Service Checks

Service or Daemon Checks

Service or Daemon checks are system processes that run in the background, usually configured to start when the system boots. There are several different use cases covered in this KB article:

The sections below provide examples of how to perform these checks using different methods.

 

Service - Started

Check to see if a service is started.

 

Nagios Plugins

Nagios Plugins does not include a service plugin however the linux-nrpe-agent does provide check_init_service. The plugin returns a CRITICAL state if the service is not started.

Service Name: crond

Command:

./check_init_service crond

Output:

crond (pid  1689) is running...

NCPA

NPCA includes a service module that can check if a service is running.

Service Name: Spooler

Command:

./check_ncpa.py -H 10.25.14.91 -t Str0ngT0k3n -M service -q service=Spooler,status=running

Output:

OK: Spooler is running

 

Be aware that the service module is cAsE SeNsative, you can overcome this with the match= argument.

Command:

./check_ncpa.py -H 10.25.14.91 -t Str0ngT0k3n -M service -q service=spooler,status=running,match=search

Output:

OK: Spooler is running

NSClient++ via check_nt

NSClient++ includes a service module that can check if a service is running.

Service Name: Spooler

Command:

./check_nt -H 10.25.14.10 -p 12489 -s 'Str0ngP@ssw0rd' -v SERVICESTATE -l Spooler -d SHOWALL

Output:

 Spooler: Started

NSClient++ via check_nrpe

NSClient++ includes a service module that can check if a service is running.

Service Name: Spooler

Command:

./check_nrpe -H 10.25.14.10 -c check_service -a service=spooler

Output:

OK: All 1 service(s) are ok. 

WMI

Check WMI Plus includes a service module that can check if a service is running.

Service Name: Spooler

Command:

./check_wmi_plus.pl -H 10.25.14.3 -u wmiagent -p Str0ngP@ssw0rd -m checkservice -a 'Spooler' -c _Total=1: -c 0

Output:

OK - Found 1 Services(s), 1 OK and 0 with problems (0 excluded). 'Print Spooler' (Spooler) is Running.|'Total Service Count'=1;1; 'Service Count OK State'=1; 'Service Count Problem State'=0;0; 'Excluded Service Count'=0;

SNMP

Checking if a service is running using SNMP is not very straight forward, checking a process is the best solution here, please refer to the Process Checks KB article.

 

 

Service - Stopped

Check to see if a service is stopped.

 

Nagios Plugins

Nagios Plugins does not include a service plugin however the linux-nrpe-agent does provide check_init_service. The plugin can only check if the service is started, you could however use the negate plugin to invert the returned result from the plugin (hence making "stopped" have an OK state).

Service Name: crond

Command:

./negate ./check_init_service crond

Output:

crond is stopped

NCPA

NPCA includes a service module that can check if a service is stopped.

Service Name: RemoteAccess

Command:

./check_ncpa.py -H 10.25.14.91 -t Str0ngT0k3n -M service -q service=RemoteAccess,status=stopped

Output:

OK: RemoteAccess is stopped

 

Be aware that the service module is cAsE SeNsative, you can overcome this with the match= argument.

Command:

./check_ncpa.py -H 10.25.14.91 -t Str0ngT0k3n -M service -q service=remoteaccess,status=stopped,match=search

Output:

OK: RemoteAccess is stopped

NSClient++ via check_nt

NSClient++ includes a service module that can check if a service is running. The module can only check if the service is started, you could however use the negate plugin to invert the returned result from the plugin (hence making CRITICAL an OK state).

Service Name: RemoteAccess

Command:

./negate -s ./check_nt -H 10.25.14.10 -p 12489 -s 'Str0ngP@ssw0rd' -v SERVICESTATE -l RemoteAccess

Output:

 OK: RemoteAccess: Stopped, delayed ()

NSClient++ via check_nrpe

NSClient++ includes a service module that can check if a service is stopped.

