Service or Daemon Checks
Service or Daemon checks are system processes that run in the background, usually configured to start when the system boots. There are several different use cases covered in this KB article:
The sections below provide examples of how to perform these checks using different methods.
Check to see if a service is started.
Nagios Plugins does not include a service plugin however the linux-nrpe-agent does provide check_init_service. The plugin returns a CRITICAL state if the service is not started.
Service Name: | crond |
Command:
./check_init_service crond
Output:
crond (pid 1689) is running...
NPCA includes a service module that can check if a service is running.
Service Name: | Spooler |
Command:
./check_ncpa.py -H 10.25.14.91 -t Str0ngT0k3n -M services -q service=Spooler,status=running
Output:
OK: Spooler is running
Be aware that the service module is cAsE SeNsative, you can overcome this with the match= argument.
Command:
./check_ncpa.py -H 10.25.14.91 -t Str0ngT0k3n -M services -q service=spooler,status=running,match=search
Output:
OK: Spooler is running
NSClient++ includes a service module that can check if a service is running.
Service Name: | Spooler |
Command:
./check_nt -H 10.25.14.10 -p 12489 -s 'Str0ngP@ssw0rd' -v SERVICESTATE -l Spooler -d SHOWALL
Output:
Spooler: Started
NSClient++ includes a service module that can check if a service is running.
Service Name: | Spooler |
Command:
./check_nrpe -H 10.25.14.10 -c check_service -a service=spooler
Output:
OK: All 1 service(s) are ok.
Check WMI Plus includes a service module that can check if a service is running.
Service Name: | Spooler |
Command:
./check_wmi_plus.pl -H 10.25.14.3 -u wmiagent -p Str0ngP@ssw0rd -m checkservice -a 'Spooler' -c _Total=1: -c 0
Output:
OK - Found 1 Services(s), 1 OK and 0 with problems (0 excluded). 'Print Spooler' (Spooler) is Running.|'Total Service Count'=1;1; 'Service Count OK State'=1; 'Service Count Problem State'=0;0; 'Excluded Service Count'=0;
Checking if a service is running using SNMP is not very straight forward, checking a process is the best solution here, please refer to the Process Checks KB article.
Check to see if a service is stopped.
Nagios Plugins does not include a service plugin however the linux-nrpe-agent does provide check_init_service. The plugin can only check if the service is started, you could however use the negate plugin to invert the returned result from the plugin (hence making "stopped" have an OK state).
Service Name: | crond |
Command:
./negate ./check_init_service crond
Output:
crond is stopped
NPCA includes a service module that can check if a service is stopped.
Service Name: | RemoteAccess |
Command:
./check_ncpa.py -H 10.25.14.91 -t Str0ngT0k3n -M service -q service=RemoteAccess,status=stopped
Output:
OK: RemoteAccess is stopped
Be aware that the service module is cAsE SeNsative, you can overcome this with the match= argument.
Command:
./check_ncpa.py -H 10.25.14.91 -t Str0ngT0k3n -M service -q service=remoteaccess,status=stopped,match=search
Output:
OK: RemoteAccess is stopped
NSClient++ includes a service module that can check if a service is running. The module can only check if the service is started, you could however use the negate plugin to invert the returned result from the plugin (hence making CRITICAL an OK state).
Service Name: | RemoteAccess |
Command:
./negate -s ./check_nt -H 10.25.14.10 -p 12489 -s 'Str0ngP@ssw0rd' -v SERVICESTATE -l RemoteAccess
Output:
OK: RemoteAccess: Stopped, delayed ()
NSClient++ includes a service module that can check if a service is stopped.
Service Name: | RemoteAccess |
Command:
./check_nrpe -H 10.25.14.10 -c check_service -a service=RemoteAccess "ok=state='stopped'" "warning=not state='stopped'" "critical=not state='stopped'" "perf-config=*(ignored:true)"
Output:
OK: All 1 service(s) are ok.
Check WMI Plus includes a service module that can check if a service is stopped. The module defines a "good" service as one that is running and a "bad" service is one that is not running, so you can define critical is when more than 0 "good" services exist.
Service Name: | RemoteAccess |
Command:
./check_wmi_plus.pl -H 10.25.14.3 -u wmiagent -p Str0ngP@ssw0rd -m checkservice -a 'RemoteAccess' -c _NumGood=0
Output:
OK - Found 1 Services(s), 0 OK and 1 with problems (0 excluded). 'Routing and Remote Access' (RemoteAccess) is Stopped.|'Total Service Count'=1; 'Service Count OK State'=0;0; 'Service Count Problem State'=1; 'Excluded Service Count'=0;
Here is the output when the RemoteAccess service was started:
CRITICAL - [Triggered by _NumGood>0] - Found 1 Services(s), 1 OK and 0 with problems (0 excluded). 'Routing and Remote Access' (RemoteAccess) is Running.|'Total Service Count'=1; 'Service Count OK State'=1;0; 'Service Count Problem State'=0; 'Excluded Service Count'=0;
Checking if a service is stopped using SNMP is not very straight forward, checking a process is the best solution here, please refer to the Process Checks KB article.
Some methods support checking multiple services at once.
The check_init_service plugin does not support checking multiple services.
NPCA allows you to check multiple services, here is an example that checks for some services that are running and some that are stopped.
Service Name: | Spooler (running) |
Service Name: | EventLog (running) |
Service Name: | RemoteAccess (stopped) |
Command:
./check_ncpa.py -H 10.25.14.91 -t Str0ngT0k3n -M service -q service=Spooler,service=EventLog,status=running,service=RemoteAccess,status=stopped
Output:
OK: Spooler is running, RemoteAccess is stopped, EventLog is running
NSClient++ allows you to check multiple services, here is an example that checks for two services that are running.
Service Name: | Spooler (running) |
Service Name: | EventLog (running) |
Command:
./check_nt -H 10.25.14.10 -p 12489 -s 'Str0ngP@ssw0rd' -v SERVICESTATE -l Spooler,EventLog -d SHOWALL
Output:
Spooler: Started, EventLog: Started
NSClient++ allows you to check multiple services, here is an example that checks for two services that are running.
Service Name: | Spooler (running) |
Service Name: | EventLog (running) |
Command:
./check_nrpe -H 10.25.14.10 -c check_service -a service=Spooler service=EventLog
Output:
OK: All 2 service(s) are ok.
Check WMI Plus allows you to check multiple services, here is an example that checks for two services that are running.
Service Name: | Spooler (running) |
Service Name: | EventLog (running) |
Command:
./check_wmi_plus.pl -H 10.25.14.3 -u wmiagent -p Str0ngP@ssw0rd -m checkservice -a 'Spooler|EventLog' -c _Total=1: -c 0
Output:
OK - Found 2 Services(s), 2 OK and 0 with problems (0 excluded). 'Windows Event Log' (eventlog) is Running, 'Print Spooler' (Spooler) is Running.|'Total Service Count'=2;1; 'Service Count OK State'=2; 'Service Count Problem State'=0;0; 'Excluded Service Count'=0;
Checking a service using SNMP is not very straight forward, checking a process is the best solution here, please refer to the Process Checks KB article.
For any support related questions please visit the Nagios Support Forums at:
http://support.nagios.com/forum/
Article ID: 775
Created On: Tue, Nov 14, 2017 at 12:02 AM
Last Updated On: Fri, Oct 25, 2019 at 1:40 PM
Authored by: tlea
Online URL: https://support.nagios.com/kb/article/service-checks-775.html