(nagios) NRPE daemon : Unable to read output

mariatsji · Post by **mariatsji** » 2012/02/01 11:16:22

Hi,

I have installed NRPE using the RHEL repositories, and it seems to be running fine.

When nagios tries to run the check from another server, the debug output to /var/log/messages from NRPE is this:

Feb 1 11:55:40 frida nrpe[31112]: Connection from 192.168.0.11 port 6345
Feb 1 11:55:40 frida nrpe[31112]: Host address is in allowed_hosts
Feb 1 11:55:40 frida nrpe[31112]: Handling the connection...
Feb 1 11:55:40 frida nrpe[31112]: Host is asking for command 'check_rotated_log_noargs' to be run...
Feb 1 11:55:40 frida nrpe[31112]: Running command: /usr/lib64/nagios/customplugins/check_rotated_log -F /home/test/mylog.log log -q "WARNING|CRITICAL|FATAL"
Feb 1 11:55:40 frida nrpe[31112]: Command completed with return code 3 and output:
Feb 1 11:55:40 frida nrpe[31112]: Return Code: 3, Output: NRPE: Unable to read output
Feb 1 11:55:40 frida nrpe[31112]: Connection from 192.168.0.11 closed.

>ps aux | grep nrpe shows this:
>nrpe 30179 0.0 0.0 40992 1204 ? Ss 11:54 0:00 /usr/sbin/nrpe -c /etc/nagios/nrpe.cfg -d
so the nrpe-daemon is running with the nrpe user, as it should

When I try to run the command manually, however, it works fine:

>sudo -u nrpe /usr/lib64/nagios/customplugins/check_rotated_log -F /home/test/mylog.log -q "WARNING|CRITICAL|FATAL"

prints this to console:

>gives: Log check ok - 0 pattern matches found

Anyone have any ideas to what can be different when nrpe-deamon tries it, and when I try it as 'sudo -u nrpe' ? I even tried to give nrpe a bash-login, did a 'sudo su - nrpe' and verified that the command also run like expected.. before I changed nrpe back to /sbin/nologin

Any ideas are most welcome =)

Post by **TrevorH** » 2012/02/01 16:16:13

I'm not sure if NRPE does what cron does and sanitises the environment before it invokes the command - you might try running
your sudo su - nrpe test and prefixing the command you run with `env -i ...` to simulate what that might look like.

pschaff · Post by **pschaff** » 2012/02/02 01:49:33

Welcome to the CentOS fora. Please see the recommended reading for new users linked in my signature.

[quote]
mariatsji wrote:
I have installed NRPE using the RHEL repositories, and it seems to be running fine.
[/quote]
If you have RHEL please use the support you are paying for.

mariatsji · Post by **mariatsji** » 2012/02/02 08:22:04

Hi,

Thanks for the suggestion. I did the 'sudo su - nrpe' and prefixed the command with 'env -i', but this did not change the output of the check (still the desired output, as opposed to when NRPE run it from remote invokation).
Your suggestion must be near the solution; since the user is the same, and the command is the same, I guess only the environment can differ(?)

btw, the log_check-script that is run is of type #!/bin/bash

mariatsji · Post by **mariatsji** » 2012/02/02 08:26:26

[quote]
pschaff wrote:
Welcome to the CentOS fora. Please see the recommended reading for new users linked in my signature.

[quote]
mariatsji wrote:
I have installed NRPE using the RHEL repositories, and it seems to be running fine.
[/quote]
If you have RHEL please use the support you are paying for.[/quote]

Sorry, I meant 'EPEL'(?), not 'RHEL' - the CentOS-repository for 'extra packages'. I am not using Red Hat Enterprise Linux =)

Post by **TrevorH** » 2012/02/02 08:44:57

Try [u]temporarily[/u] setting selinux to permissive mode by running `setenforce 0` as root. If this makes it work then your selinux contexts or rules need adjusting.

mariatsji · Post by **mariatsji** » 2012/02/02 10:01:38

Thanks!

That did the trick, now I'll google how selinux rules / context works =)

pschaff · Post by **pschaff** » 2012/02/02 14:01:46

The [url=http://wiki.centos.org/?action=fullsearch&context=180&value=selinux&titlesearch=Titles]Wiki articles[/url] are a good starting point for SELinux learning endeavors.

CentOS