[NSClient++] Topic #357 - Stops sending checks

Topic #357 - Stops sending checks

David — Mon, 02 Mar 2009 13:14:40 GMT

I am using 3.6 on a Vista machine. I have it configured to send checks via NSCA. It works for a while and then stops sending. The service is running. If I restart the service on the vista box it starts working again and then fails. The log shows the following:

2009-03-02 08:02:04: debug:NSClient++.cpp:736: No shared session: ignoring change event!

Thanks in advance,

David

Reply #1160 to topic #357 - Stops sending checks

Enrico — Fri, 24 Apr 2009 15:13:32 GMT

Hello,

I have your some problem, I tryed also the rc8 but nothing to do.. I am experiment nagios in my farm, I have more then 100 windows machine and about 900 linux servers. For this reason I would like to use nsca instead nrpe. Nsca for linux servers work fine but for the windows servers, with nsclientpp (i tryed rc2 and rc8), after a while I didn't receive the passive checks anymore. For this reason today I switched to NRPE for the win servers.

Please if you found a solution, write it here.

Thank you --

Enrico

[NSCA Agent] interval=120 encryption_method=1 password=blablabla nsca_host=nagios nsca_port=5667 hostname=ts02

[NSCA Commands] cpu_check=checkCPU warn=80 crit=90 time=20m time=10s time=4 mem_check=checkMem MaxWarn=80% MaxCrit=90% ShowAll type=page svc_check=checkServiceState CheckAll? exclude=wampmysqld exclude=MpfService? c_check=CheckDriveSize ShowAll MinWarnFree?=10% MinCritFree?=5% Drive=c:\ l_check=CheckDriveSize ShowAll MinWarnFree?=10% MinCritFree?=5% Drive=l:\ uptime=checkUpTime MinWarn=2h MinCrit=1h

[NRPE Handlers] check_cpu=inject checkCPU warn=80 crit=90 5 10 15 check_eventlog=inject CheckEventLog Application warn.require.eventType=error warn.require.eventType=warning critical.require.eventType=error critical.exclude.eventType=info truncate=1024 descriptions

check_disk_c=inject CheckDriveSize ShowAll MinWarnFree?=10% MinCritFree?=5% Drive=c:\ check_disk_d=inject CheckDriveSize ShowAll MinWarnFree?=10% MinCritFree?=5% Drive=d:\ check_disk_l=inject CheckDriveSize ShowAll MinWarnFree?=10% MinCritFree?=5% Drive=l:\ check_services=inject checkServiceState CheckAll? exclude=wampmysqld exclude=MpfService?

check_drivesize=inject CheckDriveSize MinWarn=25% MinCrit=15% CheckAll? FilterType?=FIXED

check_pagefile=inject checkMem MaxWarn=80% MaxCrit=90% ShowAll type=page check_mem=inject checkMem MaxWarn=80% MaxCrit=90% ShowAll check_uptime=inject checkUpTime MinWarn=2h MinCrit=1h

Reply #1147 to topic #357 - Stops sending checks

Mikko — Tue, 14 Apr 2009 08:46:11 GMT

No help with RC8 version. At this moment I have about 20 of 30 servers not sending results.

No errors in windows event logs or nagios server logs. nsclient++ log has last lines: 2009-04-08 16:40:37: debug:modules\NSCAAgent\NSCAThread.cpp:182: Sending to server... 2009-04-08 16:40:37: debug:modules\NSCAAgent\NSCAThread.cpp:189: Looked up 192.168.xxx.xxx to 192.168.xxx.xxx

And when I log on to the server to see what's going on, it logged these two lines:

2009-04-14 11:26:00: debug:NSClient++.cpp:745: No shared session: ignoring change event! 2009-04-14 11:26:01: debug:NSClient++.cpp:745: No shared session: ignoring change event!

If I restart nsclientpp everything runs fine again for some time...

Here is my nsc.ini:

[modules] FileLogger.dll CheckSystem.dll CheckDisk.dll CheckHelpers.dll NSCAAgent.dll

[Settings] use_file=1

[log] debug=1 file=nsclient.log root_folder=exe

[NSCA Agent] interval=300 encryption_method=3 password=xxxxxxxxx

hostname=HOSTNAME.domain.local nsca_host=192.168.xxx.xxx nsca_port=5667

[NSCA Commands] host_check=CheckOK uptimecheck=CheckUpTime MinWarn=8h MinCrit=1h hdcheck=CheckDriveSize ShowAll CheckAll? FilterType?=FIXED MinWarnFree?=10% MinCritFree?=5% cpucheck=checkCPU warn=80 crit=90 time=20m time=10s time=4 memorycheck=checkMem MaxWarn=90% MaxCrit=95% ShowAll type=physical runningservices=checkServiceState CheckAll? exclude=MpfService? exclude=SysmonLog?

