
Service - Started
Check to see if a service is started.
Nagios Plugins
Nagios Plugins does not include a service plugin however the linux-nrpe-agent does provide check_init_service. The plugin returns a CRITICAL state if the service is not started.
| Service Name: | crond |
Command:
./check_init_service crond
Output:
crond (pid 1689) is running...
NCPA
NPCA includes a service module that can check if a service is running.
| Service Name: | Spooler |
Command:
./check_ncpa.py -H 10.25.14.91 -t Str0ngT0k3n -M services -q service=Spooler,status=running
Output:
OK: Spooler is running
Be aware that the service module is cAsE SeNsative, you can overcome this with the match= argument.
Command:
./check_ncpa.py -H 10.25.14.91 -t Str0ngT0k3n -M services -q service=spooler,status=running,match=search
Output:
OK: Spooler is running
NSClient++ via check_nt
NSClient++ includes a service module that can check if a service is running.
| Service Name: | Spooler |
Command:
./check_nt -H 10.25.14.10 -p 12489 -s 'Str0ngP@ssw0rd' -v SERVICESTATE -l Spooler -d SHOWALL
Output:
Spooler: Started
NSClient++ via check_nrpe
NSClient++ includes a service module that can check if a service is running.
| Service Name: | Spooler |
Command:
./check_nrpe -H 10.25.14.10 -c check_service -a service=spooler
Output:
OK: All 1 service(s) are ok.
WMI
Check WMI Plus includes a service module that can check if a service is running.
| Service Name: | Spooler |
Command:
./check_wmi_plus.pl -H 10.25.14.3 -u wmiagent -p Str0ngP@ssw0rd -m checkservice -a 'Spooler' -c _Total=1: -c 0
Output:
OK - Found 1 Services(s), 1 OK and 0 with problems (0 excluded). 'Print Spooler' (Spooler) is Running.|'Total Service Count'=1;1; 'Service Count OK State'=1; 'Service Count Problem State'=0;0; 'Excluded Service Count'=0;
SNMP
Checking if a service is running using SNMP is not very straight forward, checking a process is the best solution here, please refer to the Process Checks KB article.
Service - Stopped
Check to see if a service is stopped.
Nagios Plugins
Nagios Plugins does not include a service plugin however the linux-nrpe-agent does provide check_init_service. The plugin can only check if the service is started, you could however use the negate plugin to invert the returned result from the plugin (hence making "stopped" have an OK state).
| Service Name: | crond |
Command:
./negate ./check_init_service crond
Output:
crond is stopped
NCPA
NPCA includes a service module that can check if a service is stopped.
| Service Name: | RemoteAccess |
Command:
./check_ncpa.py -H 10.25.14.91 -t Str0ngT0k3n -M service -q service=RemoteAccess,status=stopped
Output:
OK: RemoteAccess is stopped
Be aware that the service module is cAsE SeNsative, you can overcome this with the match= argument.
Command:
./check_ncpa.py -H 10.25.14.91 -t Str0ngT0k3n -M service -q service=remoteaccess,status=stopped,match=search
Output:
OK: RemoteAccess is stopped
NSClient++ via check_nt
NSClient++ includes a service module that can check if a service is running. The module can only check if the service is started, you could however use the negate plugin to invert the returned result from the plugin (hence making CRITICAL an OK state).
| Service Name: | RemoteAccess |
Command:
./negate -s ./check_nt -H 10.25.14.10 -p 12489 -s 'Str0ngP@ssw0rd' -v SERVICESTATE -l RemoteAccess
Output:
OK: RemoteAccess: Stopped, delayed ()
NSClient++ via check_nrpe
NSClient++ includes a service module that can check if a service is stopped.
| Service Name: | RemoteAccess |
Command:
./check_nrpe -H 10.25.14.10 -c check_service -a service=RemoteAccess "ok=state='stopped'" "warning=not state='stopped'" "critical=not state='stopped'" "perf-config=*(ignored:true)"
Output:
OK: All 1 service(s) are ok.
WMI
Check WMI Plus includes a service module that can check if a service is stopped. The module defines a "good" service as one that is running and a "bad" service is one that is not running, so you can define critical is when more than 0 "good" services exist.
| Service Name: | RemoteAccess |
Command:
./check_wmi_plus.pl -H 10.25.14.3 -u wmiagent -p Str0ngP@ssw0rd -m checkservice -a 'RemoteAccess' -c _NumGood=0
Output:
OK - Found 1 Services(s), 0 OK and 1 with problems (0 excluded). 'Routing and Remote Access' (RemoteAccess) is Stopped.|'Total Service Count'=1; 'Service Count OK State'=0;0; 'Service Count Problem State'=1; 'Excluded Service Count'=0;
Here is the output when the RemoteAccess service was started:
CRITICAL - [Triggered by _NumGood>0] - Found 1 Services(s), 1 OK and 0 with problems (0 excluded). 'Routing and Remote Access' (RemoteAccess) is Running.|'Total Service Count'=1; 'Service Count OK State'=1;0; 'Service Count Problem State'=0; 'Excluded Service Count'=0;
SNMP
Checking if a service is stopped using SNMP is not very straight forward, checking a process is the best solution here, please refer to the Process Checks KB article.
Multiple Services
Some methods support checking multiple services at once.
Nagios Plugins
The check_init_service plugin does not support checking multiple services.
NCPA
NPCA allows you to check multiple services, here is an example that checks for some services that are running and some that are stopped.
| Service Name: | Spooler (running) |
| Service Name: | EventLog (running) |
| Service Name: | RemoteAccess (stopped) |
Command:
./check_ncpa.py -H 10.25.14.91 -t Str0ngT0k3n -M service -q service=Spooler,service=EventLog,status=running,service=RemoteAccess,status=stopped
Output:
OK: Spooler is running, RemoteAccess is stopped, EventLog is running
NSClient++ via check_nt
NSClient++ allows you to check multiple services, here is an example that checks for two services that are running.
| Service Name: | Spooler (running) |
| Service Name: | EventLog (running) |
Command:
./check_nt -H 10.25.14.10 -p 12489 -s 'Str0ngP@ssw0rd' -v SERVICESTATE -l Spooler,EventLog -d SHOWALL
Output:
Spooler: Started, EventLog: Started
NSClient++ via check_nrpe
NSClient++ allows you to check multiple services, here is an example that checks for two services that are running.
| Service Name: | Spooler (running) |
| Service Name: | EventLog (running) |
Command:
./check_nrpe -H 10.25.14.10 -c check_service -a service=Spooler service=EventLog
Output:
OK: All 2 service(s) are ok.
WMI
Check WMI Plus allows you to check multiple services, here is an example that checks for two services that are running.
| Service Name: | Spooler (running) |
| Service Name: | EventLog (running) |
Command:
./check_wmi_plus.pl -H 10.25.14.3 -u wmiagent -p Str0ngP@ssw0rd -m checkservice -a 'Spooler|EventLog' -c _Total=1: -c 0
Output:
OK - Found 2 Services(s), 2 OK and 0 with problems (0 excluded). 'Windows Event Log' (eventlog) is Running, 'Print Spooler' (Spooler) is Running.|'Total Service Count'=2;1; 'Service Count OK State'=2; 'Service Count Problem State'=0;0; 'Excluded Service Count'=0;
SNMP
Checking a service using SNMP is not very straight forward, checking a process is the best solution here, please refer to the Process Checks KB article.
Final Thoughts
For any support related questions please visit the Nagios Support Forums at:
Subscribe to Article
Print Article
Email Article to Friend
Export to PDF
Export to MS Word
