"#PE Troubleshooting and Common Solutions

The Industry Standard in IT Infrastructure Monitoring

Purpose
This document describes how to troubleshoot NRPE agent issues. It covers solutions to common problems/errors and general troubleshooting tips. Additionally, it provides a simple ramewor! to systematically drill down problems with NRPE.

Target Audience
This document is intended or admins who are having issues with the NRPE agent on "inu# plat orms. It assumes that you have some basic !nowledge o how NRPE wor!s, that you have installed and created a base con iguration.

Using this Documentation

This document will assume that NRPE and the plugins are installed in the de ault directories. I your corporate build or repo installed NRPE or the Nagios$plugins to a di erent directory than the de ault ones, you will have to ma!e note and substitute your paths or those in this document. The remote system being chec!ed by the NRPE agent will be re erred as %remote host& while the Nagios server will be re erred to as the %'I (erver& or %Nagios (erver&. The command line editor %nano& will be used throughout this document. )ou are welcome to use vim/emacs/etc, but or simplicity*s sa!e, %nano& will be re erenced here. Any pac!ages that must be installed or certain sections o this document will use the standard Red +at / ,ent-( pac!age manager %yum&. I you are using a di erent distribution, you most li!ely will have to install the pac!ages through your pac!age manager .apt$get or /ebian/0buntu, pacman or Archlinu#, emerge or 1entoo, etc2.

What Types of Problems Can an Admin E pect to Encounter !ith "#PE$

The most common problems are ound in the initial setup o NRPE. ,onnection and communication issues are some o the easiest to troubleshoot and resolve. -ther problems that people run into involve speci ic errors reported by 'I in re erence to an agent or remote host.

Error Codes and %ther Issues Co&ered in this Document

This is by no means a de initive list, but these are the most common problems associated with the NRPE agent. Although it is not entirely in the scope o this document, there are a ew tips or troubleshooting N(,lient33 when using the NRPE handler. I you are e#periencing an error with NRPE that is not listed here, you are encouraged to ta!e your support re4uest to the Nagios orums or possible resolutions. Errors' I. II. III. I<. <. <I. <II. <III. I'. '. 'I. 'II. 'III. Return code o 567 is out o bounds $ plugin may be missing Return code o 568 is out o bounds $ plugin may not be e#ecutable ,+E,9:NRPE; Error $ ,ould not complete ((" handsha!e ,+E,9:NRPE; (oc!et timeout a ter n seconds ,+E,9:NRPE; Received = bytes rom daemon. ,hec! the remote server logs or error messages. ,+E,9:NRPE; Error receiving data rom daemon.((" on but not used, too short timeout2 NRPE; 0nable to read output .path in nrpe.c g wrong2 ,ommand *>your plugin?* not de ined ,onnection re used by host No output returned rom plugin Error while loading shared libraries; libssl.so.=.@.A; cannot open shared obBect ile; No such ile or directory Carning; This plugin must be either run as root or setuid ,onnection re used or timed out

"SClient(( "#PE Specific Errors' 'I<. 0N9N-CN; No handler or that command '<. ERR-R; Dissing argument e#ception )*I+ ,eneral Troubleshooting Steps

