Debug Logging
These steps explain how to enable the NSCA server to perform debug logging. This is useful for determining exactly what NSCA is doing with the check results it receives.
Before proceeding, you would have confirmed that the server is receiving NSCA check results by watching a TCP Dump and confirming that the firewall rules allow inbound traffic.
You will need to establish a terminal session to the Nagios server that has NSCA installed as a root user to perform these steps.
Editing Files
In many steps of this article you will be required to edit files. This documentation will use the vi text editor. When using the vi
editor:
Enable rsyslog Debugging
The rsyslog configuration requires updating to enable debug logging. This changes required depend on your operating system.
RHEL | CentOS | Oracle Linux
Create an rsyslog config using the following command:
vi /etc/rsyslog.d/debug.conf
Add the following line:
daemon.debug -/var/log/debug
Save the file and exit then proceed to the Restart rsyslog Service section.
Debian
Edit the /etc/rsyslog.conf file using the following command:
vi /etc/rsyslog.conf
Find the following lines:
*.=debug;\
auth,authpriv.none;\
news.none;mail.none -/var/log/debug
You need to add ,daemon.debug to the first line:
*.=debug,daemon.debug;\
auth,authpriv.none;\
news.none;mail.none -/var/log/debug
Save the file and exit then proceed to the Restart rsyslog Service section.
Ubuntu
Ubuntu has the debug lines commented out, you will need to edit the /etc/rsyslog.d/50-default.conf file to remove the comments:
vi /etc/rsyslog.d/50-default.conf
Find the following lines:
#*.=debug;\
# auth,authpriv.none;\
# news.none;mail.none -/var/log/debug
Remove the # from the beginning of each line and add ,daemon.debug to the first line:
*.=debug,daemon.debug;\
auth,authpriv.none;\
news.none;mail.none -/var/log/debug
Save the file and exit then proceed to the Restart rsyslog Service section.
Restart the rsyslog service using one of the commands below:
RHEL 7+ | CentOS 7+ | Oracle Linux 7+ | Debian | Ubuntu 16/18/20
systemctl restart rsyslog.service
Edit the nsca.cfg file using the following command:
vi /usr/local/nagios/etc/nsca.cfg
Change:
debug=0
To:
debug=1
Save changes and exit the file.
You need to restart the xinetd service using one of the commands below:
RHEL 7+ | CentOS 7+ | Oracle Linux 7+ | Debian | Ubuntu 16/18/20
systemctl restart xinetd.service
NSCA debugging information is now logged in:
/var/log/debug
You can watch the debug information by running this command:
tail -f /var/log/debug | grep nsca
Which should product output like:
Mar 24 16:18:31 core-007 xinetd[1181]: START: nsca pid=1379 from=::ffff:10.25.14.2
Mar 24 16:18:31 core-007 nsca[1379]: Handling the connection...
Mar 24 16:18:32 core-007 nsca[1379]: Time difference in packet: 0 seconds for host WIN2008R2-01
Mar 24 16:18:32 core-007 nsca[1379]: SERVICE CHECK -> Host Name: 'WIN2008R2-01', Service Description: 'CPU Load', Return Code: '0', Output: 'OK CPU Load ok.|'5m'=0%;80;90 '1m'=4%;80;90 '30s'=4%;80;90'
Mar 24 16:18:32 core-007 nsca[1379]: Attempting to write to nagios command pipe
Mar 24 16:18:32 core-007 nsca[1379]: End of connection...
Mar 24 16:18:32 core-007 xinetd[1181]: EXIT: nsca status=0 pid=1379 duration=1(sec)
For any support related questions please visit the Nagios Support Forums at:
http://support.nagios.com/forum/
Article ID: 83
Created On: Mon, Mar 23, 2015 at 11:11 PM
Last Updated On: Wed, Jan 13, 2021 at 4:45 PM
Authored by: tlea
Online URL: https://support.nagios.com/kb/article/nsca-server-debug-logging-83.html