Reply #1142 to topic #357 - Stops sending checks

Mikko — Tue, 07 Apr 2009 11:23:23 GMT

Should I try the RC8 version?

I installed RC8 on about 10 servers, and I'll keep you informed

Reply #1138 to topic #357 - Stops sending checks

Mikko — Mon, 06 Apr 2009 07:07:10 GMT

I have this same problem on multiple Win 2003 servers. I am only using passive checks on hosts, and they randomly just stop sending. I changed debug=1 on few servers, and I get this error message in log: cpp:736: No shared session: ignoring change event! , but only after I remote desktop to the server, before that nothing for like two days.

When I restart the nsclientpp service everything starts to run normally. It can run 2 hours or 2 weeks just fine, and then stop again.

Should I try the RC8 version?

Reply #1118 to topic #357 - Stops sending checks

David — Fri, 06 Mar 2009 00:31:51 GMT

Did some further investigation. Every time this stops working there is an error in event viewer:

TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts. M$ as a limit on vista ultimate of 25 connection. There are methods to get around this but would rather not.

I have it set to send out every 5 seconds and using encryption.

I turned it down to every 30 seconds and will see if the error returns.

Regards,

David

Reply #1115 to topic #357 - Stops sending checks

David — Thu, 05 Mar 2009 13:00:59 GMT

Prior to the RC7 version I did when it failed that would be the last entry. Before failing the "shared session" is not listed in the log. After moving to the RC7 release it just stops and requires a restart of the service. Here is the last entry in the log when it stopped last. There does not seem to be a pattern in the time frame that it stops. Also the service shows that it is running but the process does not consume and CPU time. When it is functioning properly I see it use CPU time in the task manager.

 2009-03-04 15:00:02: debug:NSClient++.cpp:1017: Injecting: CheckOK: Host is alive
2009-03-04 15:00:02: debug:NSClient++.cpp:1053: Injected Result: OK 'Host is alive'
2009-03-04 15:00:02: debug:NSClient++.cpp:1054: Injected Performance Result: ''
2009-03-04 15:00:02: debug:NSClient++.cpp:1017: Injecting: checkCPU: warn=80, crit=90, time=20m, time=10s, time=4
2009-03-04 15:00:02: debug:NSClient++.cpp:1053: Injected Result: OK 'OK CPU Load ok.'
2009-03-04 15:00:02: debug:NSClient++.cpp:1054: Injected Performance Result: ''20m'=5%;80;90; '10s'=6%;80;90; '4'=5%;80;90; '
2009-03-04 15:00:02: debug:NSClient++.cpp:1017: Injecting: CheckDriveSize: CheckAll, ShowAll=long, MaxWarnUsed=90%, MaxCritUsed=95%, FilterType=FIXED
2009-03-04 15:00:02: debug:NSClient++.cpp:1053: Injected Result: OK 'OK: C:\: Total: 149G - Used: 95.4G (64%) - Free: 53.5G (36%)'
2009-03-04 15:00:02: debug:NSClient++.cpp:1054: Injected Performance Result: ''C:\'=64%;90;95; '
2009-03-04 15:00:02: debug:NSClient++.cpp:1017: Injecting: CheckEventLog: filter=in, file=application, MaxWarn=1, MaxCrit=1, filter=in, filter-generated=>1h, filter.eventID==1017, filter.eventID==35
2009-03-04 15:00:02: debug:NSClient++.cpp:1053: Injected Result: OK 'Eventlog check ok'
2009-03-04 15:00:02: debug:NSClient++.cpp:1054: Injected Performance Result: ''eventlog'=0;1;1; '
2009-03-04 15:00:02: debug:NSClient++.cpp:1017: Injecting: checkMem: MaxWarn=80%, MaxCrit=90%, ShowAll, type=physical
2009-03-04 15:00:02: debug:NSClient++.cpp:1053: Injected Result: OK 'OK: physical memory: 2.53G'
2009-03-04 15:00:02: debug:NSClient++.cpp:1054: Injected Performance Result: ''physical memory'=72%;80;90; '
2009-03-04 15:00:02: debug:modules\NSCAAgent\NSCAThread.cpp:187: Looked xx.xx.xx.xx to xx.xx.xx.xx

Thanks for your help.