"agios Enterprises. //C P+%+ 2o 1-34 Saint Paul. M" 33-51 USA

US' -01110"A,I%S0Int6l' (- 73-085409-58 ;a ' (- 73-085409-5<

Web' !!!+nagios+com Email' sales:nagios+com

Page ,opyright E 6=5F Nagios Enterprises, "", Revision 5.= G Darch, 6=5F

"#PE Troubleshooting and Common Solutions

I+ #eturn code of -8= is out of bounds 0 plugin may be missing
This error is usually e#perienced when the plugin re erenced by the command directive in nrpe.c g is either missing rom the libe#ec older or the command directive is named incorrectly. It could also imply that the command name passed through NRPE rom the Nagios 'I server is not de ined in the nrpe.c g ile on the remote host. The irst troubleshooting step is to ma!e sure the plugin e#ists; ls /usr/local/nagios/libexec )ou should see the name o the plugin in 4uestion in the older. I not, you will have to copy the plugin to the /usr/local/nagios/libe#ec older. I the plugin ile e#ists, chec! the nrpe.c g ile on the remote host. Da!e sure the path or the command matches the path to the plugin including any ile e#tension the plugin may have, and chec! the spelling o the command directive itsel . nano /usr/local/nagios/etc/nrpe.cfg )ou will ind the commands de ined near the bottom o the ile. They will be in the ollowing ormat; command[check_foo]=/usr/local/nagios/libexec/check_foo.sh -w x -c y -+ 8+ ,hec! the spelling o *chec!: oo* compared to the spelling o the command in 'I. <eri y the path */usr/local/nagios/libe#ec/chec!: oo.sh*, ma!ing sure that it matches the path o the plugin. (ome plugins have ile e#tensions ..sh, .bin, .pl, .py, etc.2. The path must include the e#tension o the plugin, but the command directive name, wrapped in *command>?* does not need an e#tension. In act, it can be named something entirely di erent than the plugin ile itsel . This way you can use the same plugin or multiple command directives with di erent command names. <eri y that the spelling o the command in Nagios 'I or the NRPE chec! matches the spelling o *chec!: oo* e#actly. The ormat or an nrpe chec! in 'I is as ollows; 5. ,hec! command; chec!:nrpe 6. HAR15H; the command name, or e#ample; chec!: oo F. HAR16H; arguments to be passed to the plugin.

<+ 4+

II+ #eturn code of -87 is out of bounds 0 plugin may not be e ecutable
Dany times when a plugin is downloaded rom the e#change and copied to the remote host, it will not have e#ecutable permissions. )ou can veri y this by getting a long$listing o the libe#ec plugin directory; ls -l /usr/local/nagios/libexec )ou should see a listing similar to; -rwxr-xr-x 1 apache apache 1! -rwxr-xr-x. 1 root root $)*#1* -rwxr-xr-x. 1 root root *,') -rwxr-xr-x. 1 root root &1)$ -rw-r--r--. 1 root root ,' /......0truncated1.......... "eb +an -o. -o. -o. # & 1 1 1 1$%&' !1%1* !1%$, !1%$' !1%$' check_apachere(uests.pl check_apt check_asterisk.pl check_bl check_foo.sh

The ar le t column o the listing are the permissions or each ile. I you noticed, %chec!: oo.sh& is missing an %#& in a ew places. These are e#ecutable permissions and can easily be added to the ile by typing; chmod 2x /usr/local/nagios/libexec/check_foo.sh Remember that %chec!: oo.sh& is Bust an e#ample and you will change that to the actual name and path to your plugin that is missing e#ecutable permissions.

"agios Enterprises. //C P+%+ 2o 1-34 Saint Paul. M" 33-51 USA

US' -01110"A,I%S0Int6l' (- 73-085409-58 ;a ' (- 73-085409-5<

Web' !!!+nagios+com Email' sales:nagios+com

Page 8
,opyright E 6=5F Nagios Enterprises, "", Revision 5.= G Darch, 6=5F

"#PE Troubleshooting and Common Solutions

III+ C>EC?@"#PE' Error 0 Could not complete SS/ handshaAe
Allo!ed hosts' This is probably the most common o all error messages and one o the irst you will e#perience when new to NRPE. There are a ew di erent causes o this, though the most li!ely one is that the Nagios server*s ip address is not de ined in the remote host*s nrpe.c g ile. Edit the nrpe.c g ile on the remote host and loo! or the line; allowed_hosts=1 ).!.!.1 )ou will need to add the ip address o your Nagios server to this line .it is comma0separated2. nano /usr/local/nagios/etc/nrpe.cfg ,hange; allowed_hosts=1 ).!.!.1 To; allowed_hosts=1 ).!.!.134nagios ser.er ip5 I you use #inetd or controlling the NRPE daemon .most people do2, then you need to add the Nagios server*s ip address to the #inetd nrpe con iguration ile; /etc/#inetd.d/nrpe. In this ile you will ind the line; only_from = 1 ).!.!.1 This list is space0delimited .instead o comma delimited li!e the nrpe.c g allowed:hosts directive, con using, I !now2. nano /etc/xinetd.d/nrpe ,hange; only_from = 1 ).!.!.1 To; only_from = 1 ).!.!.1 4-agios ser.er ip5 -ne thing to note is that localhost .567.=.=.52 should remain as it allows you to troubleshoot NRPE issues locally, and disabling it may even brea! a ew select plugins. A ter )ou have made the ollowing changes, restart the NRPE service on the remote host to bring up NRPE with the new con iguration options. I you use #inetd; ser.ice xinetd restart I you use an init$script method .this is the de ault way, but your distribution may vary2; /etc/init.d/nrpe restart SS/ not compiled in' The other common cause is that NRPE was not compiled with ssl enabled. To recompile NRPE with ssl support, browse to your NRPE source directory .usually in /tmp/nrpe$6.5I i you ollowed the compiling NRPE rom source document2 and compile with the switch; ./configure --enable-ssl cd /tmp/nrpe- .1& ./configure --enable-ssl make all make install 0nderstand that i you installed rom a corporate build or rom a pac!age repo, you may have either uninstall the current NRPE pac!age and install rom source or pursue support on the speci ic distribution*s orums or through Nagios support. )inetd Per Source /imit' This cause is rare, but worth mentioning. I you use your remote host*s nrpe server as a nrpe node pro#y .sending all chec!s or the networ! segment to a single nrpe enabled server behind a irewall2, or i you are doing a large number o nrpe chec!s in relatively short time period on one remote host, you may hit the ma#imum connection limit o nrpe. This is technically an #inetd setting and can be uncapped by editing the ile; BetcB inetd+dBnrpe. Add the ollowing lines to the de inition;

