NSClient++ Help (#1) - NSClient++.exe crashing on Win2k3 (#19) - Message List

Hi, We have found the NSClient++ is crashing occasionally on 2 servers. Can anyone see why this is so? It seems to happen on Win2k3 R2 SP1 ENT/STD. It has started to happen on numerous servers, from SQL2005 to Exchange 2003 servers.

All seems to be random. Is this normal for this client to crash without any warning? I have the below extract from the app event log. Event Type: Error Event Source: Application Error Event Category: (100) Event ID: 1000 Date: 18/04/2007 Time: 9:42:46 PM User: N/A Computer: HMSFP01 Description: Faulting application NSClient++.exe, version 0.0.0.0, faulting module NSClientListener.dll, version 0.0.0.0, fault address 0x0000ebe8. For more information, see Help and Support Center at ​http://go.microsoft.com/fwlink/events.asp. Data: 0000: 41 70 70 6c 69 63 61 74 Applicat 0008: 69 6f 6e 20 46 61 69 6c ion Fail 0010: 75 72 65 20 20 4e 53 43 ure NSC 0018: 6c 69 65 6e 74 2b 2b 2e lient++. 0020: 65 78 65 20 30 2e 30 2e exe 0.0. 0028: 30 2e 30 20 69 6e 20 4e 0.0 in N 0030: 53 43 6c 69 65 6e 74 4c SClientL 0038: 69 73 74 65 6e 65 72 2e istener. 0040: 64 6c 6c 20 30 2e 30 2e dll 0.0. 0048: 30 2e 30 20 61 74 20 6f 0.0 at o 0050: 66 66 73 65 74 20 30 30 ffset 00 0058: 30 30 65 62 65 38 00ebe8 And the below is from the client.log -04-18 21:42:39: debug:.\NSClientListener.cpp:166: Data: ShowAll&backupexecagentaccelerator 2007-04-18 21:42:39: debug:.\NSClient++.cpp:370: Injecting: checkServiceState: ShowAll, backupexecagentaccelerator, nsclient 2007-04-18 21:42:39: debug:.\NSClient++.cpp:390: Injected Result: OK -- backupexecagentaccelerator: Started 2007-04-18 21:42:39: debug:.\NSClient++.cpp:391: Injected Performance Result: 2007-04-18 21:42:40: debug:.\NSClientListener.cpp:141: Data: None&5&ShowAll&Spooler 2007-04-18 21:42:40: debug:.\NSClientListener.cpp:166: Data: ShowAll&Spooler 2007-04-18 21:42:40: debug:.\NSClient++.cpp:370: Injecting: checkServiceState: ShowAll, Spooler, nsclient 2007-04-18 21:42:40: debug:.\NSClient++.cpp:390: Injected Result: OK -- Spooler: Started 2007-04-18 21:42:40: debug:.\NSClient++.cpp:391: Injected Performance Result: 2007-04-18 21:42:40: debug:.\NSClientListener.cpp:141: Data: None&2&5 2007-04-18 21:42:40: debug:.\NSClientListener.cpp:166: Data: 5 2007-04-18 21:42:40: debug:.\NSClient++.cpp:370: Injecting: checkCPU: 5, nsclient 2007-04-18 21:42:40: debug:.\NSClient++.cpp:390: Injected Result: OK -- 0 2007-04-18 21:42:40: debug:.\NSClient++.cpp:391: Injected Performance Result: 2007-04-18 21:42:40: debug:.\NSClientListener.cpp:141: Data: None&4&d 2007-04-18 21:42:40: debug:.\NSClientListener.cpp:166: Data: d 2007-04-18 21:42:40: debug:.\NSClient++.cpp:370: Injecting: CheckDriveSize: d, nsclient 2007-04-18 21:42:40: debug:.\NSClient++.cpp:390: Injected Result: OK -- 144551751680&272116936704 2007-04-18 21:42:40: debug:.\NSClient++.cpp:391: Injected Performance Result: 2007-04-18 21:42:40: debug:.\NSClientListener.cpp:141: Data: None&4&c 2007-04-18 21:42:40: debug:.\NSClientListener.cpp:166: Data: c 2007-04-18 21:42:40: debug:.\NSClient++.cpp:370: Injecting: CheckDriveSize: c, nsclient 2007-04-18 21:42:40: debug:.\NSClient++.cpp:390: Injected Result: OK -- 14682947584&20974428160 2007-04-18 21:42:40: debug:.\NSClient++.cpp:391: Injected Performance Result: 2007-04-18 21:42:40: debug:.\NSClientListener.cpp:141: Data: None&3 2007-04-18 21:42:40: debug:.\NSClientListener.cpp:166: Data: 2007-04-18 21:42:40: debug:.\NSClient++.cpp:370: Injecting: checkUpTime: nsclient 2007-04-18 21:42:40: debug:.\NSClient++.cpp:390: Injected Result: OK -- 2075696 2007-04-18 21:42:40: debug:.\NSClient++.cpp:391: Injected Performance Result:

