| Cheshire Cat Computing http://steveshipway.org/forum/ |
|
| Winsock error 0 trying to send to NSCA. Check the error logs http://steveshipway.org/forum/viewtopic.php?f=22&t=4348 |
Page 1 of 1 |
| Author: | jkennedy8902 [ Mon Jun 13, 2011 7:18 am ] |
| Post subject: | Winsock error 0 trying to send to NSCA. Check the error logs |
Hello I've started recently using Nagios XI. I've been using Nagios Core for sometime now. I'm having some issues I can't seem to figure out with the Windows EventLog agent. Below are the messages I'm receiving from the Windows Server and the Nagios XI (Centos 5) Windows 2008 Server: These messages appear after submitting a Test check from the agent. 1. Winsock error 0 trying to send to NSCA. Check the error logs for the NSCA server! 2. Error: Could not read init packet from server 3. Error (0): Server closed connection before init packet was received Notes: I've tested the NSCA Daemon from the Windows EventLog agent and everything checks out OK Port 5667 is opened up on Nagios Box (I shut down IPTables just in case if it was a firewall issue) Lastest Windows Event Log agent installed (1.9.2) Nagios XI (Centos 5) /var/log/messages Jun 12 15:35:34 localhost xinetd[4033]: START: nsca pid=6930 from=192.168.72.1 Jun 12 15:35:34 localhost xinetd[4033]: EXIT: nsca status=0 pid=6930 duration=0(sec) Jun 12 15:36:20 localhost xinetd[7139]: FAIL: nsca address from=192.168.72.1 Notes: Now this is a bit tricky. I'm no means a Linux expert so I try my best. I have found nsca.cfg and made sure that all is OK but that is where my fault may be. Not sure if it is or not. Double checked password and encryption seems the nsca.cfg and Windows EventLog agent are using the same. Using just a simple password and (1)XOR for encryption. I wish the above /var/log/messages would tell me more but as you can see, it does not but you can see that at least the Windows box is talking to the Linux box. Any help would be appreciated. Thanx!!! |
|
| Author: | stevesh [ Thu Jun 16, 2011 11:09 am ] |
| Post subject: | Re: Winsock error 0 trying to send to NSCA. Check the error logs |
Are you using tcpwrappers on your Nagios server? This message usually comes when either xinetd or tcpwrappers, or the nsca.cfg file, restrict NSCA access to a list of IP ranges, and the client is not in these ranges, so the NSCA daemon hangs up immediately after connect. Check your nagios server -- /etc/host.allow, /etc/xinetd.d/nsca, nsca.cfg, etc (depending on how you installed NSCA) -- and make sure you havent blocked access to your Windows client's IP. |
|
| Author: | yohbur [ Tue Jul 12, 2011 3:54 am ] |
| Post subject: | Re: Winsock error 0 trying to send to NSCA. Check the error logs |
Hi all. I'm using Nagios on Linux RedHat Enterprise, for monitoring some windows servers. Alerts in the webpage and mails work good, but in the application eventmanager of each windows servers, some errors are logged: - Winsock error 997 trying to send to NSCA. Check the error logs for the NSCA server! - Error: Could not read init packet from server - Error: Server closed connection before init packet was received I have tryng to reinstall the NSclient on my servers, but it the same. It can be one day without any errors messages and the day after an error message each hour. |
|
| Author: | stevesh [ Tue Jul 12, 2011 12:15 pm ] |
| Post subject: | Re: Winsock error 0 trying to send to NSCA. Check the error logs |
As I mentioned previously, this means your NSCA server is closing the connection. If using xinetd, check your xinetd allow/deny rules for your client IP If using tcpwrappers, check /etc/hosts.allow and /etc/hosts.deny to see if the client IP is permitted If using a hostbased firewall on the NSCA server, check that it is permitting the connection. Check your nsca and/or xinetd configuration to make sure you do not have a connection limit set Make sure your network is reliable between the two. Check the NSCA server error logs in case something helpful has been placed in there (xinetd will normally log dropped connections) |
|
| Author: | crypt0 [ Fri Apr 27, 2012 1:24 am ] |
| Post subject: | Re: Winsock error 0 trying to send to NSCA. Check the error logs |
| Author: | stevesh [ Mon May 07, 2012 5:17 pm ] |
| Post subject: | Re: Winsock error 0 trying to send to NSCA. Check the error logs |
On your nsca server, check the /etc/xinetd.d/nsca file (or whatever file you are holding the configuration in). Possibly you have allowed_hosts set and so xinetd is dropping connections? Also, make sure nsca is configured correctly to know where the Nagios cmd file is, and it has write access. Check the nsca log file to make sure there are no errors. |
|
| Author: | crypt0 [ Mon May 07, 2012 7:19 pm ] |
| Post subject: | Re: Winsock error 0 trying to send to NSCA. Check the error logs |
I figured it out! It was the payload length simply add the option: string_length=4096 Thanks for your reply! |
|
| Author: | williamnie2088 [ Thu Oct 04, 2012 5:04 am ] |
| Post subject: | Re: Winsock error 0 trying to send to NSCA. Check the error logs |
Hi, I'm got the same error: 1. Winsock error 0 trying to send to NSCA. Check the error logs for the NSCA server! 2. Error: Could not connect to host xxxxxxxxxxxxxxxxxx on port 5667 I wasn't the one configure the NSCA, but is there anyway i can find out if the NSCA is configured properly? |
|
| Author: | stevesh [ Thu Oct 04, 2012 5:41 pm ] |
| Post subject: | Re: Winsock error 0 trying to send to NSCA. Check the error logs |
From your eventlog agent server, try to telnet to port 5667 on the NSCA server. If you cannot connect, then NSCA is not running or there is a firewall blocking you. If you connect but it immediately drops the connection, then the NSCA is misconfigured (see the xinetd only_from or the nsca.conf only_from settings, or else hosts.allow settings). Finally, if you connect and do not immediately drop, it is likely the payload length as the previous user had. It looks like the issue is the firewall or nsca not running one (since you get 'unable to connect' as your message). |
|
| Page 1 of 1 | All times are UTC + 12 hours [ DST ] |
| Powered by phpBB® Forum Software © phpBB Group http://www.phpbb.com/ |
|