"agios Enterprises. //C P+%+ 2o 1-34 Saint Paul. M" 33-51 USA

US' -01110"A,I%S0Int6l' (- 73-085409-58 ;a ' (- 73-085409-5<

Web' !!!+nagios+com Email' sales:nagios+com

Page <
,opyright E 6=5F Nagios Enterprises, "", Revision 5.= G Darch, 6=5F

"#PE Troubleshooting and Common Solutions

per_source = 6-7898:;< instances = 6-7898:;< And then restart nrpe; ser.ice xinetd restart

I*+ C>EC?@"#PE' SocAet timeout after n seconds

Increase SocAet Timeout' This is one o the harder to pin down errors. Dore o ten than not, follo!ing the steps from part III will be enough to solve this problem. Jut sometimes, it is not related to ((" or your allowed hosts. In these instances, it can either be that a plugin is ta!ing longer than %n& seconds to return the chec!, or there is a irewall/port issue. )ou can increase the timeout on the chec!, though you will have to alter the chec! in 'I and the command and connection timeout in the nrpe.c g ile on the remote host. Jy de ault the timeout is set to 5= seconds, which is too short or certain chec!s .dis!/ ilesystem/database chec!s among others2. )ou can speci y the timeout in 'I by including the switch %$t& in the chec!:nrpe command. In 'I, go to the %,ore ,on ig Danager& .,,D2 K ,ommands .on le t2 K (earch or %nrpe& K ,lic! %chec!:nrpe&. In the %,ommand "ine&, change %$t 5=& to a higher value, we will use F= seconds in this e#ample .%$t F=&2. (ave and apply con iguration. )ou may need to change a couple settings in the remote host*s nrpe.c g ile depending on how high you set the timeout in 'I. (peci ically, the %command:timeoutL& and %connection:timeoutL& settings may need to be altered. (et both o these, at minimum, to the value o the timeout in 'I. 0sually the %connection:timeoutLF==& is more than enough, as is the command:timeout which de aults to 8= seconds. I you do set your timeout in 'I higher, at least increase the command:timeout to match. ChecA the "#PE Ser&ice Status' )ou may receive this error i the NRPE daemon is not running on the remote host. I you are using #inetd, you can chec! the status o the service with; ser.ice xinetd status )ou should see output similar to the ollowing; xinetd 0pid 1 *!1 is running...

I you are using the init$script method, or i your distribution does not use the %service& command, you can always grep a process listing; ps -aef = grep nrpe )ou should see output similar to the ollowing .important bits in bold2; nagios #$ 1$ 1 ! "eb * > !!%!!%!) /usr/libexec/nrpe -c /etc/nagios/nrpe.cfg --daemon

I NRPE/#inetd is not running, start it; ser.ice xinetd start -r;

