NSClient++ commands for NRPE with Windows Server 2012 from Icinga

Question

I have researched this problem for days but I can't come to a solution. I have a Windows 2012 server with NSClient++ installed on this. I have also an Icinga server with the Nagios NRPE plugin installed. Also, the NSClient++ is configured to accept NRPE commands and the "allow arguments = 1" is set. From the Icinga server, when I give this input:

/usr/lib/nagios/plugins/check_nrpe -H 192.168.1.22 -c alias_cpu

it gives this: OK CPU Load ok.|'5m'=27%;80;90 '1m'=26%;80;90 '30s'=26%;80;90

So everything looks totally fine, but from the Icinga webinterface, I get this error: /usr/lib/nagios/plugins/check_nrpe: option requires an argument -- 'a'

It looks that I just can't get the commands right. I tried every command I found on the internet but none of them works fine. Also, the NSClient documentation for NRPE is outdated, as they say that you should use check_nt but that command is deprecated for over a year now, so I should use check_nrpe but that doesn't work eiter.

So I created a .cfg file in /etc/icinga/objects and I am currently using these commands:

define host{
       use windows-servers
       host_name host.domain.com
       alias host
       address 192.168.1.22
}

define service{
        use                             generic-service
        host_name                       host.domain.com
        service_description             Drive Usage
        check_command                   check_nrpe!alias_disk
        }


define service{
        use                     generic-service
        host_name               host.domain.com
        service_description     CPU Load
        check_command           check_nrpe!alias_cpu
}

On the Windows Server, the settings in the nsclient.ini are these:

[/settings/NRPE/server]
allowed hosts=172.16.0.7
allow arguments=1
port=5666
allow nasty_meta chars=1 
use SSL = 1

Does anyone has an idea what is going wrong here? I am totally out of options now. Am I gving wrong commands? Does anyone know the right commands? Or am I doing something else wrong? Thanks!

Answer 1

On thing I've found (testing on Icinga 2) after some serious debugging is that how you split up the parameters of the check command into different strings affects the way they're passed to the child process. This can be an extremely big issue, depending on how the child process handles command line parameters internally. Here's a particularly thorny real-life example:

object CheckCommand "cc-cisco-interface-status" {
  import "plugin-check-command"

  command = [ PluginDir + "/check_snmp_ifname.sh",
             "-H", "$host.address$",
             "-P 2c",
             "-C", "$host.vars.snmpcommunity$",
             "-o", "IF-MIB::ifOperStatus",
             "-IF", "$service.vars.ifname$"
            ]

So with this command, the child process receives:

$1 = -H
$2 = 1.1.1.1
$3 = -P 2c
$4 = -C
$5 = MyCommunity
$6 = -o
$7 = IF-MIB::ifOperStatus
$8 = -IF
$9 = Serial0/0/0:0

This was driving us insane because, for example,

             "-IF", "$service.vars.ifname$"
$8 = -IF
$9 = Serial0/0/0:0

works while

             "-IF $service.vars.ifname$"
$8 = -IF Serial0/0/0:0

does not.

But I think once you understand what's going on, this becomes a manageable issue (and even convenient, as it gives you some pretty nice control over quoted strings).

Answer 2

This is a few months old, but I want to weigh in.

Your solution, switching the command definitions for check_nrpe and check_nrpe_1arg, is not optimal. check_nrpe is used when you want to pass an external command along with its command-line options, and check_nrpe_1arg is when you want to pass only the external command (which is what you're trying to do).

For your use case, the best solution would be to leave the check_nrpe and check_nrpe_1arg command definitions as-is, and change your service definitions to use the proper command:

define service{
    use                             generic-service
    host_name                       host.domain.com
    service_description             Drive Usage
    check_command                   check_nrpe_1arg!alias_disk
    }


define service{
    use                             generic-service
    host_name                       host.domain.com
    service_description             CPU Load
    check_command                   check_nrpe_1arg!alias_cpu
}

If you wanted to pass command-line options to nrpe, on the other hand, you would use the check_nrpe command. Like so:

define service {
     use                            generic-service
     host_name                      host.domain.com
     service_description            Check SMART status of sda
     check_command                  check_nrpe!check_smart!/dev/sda
     }

(assuming you have the following check_smart command defined in your nrpe.cfg):

command[check_smart]=/usr/lib/nagios/plugins/check_ide_smart -d $ARG1$

Answer 3

With the help of the Icinga/Nagios forum, I found out that define_command was this:

# this command runs a program $ARG1$ with arguments $ARG2$
define command {
        command_name    check_nrpe
        command_line    /usr/lib/nagios/plugins/check_nrpe -H $HOSTADDRESS$ -c $ARG1$ -a $ARG2$
}

# this command runs a program $ARG1$ with no arguments
define command {
        command_name    check_nrpe_1arg
        command_line    /usr/lib/nagios/plugins/check_nrpe -H $HOSTADDRESS$ -c $ARG1$
}

And should be this:

# this command runs a program $ARG1$ with arguments $ARG2$
define command {
        command_name    check_nrpe_1arg

        command_line    /usr/lib/nagios/plugins/check_nrpe -H $HOSTADDRESS$ -c $ARG1$ -a $ARG2$
}

# this command runs a program $ARG1$ with no arguments
define command {
        command_name    check_nrpe
        command_line    /usr/lib/nagios/plugins/check_nrpe -H $HOSTADDRESS$ -c $ARG1$
}

Only swapped two lines but cost me days to find out. But fortunately, it's solved now.