nsc.ini

[modules] ;# NSCLIENT++ MODULES ;# A list with DLLs to load at startup. ; You will need to enable some of these for NSClient++ to work. ; ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ; * * ; * N O T I C E ! ! ! - Y O U H A V E T O E D I T T H I S * ; * * ; ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! FileLogger.dll CheckSystem.dll CheckDisk.dll NSClientListener.dll NRPEListener.dll SysTray.dll CheckEventLog.dll CheckHelpers.dll ; ; CheckWMI IS AN EXTREM EARLY IDEA SO DONT USE FOR PRODUCTION ENVIROMNEMTS! ;CheckWMI.dll ; ; RemoteConfiguration IS AN EXTREM EARLY IDEA SO DONT USE FOR PRODUCTION ENVIROMNEMTS! ;RemoteConfiguration.dll

[Settings] ;# OBFUSCATED PASSWORD ; This is the same as the password option but here you can store the password in an obfuscated manner. ; *NOTICE* obfuscation is *NOT* the same as encryption, someone with access to this file can still figure out the ; password. Its just a bit harder to do it at first glance. ;obfuscated_password=Jw0KAUUdXlAAUwASDAAB ; ;# PASSWORD ; This is the password (-s) that is required to access NSClient remotely. If you leave this blank everyone will be able to access the daemon remotly. ;password=secret-password ; ;# ALLOWED HOST ADDRESSES ; This is a comma-delimited list of IP address of hosts that are allowed to talk to the all daemons. ; If leave this blank anyone can access the deamon remotly (NSClient still requires a valid password). ; The syntax is host or ip/mask so 192.168.0.0/24 will allow anyone on that subnet access allowed_hosts=127.0.0.1/32,10.3.1.10 ; ;# USE THIS FILE ; Use the INI file as opposed to the registry if this is 0 and the use_reg in the registry is set to 1 ; the registry will be used instead. use_file=1

[log] ;# LOG DEBUG ; Set to 1 if you want debug message printed in the log file (debug messages are always printed to stdout when run with -test) debug=1 ; ;# LOG FILE ; The file to print log statements to file=NSC.log ; ;# LOG DATE MASK ; The format to for the date/time part of the log entry written to file. date_mask=%Y-%m-%d %H:%M:%S

[NSClient] ;# ALLOWED HOST ADDRESSES ; This is a comma-delimited list of IP address of hosts that are allowed to talk to NSClient deamon. ; If you leave this blank the global version will be used instead. allowed_hosts=10.3.1.10 ; ;# NSCLIENT PORT NUMBER ; This is the port the NSClientListener.dll will listen to. port=12489 ; ;# BIND TO ADDRESS ; Allows you to bind server to a specific local address. This has to be a dotted ip adress not a hostname. ; Leaving this blank will bind to all avalible IP adresses. ;bind_to_address=