"agios Enterprises. //C P+%+ 2o 1-34 Saint Paul. M" 33-51 USA

US' -01110"A,I%S0Int6l' (- 73-085409-58 ;a ' (- 73-085409-5<

Web' !!!+nagios+com Email' sales:nagios+com

Page 4
,opyright E 6=5F Nagios Enterprises, "", Revision 5.= G Darch, 6=5F

"#PE Troubleshooting and Common Solutions

/path/to/init/script start ChecA ;ire!all and Port Settings' The last o the probable causes o this error is associated with irewalls and ports. I the NRPE tra ic is not traversing a irewall, you will see the chec!s timeout. Additionally, i port M888 is not open on the remote host*s irewall, you may receive a timeout error as well. 0sually #inetd will open the ports automatically, as long as the /etc/#inetd.d/nrpe ile is con igured correctly, and NRPE*s port settings have been added to /etc/services. Nirst, we should ma!e sure that port M888 is open on the remote host. The easiest way to do this, is to Bust run chec!:nrpe rom the remote host to itsel . This will also double as a good way to chec! that NRPE is unctioning as e#pected. -n the remote host; /usr/local/nagios/libexec/check_nrpe -? localhost )ou should get something similar to the ollowing output; -@A; . .1& I not, ma!e sure the that port M888 is open on the remote host*s irewall. I you are using #inetd go bac! to previous step .chec! the NRPE service status2 as it should automatically open the port or you. ChecAing #emote >ost6s Ports and Configuring iptables Cusually for the init script methodD' I you use an init script method, you may have to open port M888 on your irewall, which in the case o most "inu# distributions, is iptables. To get a listing o the current iptables rules, run the ollowing on the remote host; iptables -7 The e#pected output is similar to; BCC;A: - tcp -- !.!.!.!/! !.!.!.!/! tcp dpt%#*** I the port is not open, you will have to add an iptables rule or it. Edit the ile; /etc/sysconfig/iptables and add the line; -B 8-A6: -m state --state -;D -m tcp -p tcp --dport #*** -E BCC;A: (ave the ile and restart nrpe; /path/to/init/script restart ChecAing port 3777 from the "agios )I Ser&er With nmap or telnet' )ou can use telnet or nmap .among other port scanners2 to chec! the remote host*s ports. I you do not have either o those pac!ages, install one o them with yum or R+E"/,ent-( systems .i your distribution is di erent, re er to your pac!age manager*s documentation2; yum install nmap -r; yum install telnet -nce installed, test the connection on port M888 rom the 'I server to the remote host; nmap 4remote host ip5 -p #*** The e#pected output should be similar to; AF@: G:B:; G;@H8C; #***/tcp open nrpe

"agios Enterprises. //C P+%+ 2o 1-34 Saint Paul. M" 33-51 USA

US' -01110"A,I%S0Int6l' (- 73-085409-58 ;a ' (- 73-085409-5<

Web' !!!+nagios+com Email' sales:nagios+com

Page 3
,opyright E 6=5F Nagios Enterprises, "", Revision 5.= G Darch, 6=5F

"#PE Troubleshooting and Common Solutions

Alternatively, test with telnet; telnet 4remote host ip5 #***

*+ C>EC?@"#PE' #ecei&ed 5 bytes from daemon+ ChecA the remote ser&er logs for error messages
Nirst, ma!e sure that NRPE is running as this is a common cause o this error. Nor instructions on how to do so, re er to part I< o this document under the section %,hec! the NRPE (ervice (tatus&. The other causes all deal with arguments. I you are passing arguments to the remote host through nrpe, the argument usage should be consistent between the 'I service chec! and the arguments declared in the command directive in the remote host*s nrpe.c g. Additionally, ,hec! the remote host*s nrpe.c g or the %dont:blame:nrpe& directive. cat /usr/local/nagios/etc/nrpe.cfg = grep blame The e#pected output should be; dont_blame_nrpe=1 Cithout this directive set to %5&, arguments will not be accepted or any chec!s other than those speci ied in the nrpe.c g ile itsel . "o Arguments To chec! it your argument usage is consistent, compare the chec! in 'I to the command directive in the remote host*s nrpe.c g ile. I you have declared all the arguments or a chec! in the nrpe.c g ile, then 'I should pass no arguments other than the command itsel ; nrpe.c g; command[check_users]=/usr/local/nagios/libexec/check_users -w # -c 1! 'I service chec!; check_command% check_nrpe IB@J1I check_users IB@J I2 4blank5 Separate Arguments I you have setup multiple arguments or each threshold/option, 'I should pass them in the same order; nrpe.c g; command[check_users]=/usr/local/nagios/libexec/check_users -w IB@J1I -c IB@J I 'I service chec!; check_command% check_nrpe IB@J1I check_users IB@J I # IB@J$I 1! IB@J&I2 4blank5 Notice how the command directive e#pects HAR15H and HAR16H even though in 'I they are actually HAR16H and HAR1FH. This trips up beginners, as 'I passes all F arguments to chec!:nrpe, where chec!:nrpe then passes the command and it*s 6 arguments to NRPE on the remote host. Oust something to be aware o . Combined Arguments The inal ormat is to encapsulate all o the arguments into one ield in 'I and one HAR15H in the remote host*s nrpe.c g ile. This is how 'I sets up chec!s con igured through the linu#$server and nrpe wiPards, so i you compiled NRPE rom source or the remote host but are using the 'I wiPards to create chec!s, you will have to edit the command directive in the remote host*s nrpe.c g ile.