Service Name: RemoteAccess

Command:

./check_nrpe -H 10.25.14.10 -c check_service -a service=RemoteAccess "ok=state='stopped'" "warning=not state='stopped'" "critical=not state='stopped'" "perf-config=*(ignored:true)"

Output:

OK: All 1 service(s) are ok. 

WMI

Check WMI Plus includes a service module that can check if a service is stopped. The module defines a "good" service as one that is running and a "bad" service is one that is not running, so you can define critical is when more than 0 "good" services exist.

Service Name: RemoteAccess

Command:

./check_wmi_plus.pl -H 10.25.14.3 -u wmiagent -p Str0ngP@ssw0rd -m checkservice -a 'RemoteAccess' -c _NumGood=0

Output:

OK - Found 1 Services(s), 0 OK and 1 with problems (0 excluded). 'Routing and Remote Access' (RemoteAccess) is Stopped.|'Total Service Count'=1; 'Service Count OK State'=0;0; 'Service Count Problem State'=1; 'Excluded Service Count'=0; 


Here is the output when the RemoteAccess service was started:

CRITICAL - [Triggered by _NumGood>0] - Found 1 Services(s), 1 OK and 0 with problems (0 excluded). 'Routing and Remote Access' (RemoteAccess) is Running.|'Total Service Count'=1; 'Service Count OK State'=1;0; 'Service Count Problem State'=0; 'Excluded Service Count'=0;

 

SNMP

Checking if a service is stopped using SNMP is not very straight forward, checking a process is the best solution here, please refer to the Process Checks KB article.

 

 

Multiple Services

Some methods support checking multiple services at once.

 

Nagios Plugins

The check_init_service plugin does not support checking multiple services.

NCPA

NPCA allows you to check multiple services, here is an example that checks for some services that are running and some that are stopped.

Service Name: Spooler (running)
Service Name: EventLog (running)
Service Name: RemoteAccess (stopped)

Command:

./check_ncpa.py -H 10.25.14.91 -t Str0ngT0k3n -M service -q service=Spooler,service=EventLog,status=running,service=RemoteAccess,status=stopped

Output:

OK: Spooler is running, RemoteAccess is stopped, EventLog is running 

NSClient++ via check_nt

NSClient++ allows you to check multiple services, here is an example that checks for two services that are running.

Service Name: Spooler (running)
Service Name: EventLog (running)

Command:

./check_nt -H 10.25.14.10 -p 12489 -s 'Str0ngP@ssw0rd' -v SERVICESTATE -l Spooler,EventLog -d SHOWALL

Output:

 Spooler: Started, EventLog: Started

NSClient++ via check_nrpe

NSClient++ allows you to check multiple services, here is an example that checks for two services that are running.

Service Name: Spooler (running)
Service Name: EventLog (running)

Command:

./check_nrpe -H 10.25.14.10 -c check_service -a service=Spooler service=EventLog

Output:

OK: All 2 service(s) are ok.

WMI

Check WMI Plus allows you to check multiple services, here is an example that checks for two services that are running.

Service Name: Spooler (running)
Service Name: EventLog (running)

Command:

./check_wmi_plus.pl -H 10.25.14.3 -u wmiagent -p Str0ngP@ssw0rd -m checkservice -a 'Spooler|EventLog' -c _Total=1: -c 0

Output:

OK - Found 2 Services(s), 2 OK and 0 with problems (0 excluded). 'Windows Event Log' (eventlog) is Running, 'Print Spooler' (Spooler) is Running.|'Total Service Count'=2;1; 'Service Count OK State'=2; 'Service Count Problem State'=0;0; 'Excluded Service Count'=0;

SNMP

Checking a service using SNMP is not very straight forward, checking a process is the best solution here, please refer to the Process Checks KB article.

 

 

Final Thoughts

For any support related questions please visit the Nagios Support Forums at:

http://support.nagios.com/forum/

Posted by: - Tue, Nov 14, 2017 at 12:02 AM. This article has been viewed 3884 times.
Online URL: https://support.nagios.com/kb/article/service-checks-775.html

Powered by PHPKB (Knowledge Base Software)