David

Reply #1114 to topic #357 - Stops sending checks

mickem — Thu, 05 Mar 2009 05:39:29 GMT

do you always get the same "sahred session" message in your log?

Reply #1113 to topic #357 - Stops sending checks

David — Wed, 04 Mar 2009 21:16:00 GMT

Pulled down the 0.3.6-RC7. Process ran fine for 5 hours exactly. Then just stopped. No errors noted it just quit running. If I stop and restart the process it will continue to run fine and then quit after an undetermined amount of time.

Reply #1111 to topic #357 - Stops sending checks

David — Wed, 04 Mar 2009 14:10:34 GMT

Used the build and got the exact same message as noted above. Ran fine for about 19 hours and then stopped.

Reply #1102 to topic #357 - Stops sending checks

David — Mon, 02 Mar 2009 21:11:03 GMT

I will try that and let you know. Thanks.

Reply #1101 to topic #357 - Stops sending checks

mickem — Mon, 02 Mar 2009 19:36:01 GMT

I have uploaded a new nightly build which adds some more logging as well as catches around the NSCA thread so feel free to see if this sheds more light on the problem.

Michael Medin

Reply #1100 to topic #357 - Stops sending checks

David — Mon, 02 Mar 2009 18:16:30 GMT

Thanks for your assistance. Here is what is in the log when it stops sending.

2009-03-01 19:13:57: debug:modules\NSCAAgent\NSCAThread.cpp:174: Looked up xx.xx.xx.xx to xx.xx.xx.xx
2009-03-01 19:14:02: debug:NSClient++.cpp:1017: Injecting: CheckOK: Host is alive
2009-03-01 19:14:02: debug:NSClient++.cpp:1053: Injected Result: OK 'Host is alive'
2009-03-01 19:14:02: debug:NSClient++.cpp:1054: Injected Performance Result: ''
2009-03-01 19:14:02: debug:NSClient++.cpp:1017: Injecting: checkCPU: warn=80, crit=90, time=20m, time=10s, time=4
2009-03-01 19:14:02: debug:NSClient++.cpp:1053: Injected Result: OK 'OK CPU Load ok.'
2009-03-01 19:14:02: debug:NSClient++.cpp:1054: Injected Performance Result: ''20m'=0%;80;90; '10s'=0%;80;90; '4'=2%;80;90; '
2009-03-01 19:14:02: debug:NSClient++.cpp:1017: Injecting: CheckDriveSize: CheckAll, ShowAll=long, MinWarnUsed=10%, MinCritUsed=5%, FilterType=FIXED
2009-03-01 19:14:02: debug:NSClient++.cpp:1053: Injected Result: OK 'OK: C:\: Total: 149G - Used: 96.2G (64%) - Free: 52.7G (36%)'
2009-03-01 19:14:02: debug:NSClient++.cpp:1054: Injected Performance Result: ''C:\'=64%;10;5; '
2009-03-01 19:14:02: debug:NSClient++.cpp:1017: Injecting: CheckEventLog: filter=in, file=application, MaxWarn=1, MaxCrit=1, filter=in, filter-generated=>1h, filter.eventID==1017, filter.eventID==35
2009-03-01 19:14:02: debug:NSClient++.cpp:1053: Injected Result: OK 'Eventlog check ok'
2009-03-01 19:14:02: debug:NSClient++.cpp:1054: Injected Performance Result: ''eventlog'=0;1;1; '
2009-03-01 19:14:02: debug:NSClient++.cpp:1017: Injecting: checkMem: MaxWarn=80%, MaxCrit=90%, ShowAll, type=page
2009-03-01 19:14:02: debug:NSClient++.cpp:1053: Injected Result: OK 'OK: page file: 2.84G'
2009-03-01 19:14:02: debug:NSClient++.cpp:1054: Injected Performance Result: ''page file'=39%;80;90; '
2009-03-01 19:14:02: debug:modules\NSCAAgent\NSCAThread.cpp:174: Looked up xx.xx.xx.xx to xx.xx.xx.xx
2009-03-01 19:14:07: debug:NSClient++.cpp:736: No shared session: ignoring change event!

Reply #1098 to topic #357 - Stops sending checks

mickem — Mon, 02 Mar 2009 17:04:40 GMT

Is that the only thing in the log? (if so enable debug logging and post full (or more detailed) log)

MickeM