"agios Enterprises. //C P+%+ 2o 1-34 Saint Paul. M" 33-51 USA

US' -01110"A,I%S0Int6l' (- 73-085409-58 ;a ' (- 73-085409-5<

Web' !!!+nagios+com Email' sales:nagios+com

Page 7
,opyright E 6=5F Nagios Enterprises, "", Revision 5.= G Darch, 6=5F

"#PE Troubleshooting and Common Solutions

nrpe.c g; command[check_users]=/usr/local/nagios/libexec/check_users IB@J1I 'I service chec!; check_command% check_nrpe IB@J1I check_users IB@J I -a K-w # -c 1!K IB@J$I2 4blank5 All three o these argument con iguration methods are valid, though it is best to choose one method and stic! to it or consistency and ease o troubleshooting.

*I+ C>EC?@"#PE' Error recei&ing data from daemon

This error is not to be con used with the error %,+E,9:NRPE; Received = bytes rom daemon& as they have separate causes. Dost o ten, this error is e#perience when passing the no ssl switch .$n2 to chec!:nrpe even though NRPE on the remote host was compiled with ssl enabled. There are very ew instances where NRPE is best run without ssl, so i you added the %$n& switch to your chec! or testing reasons, ma!e sure to remove the switch be ore deploying the chec!. I you do have a good reason or not using ssl, do note that you will have to compile NRPE without ssl to avoid this error when using the %$n& switch. The other general cause o this error, though rare, happens when your chec!*s chec!:nrpe timeout is set too low. To increase the timeout, re er to section o this document named %<. ,+E,9:NRPE; (oc!et timeout a ter n seconds& under the subsection %Increase (oc!et Timeout&.

*II+ "#PE' Unable to read output

This error implies that NRPE did not return any character output. ,ommon causes are incorrect plugin paths in the nrpe.c g ile or that the remote host does not have NRPE installed. Rarely, it is caused by trying to run a plugin that re4uires root privileges. Incorrect Plugin Paths Nirst, chec! the plugin paths in the nrpe.c g ile. Try to browse to the plugin older and ma!e sure the plugins are listed. (ometimes when installing rom a pac!age repo, the commands in nrpe.c g will have a path to a distribution speci ic location. I the nagios$plugins pac!age was installed rom source or moved over rom another remote host, they me be located in a di erent directory. The de ault location or the nagios$plugins can be ound at /usr/local/nagios/libe#ec. )our location may be di erent. -pen up your nrpe.c g ile on the remote host and ta!e note o the path or the command directives .in bold2; command[check_users]=/usr/local/nagios/libexec/check_users IB@J1I ,hange directory to this location and get a listing G you should see a large list o available plugins; cd /usr/local/nagios/libexec/ ls I the directory is blan! or altogether missing, you are either missing the nagios$plugins, or they are in a di erent directory. Is "#PE Installed$ Ne#t, ma!e sure that NRPE is indeed installed on the remote host. The easiest way is with % ind&; find / -name nrpe I the remote host does not have nrpe, you will have to install it irst. I it does have nrpe, re er to part I< o this document %,+E,9:NRPE; (oc!et timeout a ter n seconds&, under the section %,hec! the NRPE (ervice (tatus& to ma!e sure that NRPE is actually running. The Plugin #eEuires FsudoG Pri&ileges Ninally, it may be that your speci ic plugin re4uires root access. /epending on the linu# distribution on the remote host, you may have to consult the speci ic distro*s orums or the %right way& to give permission to the plugin and the user %nagios&. Nor this e#ample, we will

