permission denied running check_vmfs.sh through NRPE

Question

we have a nagios monitoring system already running and I was after monitor our vmware datastores using the following plugin I installed vmware cli and tested with no issues:

[root@nrpe-relay ~]# /usr/lib64/nagios/plugins/check_vmfs.sh -C /usr/lib64/nagios/plugins/vmware_esxi_conf.txt -S 192.168.20.241 -V /vmfs/volumes/LocalSlot45S6 -w 75 -c 90 -u Gb
WARNING - /vmfs/volumes/LocalSlot45S6 - total: 931.25 Gb - used: 800.95 Gb (86%)- free: 130.29 Gb (14%) | /vmfs/volumes/LocalSlot45S6=800.95Gb;698.43;838.12;;931.25

[root@nrpe-relay ~]# ps auxww|grep nrpe
nagios    1463  0.0  0.1  41468  1364 ?        Ss   21:24   0:00 nrpe -c /etc/nagios/nrpe.cfg -d
root      2261  0.0  0.0 103304   876 pts/0    S+   22:00   0:00 grep nrpe

However I am not getting same value when the command runs remotely:

[root@nagios nagios]# /usr/lib64/nagios/plugins/check_nrpe -H <hostname> -c 'check_datastore_LocalSlot45S6'
CRITICAL -

This is what I have in my cfg file

command[check_datastore_LocalSlot45S6]=/usr/lib64/nagios/plugins/check_vmfs.sh -C /usr/lib64/nagios/plugins/vmware_esxi_conf.txt -S 192.168.20.241 -V /vmfs/volumes/LocalSlot45S6 -w 75 -c 90 -u Gb

and my server cfg:

define service{
    use                     generic-service 
    host_name               <hostname>
    service_description     datastore-LocalSlot45S6
    check_command           check_nrpe!check_datastore_LocalSlot45S6
    }

This is what I can see from /var/log/message:

nagios nagios: EXTERNAL COMMAND: SCHEDULE_FORCED_SVC_CHECK;<hostname>;datastore-LocalSlot1-2S3;1441798845

QUESTION: Anyone has any clue about where the problem is? or how can I trace down this issue?

Firstly, who are you running `nrpe` as on the remote host? You show that you can run the `check_vmfs.sh` on the remote host **as root**, but it is not likely that the NRPE daemon is running as root. Paste the output of `ps auxww|grep nrpe` on the remote host into your answer. — MadHatter, Sep 09 '15 at 11:53
So, we see it's running as user `nagios`. What happens when you try to run `check_vmfs.sh` as the nagios user on nrpe-relay? — MadHatter, Sep 09 '15 at 12:04
Try (as root) `/bin/su - nagios -s /bin/bash`, then run the full command from the shell. — MadHatter, Sep 09 '15 at 12:24
@MadHatter /usr/lib64/nagios/plugins/check_vmfs.sh: line 161: /usr/lib64/nagios/plugins/check_vmfs.err: Permission denied CRITICAL - — masber, Sep 09 '15 at 12:26

score 3 · Accepted Answer · answered Sep 09 '15 at 12:29

Your problem is that the NRPE daemon runs as the user nagios, and that user doesn't have permission to run the command in question.

You will either have to open up permissions so that the user can run it (incidentally, your last comment suggests you're not paying complete attention to the output; it is the file /usr/lib64/nagios/plugins/check_vmfs.err on which permission has been denied, not check_vmfs.sh), or modify the NRPEd to use passwordless sudo, with eg

command[check_datastore_LocalSlot45S6]=sudo /usr/lib64/nagios/plugins/check_vmfs.sh -C /usr/lib64/nagios/plugins/vmware_esxi_conf.txt -S 192.168.20.241 -V /vmfs/volumes/LocalSlot45S6 -w 75 -c 90 -u Gb

coupled with a sudoers entry similar to

nagios  ALL=(root) NOPASSWD: /usr/lib64/nagios/plugins/check_vmfs.sh

If you take the latter route, you will need also to have

Defaults    !requiretty

in your sudoers file, if it is not already there.

thank you mate, I just changed the file owner from root to nagios and that fixed the issue. thanks heaps for your quick response! — masber, Sep 09 '15 at 12:36

permission denied running check_vmfs.sh through NRPE

1 Answers1