Ssl – “CHECK_NRPE: Socket timeout after 10 seconds” HTTPS / SSL

fedora-20httpsnagiosnrpessl

I have configured

  • NAGIOS server on IP address AA.BB.CC.DD (Linux Fedora 20), and
  • Monitoring the host with IP address LL.MM.NN.OO (Linux Fedora 20).

I have configured NRPE to run on port # 15666 on both the machines, and configured iptables.
I am accessing NAGIOS web interface securely over https (SSL) [e.g. (https://AA.BB.CC.DD/nagios)].

On the NAGIOS server, when I run the command, I can see the output:

sudo -u nagios /usr/lib64/nagios/plugins/check_nrpe -H LL.MM.NN.OO -p 15666 -c check_total_procs
PROCS OK: 114 processes

So, it appears like NRPE is configured correctly.

However, when I check the host/services from the browser (https://AA.BB.CC.DD/nagios), I get an error CHECK_NRPE: Socket timeout after 10 seconds.

Am I missing something?

Well, I have modelled my config files based on the examples in the book "Building a Monitoring Infrastructure with Nagios", and objecttricks.html on Sourceforge.

Here are the snippets from the config files anyways:

define command{
        command_name check_nrpe
        command_line $USER1$/check_nrpe -H $HOSTADDRESS$ -c $ARG1$
        }

and

define service{
        use                     generic-service
        host_name               SystemTest
        service_description     Total Processes
        check_command           check_nrpe!check_total_procs
        }

Remote host configuration:

/etc/nagios/nrpe.cfg has:

command[check_network_security]=/usr/lib64/nagios/plugins/check_procs -c 1:30 -C NetworkSecurity.bin
command[check_network_comm]=/usr/lib64/nagios/plugins/check_procs -c 1:30 -C NetworkCommunication.bin
command[check_ping]=/usr/lib64/nagios/plugins/check_ping -H $ARG1$ -w $ARG2$ -c $AGR3$ -p 5

Best Answer

Since you decided to change the port that NRPE uses for some reason (the default is 5666), you have to change the command definition for check_nrpe to match.

So you'll need to add -p 15666 to the command_line, at the very least.

(If you plan to run NRPE on this alternate port on every host, you can safely add the hard-coded port to the command def. But if you don't intend to do this, you might want to define a new command called check_nrpe_port (or similar) that accepts the port as $ARG2$ and leave the original intact.)

Related Topic