"agios Enterprises. //C P+%+ 2o 1-34 Saint Paul. M" 33-51 USA

US' -01110"A,I%S0Int6l' (- 73-085409-58 ;a ' (- 73-085409-5<

Web' !!!+nagios+com Email' sales:nagios+com

Page =
,opyright E 6=5F Nagios Enterprises, "", Revision 5.= G Darch, 6=5F

"#PE Troubleshooting and Common Solutions

use sudo and the /etc/sudoers ile as it is standard on most mainstream distributions. )ou will need to create a rule in /etc/sudoers or the user nagios and the plugin script/binary in 4uestion. Additionally, i the plugin script calls another system binary that re4uires root access, you will need to speci y a rule or that binary as well .this problem is most o ten ound with raid array plugins that re4uire a access to a third party utility that re4uires root access2. Edit the sudoers ile on the remote host; nano /etc/sudoers )ou will need to add the ollowing line .replace QpluginR with the ile name o your plugin2; nagios B77 = -FABGGD<%/usr/local/nagios/libexec/4plugin5

I your plugin re4uires another binary on the system that is restricted to root, you will have to create an additional rule .replace */path/to/binary* with the actual path to the re4uired binary2; nagios B77 = -FABGGD<%/path/to/binary

This will allow the user nagios .the user that nrpe runs under2 to run the speci ied plugin as root .through sudo2 without a password. )ou should be very care ul with these settings, as incorrectly con iguring it with lead to "AR1E security vulnerabilities. The inal step is to add %sudo& to the command in the remote host*s nrpe.c g; command[check_raid]=sudo /usr/local/nagios/libexec/check_raid Now restart NRPE and veri y the plugin is wor!ing correctly.

*III+ Command 6Hyour pluginI6 not defined

This error is very straight orward. 0sually this is caused by a mismatch between the command name declared in 'I to be chec! through nrpe and the actual command name o the command directive in the remote host*s nrpe.c g ile. Nor e#ample; nrpe.c g; command[check_users]=/usr/local/nagios/libexec/check_users -w # -c 1! 'I service chec!; check_command% check_nrpe IB@J1I check_users IB@J I2 4blank5 Notice how the parts in bold match e actly. I they do not, this error is inevitable and either the 'I HAR15H command or the NRPE command>...? name needs to be changed to match the other.

I)+ Connection refused by host

This error usually relates to port/ irewall issues or improperly con igured %allowed:hosts& directives. (ee the ollowing sections o this document or the pertinent troubleshooting steps; III. ,+E,9:NRPE; Error $ ,ould not complete ((" handsha!e I<. ,+E,9:NRPE; (oc!et timeout a ter n seconds

)+ "o output returned from plugin

There are ew causes o this error, two o which have solutions that have been covered other places in this document. Permissions The most common solution is to chec! the permissions on the chec!:nrpe binary on the 'I server; ls -la /usr/local/nagios/libexec/check_nrpe

"agios Enterprises. //C P+%+ 2o 1-34 Saint Paul. M" 33-51 USA

US' -01110"A,I%S0Int6l' (- 73-085409-58 ;a ' (- 73-085409-5<

Web' !!!+nagios+com Email' sales:nagios+com

Page 1
,opyright E 6=5F Nagios Enterprises, "", Revision 5.= G Darch, 6=5F

"#PE Troubleshooting and Common Solutions

The e#pected permissions should resemble; -rwxrwxr-x. 1 nagios nagios )#&&& -o. 1 !1%$, check_nrpe

I not, change ownership to user/group %nagios& and i# up the permissions; chown nagios%nagios /usr/local/nagios/libexec/check_nrpe chmod u2rwx /usr/local/nagios/libexec/check_nrpe chmod u2rx /usr/local/nagios/libexec/check_nrpe This should be setup by de ault during the 'I install process, but enough people have had the issues that it was worth noting here. Missing Plugin Another cause is a missing plugin ile, though, in order to receive this error, you usually have to also be e#periencing a secondary con iguration issue. In order to resolve issues relating to missing plugins, see the section; %I. Return code o 567 is out o bounds $ plugin may be missing& o this document or possible solutions. The inal cause, and usually the secondary issue or those who ound their plugin missing rom the e#pected location, is an argument usage mismatch between the remote host*s nrpe.c g command directive and the arguments passed by 'I through chec!:nrpe. This was covered in this document under the section; %<. ,+E,9:NRPE; Received = bytes rom daemon. ,hec! the remote server logs or error messages& and the possible solutions can be ound there.