[Check System] ;# CPU BUFFER SIZE ; Can be anything ranging from 1s (for 1 second) to 10w for 10 weeks. Notice that a larger buffer will waste memory ; so don't use a larger buffer then you need (ie. the longest check you do +1). ;CPUBufferSize=1h ; ;# CHECK RESOLUTION ; The resolution to check values (currently only CPU). ; The value is entered in 1/10:th of a second and the default is 10 (which means ones every second) ;CheckResolution?=10

[NRPE] ;# NRPE PORT NUMBER ; This is the port the NRPEListener.dll will listen to. port=5666 ; ;# COMMAND TIMEOUT ; This specifies the maximum number of seconds that the NRPE daemon will allow plug-ins to finish executing before killing them off. command_timeout=60 ; ;# COMMAND ARGUMENT PROCESSING ; This option determines whether or not the NRPE daemon will allow clients to specify arguments to commands that are executed. ;allow_arguments=0 ; ;# COMMAND ALLOW NASTY META CHARS ; This option determines whether or not the NRPE daemon will allow clients to specify nasty (as in |`&><'"\[]{}) characters in arguments. ;allow_nasty_meta_chars=0 ; ;# USE SSL SOCKET ; This option controls if SSL should be used on the socket. ;use_ssl=1 ; ;# BIND TO ADDRESS ; Allows you to bind server to a specific local address. This has to be a dotted ip adress not a hostname. ; Leaving this blank will bind to all avalible IP adresses. bind_to_address=192.168.43.110 ; ;# ALLOWED HOST ADDRESSES ; This is a comma-delimited list of IP address of hosts that are allowed to talk to NRPE deamon. ; If you leave this blank the global version will be used instead. allowed_hosts=10.3.1.10 ; ;# SCRIPT DIRECTORY ; All files in this directory will become check commands. ; *WARNING* This is undoubtedly dangerous so use with care! script_dir=scripts\

[NRPE Handlers] ;# COMMAND DEFINITIONS ;# Command definitions that this daemon will run. ;# Can be either NRPE syntax: check_drive_c=inject CheckDriveSize MaxWarnUsed?=90% MaxCritUsed?=95% ShowAll Drive=c:\ check_disk_c=c:\windows\system32\cscript.exe NoLogo T:10 C:\NSClient\scripts\check_disk-1.13c\check_disk.wsf /drive:"c:\" /w:300 /c:100 check_service_MSExchangeIS=c:\windows\system32\cscript.exe NoLogo T:10 C:\NSClient\scripts\check_service.wsf MSExchangeIS command[check_users]=/usr/local/nagios/libexec/check_users -w 5 -c 10 ;# Or simplified syntax: ;test=c:\test.bat foo $ARG1$ bar check_disk1=/usr/local/nagios/libexec/check_disk -w 5 -c 10 ;# Or even loopback (inject) syntax (to run internal commands) ;# This is a way to run "NSClient" commands and other internal module commands such as check eventlog etc. check_cpu=inject checkCPU warn=80 crit=90 5 10 15 ;check_eventlog=inject CheckEventLog Application warn.require.eventType=error warn.require.eventType=warning critical.require.eventType=error critical.exclude.eventType=info truncate=1024 descriptions ;check_disk_c=inject CheckFileSize ShowAll MaxWarn=1024M MaxCrit=4096M File:WIN=c:\nsclient\*.* ;# But be careful: ; dont_check=inject dont_check This will "loop forever" so be careful with the inject command... ;# Check some escapings... ; check_escape=inject CheckFileSize ShowAll MaxWarn=1024M MaxCrit=4096M "File: foo \" WIN=c:
WINDOWS
*.*" ;# Some real world samples nrpe_cpu=inject checkCPU warn=80 crit=90 5 10 15 nrpe_ok=C:\nsclient\scripts\ok.bat