)I+ Error !hile loading shared libraries' libssl+so+5+9+1' cannot open shared obJect file' "o such file or directory
)ou are probably missing the ssl libraries. This is an easy i#, as all you need to do is install openssl rom the host*s distribution repos. Nor e#ample, in ,ent-(/R+E"; yum install openssl )ou can veri y that it installed correctly with; which openssl The output should be similar to; /usr/bin/openssl I you use another distribution other than ,ent-( or R+E", you may need to consult with their orums or run a search with the distribution*s pac!age manager to locate the correct pac!age.

)II+ Warning' This plugin must be either run as root or setuid

This error is usually plugin speci ic and is most commonly e#perienced when trying to use a third$party hardware chec! plugin .most o ten dis! smart chec!s and raid health plugins2. )ou need to either setup the sudoers ile and associated con ig changes mentioned in this document earlier in the section; %<II. NRPE; 0nable to read output The Plugin&, subsection; %Re4uires *sudo* Privileges&. SticAy 2it Alternatively, you could set the stic!y bit on the plugin*s permissions. (udoers is considered sa er, so only use this option i you understand the conse4uences; chmod u2s /usr/local/nagios/libexec/4plugin5

)III+ Connection refused or timed out

This error is most o ten e#perienced when using the remote host as an NRPE pro#y server to a networ! segment. It can also be caused by using an incorrect IP address or hostname in the chec!:nrpe command. .rare in 'I con igurations2 I you do use the remote host as an NRPE pro#y, you may need to increase the ma#imum number o concurrent connections through #inetd. )ou need to add per:source L 0N"IDITE/ to /etc/#inetd.d/nrpe.

"agios Enterprises. //C P+%+ 2o 1-34 Saint Paul. M" 33-51 USA

US' -01110"A,I%S0Int6l' (- 73-085409-58 ;a ' (- 73-085409-5<

Web' !!!+nagios+com Email' sales:nagios+com

Page 9
,opyright E 6=5F Nagios Enterprises, "", Revision 5.= G Darch, 6=5F

"#PE Troubleshooting and Common Solutions

nano /etc/xinetd.d/nrpe Add the ollowing line to the ile inside the closing %S&; per_source=6-7898:;< Restart #inetd; ser.ice xinetd restart

"SClient(( "#PE Specific Errors' )I*+ U"?"%W"' "o handler for that command
This is usually caused by a missing or incorrectly spelled handler .e#ternal alias2 in the remote host*s nsclient.ini/nsc.ini. ,hec! the spelling o the chec!:nrpe command or the service chec! in 'I .the name o the command a ter the %$c&2. It should match the spelling o the e#ternal alias in the nsclient con ig. Nor e#ample; [;xternal Blias] alias_cpu=checkCA6 warn=,! crit='! time=#m time=1m time=$!s ...[truncated]... In the e#ample above, the bolded %alias:cpu& is the handler and there ore the service chec! in 'I should speci y the chec!:nrpe command as %alias:cpu&.

)*+ E##%#' Missing argument e ception

This is usually due to clashing handler names .more than 5 o the same e#ternal alias name2. It can also be caused by an argument mismatch as well. Read over the section %<. ,+E,9:NRPE; Received = bytes rom daemon. ,hec! the remote server logs or error messages& o this document, speci ically the %no Arguments& section or an in depth e#planation o this problem. Instead o editing the command directives in your nrpe.c g ile .which does not e#ist as this is a windows remote host2, edit the %>E#ternal Alias?& section o the nsclient.ini/nsc.ini ile. Da!e sure you argument usage is consistent between the nsclient con ig and the 'I service chec!.

)*I+ ,eneral Troubleshooting Tips

Chen Troubleshooting NRPE issues, there is a general order o procedure or drilling down the problem. (tart with the plugin itsel , and then move to NRPE, and inally chec! your argument usage. I you ollow the general steps below be ore dealing with support, your issue may be solved aster than e#pected as these are always the irst steps a Nagios 'I support representative will as! you to per om; -+ Test the plugin locally first+ ,opy the plugin to your plugins directory ./usr/local/nagios/libe#ec2 on the remote host and run it; /usr/local/nagios/libexec/4name of plugin5 I it does not wor! as e#pected, you may want to chec! the plugin*s usage as you may ind some hints to why it is not wor!ing; /usr/local/nagios/libexec/4name of plugin5 -h )ou may have to set some thresholds, usually warning .$w2 and critical .$c2 or a large number o plugins be ore they will wor! correctly. -nce the plugin has been tested and wor!ing locally rom the remote host, create a command directive or it in the nrpe.c g ile. Ta!e a mental note o how you setup your arguments. 8+ *erify that "#PE is !orAing locally and open to reEuests from the )I ser&er' -n the remote host, run; ser.ice xinetd status -r . or init script systems2;

"agios Enterprises. //C P+%+ 2o 1-34 Saint Paul. M" 33-51 USA

US' -01110"A,I%S0Int6l' (- 73-085409-58 ;a ' (- 73-085409-5<

Web' !!!+nagios+com Email' sales:nagios+com

Page -5
,opyright E 6=5F Nagios Enterprises, "", Revision 5.= G Darch, 6=5F

"#PE Troubleshooting and Common Solutions

ser.ice nrpe status I it is not running, run through the steps in Part III o this document. I it is running, move on to testing the connection to the remote host rom the 'I server with chec!:nrpe. -n the 'I server; /usr/local/nagios/libexec/check_nrpe -? 4remote host ip5 The command above should return the NRPE version o the remote host. I not, ollow the steps in Part I< o this document. -therwise move on to step F. <+ Try the full command from the cli on the )I ser&er' /usr/local/nagios/libexec/check_nrpe -? 4remote host ip5 -c 4command and arguments5 I you do not get the e#pected output, chec! the plugin usage again to ma!e sure your synta# is correct. Additionally, chec! the remote host*s nrpe.c g ile and veri y that your argument usage is consistent. Re er to part <III o this document or in ormation on argument usage. I the plugin does output the e#pected data, move on to step I. 4+ Setup the ser&ice checA in )I' ,reate a new service or the chec!. CCCM 0K Ser&ices 0K Add "e!D (peci y the con ig name and description or the chec!. 0se checA@nrpe in the ChecA@command dropdown. Now set up the command arguments under Command &ie!. LA#,-L is the remote command to be sent to remote host through nrpe. LA#,8L is used or e#tra command args, i you have de ined any in the remote host*s nrpe.c g.. The chec! needs to be applied to a host, so clic! the MManage >ostsM button. (elect a host rom the list and clic! MAdd SelectedM. )ou should see the host appear in the right hand pane under MAssignedM. Now clic! CloseM. -ne thing to note is that you can add multiple host to one service chec!, e ectively chec!ing multiple hosts with the same chec! con iguration. The last thing to do in the 'I con iguration is to set up a ew de aults that 'I e#pects. ,lic! the MChecA SettingsM tab. At minimum, we need to setup chec! intervals, attempts, and a period. MChecA inter&alM speci ies how o ten the chec! is run. #etry inter&al speci ies the time between chec! retries when the service chec! has ailed .(-NT (TATE2. Ma checA attempts speci ies the number o retries a chec! will attempt be ore it is mar!ed as a +AR/ (TATE ail. The last re4uired setting to set on this tab is the ChecA period. This speci ies what in time period the chec! should run and can be con igured or certain days and time rames. i@timeperiod@84 = will be ine or this e#ample. "ast, clic! the MAlert SettingsM and set the M"otification periodM to M i@timeperiod@84 =M. This speci ies the time period or noti ications. .emails, sms, etc.2 ,lic! MManage ContactsM and add a contact to the chec! i you want. All /one. ,lic! MSa&eM. It may ta!e a minute or the service to change rom pending to a (TATE. )ou can add more hosts to the chec! by editing the service chec! and adding hosts or hostgroups. This procedure can be used as an e#ample/abstract or setting up di erent nrpe service chec!s.

"agios Enterprises. //C P+%+ 2o 1-34 Saint Paul. M" 33-51 USA

US' -01110"A,I%S0Int6l' (- 73-085409-58 ;a ' (- 73-085409-5<

Web' !!!+nagios+com Email' sales:nagios+com

Page -,opyright E 6=5F Nagios Enterprises, "", Revision 5.= G Darch, 6=5F