Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have install Nagios Core and I am using WMI Checks for Windows and Created a script to execute remote commands through ssh on my Linux machines.

When Installing Nagios there is an option to run NsClient++, but I went with the WMI Checks because it is agent less. What are the advantages of using NsClient++ for Nagios?

Also would calling too many commands through WMI or SSH hinder the performance of the remote host?

share|improve this question

1 Answer 1

up vote 0 down vote accepted

There are alot of advantages of using NSclient. Mainly reduced load on the host as it uses NRPE, which is very low bandwidth and uses litte resources to execute the checks.

enter image description here

NRPE works much like SSH or telnet etc. It relays a command and awaits the result. In the above diagram what happens is:

  • Nagios executes check_nrpe with the proper arguments.
  • NSClient++ receives the command to be executed.
  • NSClient++ will execute the command and get a result on the form of , and optionally
  • NSClient++ sends the result back to Nagios
  • Nagios gets the result from check_nrpe (and uses it much like any other plugin).

Source

NRPE imposes less overhead than SSH and you don't need ssh keys. SSH is perfectly fine if you have a small environment but when the Monitoring host is establishing 100's (or 1000's) of SSH sessions a minute it becomes a problem with CPU overhead.

Plus you can write checks for virtually anything on your server not just what is presented to you through the WMI controls. You also get full access to the same info as WMI through the local performance counters without adding overhead from WMI.

Also increased security:

NSclient only needs 1 port open (2 if you have checks using SSL). WMI needs quite a few security exceptions to function properly:

  • DCOM needs to be running on both servers
  • DCOM needs open UDP ports in the 1024-5000 range.
  • The firewall needs the WMI exception added and remote administration.
  • The Monitoring user need to have remote access rights in COM and WMI, Or be a domain admin.

Generally these aren't a security issue as long as your network has a properly configured hardware firewall on the edge. However it does introduce more layers where issues can arise.

Also if Network bandwidth is an issue you can use NSCA passive checks with NSclient ++ which has an even smaller footprint. I stopped using Nagios before NSCA was available so I"m not sure how small the footprint is compared to NRPE.

Don't think I'm bashing WMI here as I now use a NMS that is almost exclusively WMI dependent. I just use it because I receive support and any admin in my group can setup WMI checks (easily) through web UI. However, my vendor suggests only 120 WMI checks per monitoring server and I noticed over 200 checks I needed to upgrade the monitoring VM to a quad core just to use GUI on the server. So if you do have big environment with lots of monitoring over WMI be prepared to setup your monitoring server as a cluster.

share|improve this answer
    
I am using the WMI Checks for windows. NSCA is for linux boxes, But in comparison to running remote commands through SSH, how does NSCA or even NRPE compare? Footprint wise on the server –  jenglee Nov 21 '12 at 17:02
    
@jenglee I don't think you understand how NSclient++ works. When you submit an NRPE or NSCA check on linux or windows it still needs an agent to execute the checks (nsclient). NRPE and NSCA are specific to Nagios not linux, the checks will run fine on any windows server running NSclient ++ as the client provides translation for the checks based on what operating system you use. So the same Check_CPU command will work on windows/linux/unix as long as NSclient is supported. –  Kyle Nov 21 '12 at 17:17
    
To expand on the last comment Nsclient++ includes a config file in the windows directory you installed to prepopulated with most of the common checks. You will see checks such as Check_CPU and the matching performance counter IE: \\Computer \PerfObject(ParentInstance/ObjectInstance#InstanceIndex)\Counter however you can edit that counter to be anything. Or just create your own add entry in nsclient for CHECK_somethingspecificinyourenvirment then add performance counter,snmp OID, ect. then it's up to you to tell nagios how to parse the value returned by NSclient. –  Kyle Nov 21 '12 at 17:22
    
Thanks for the explanation –  jenglee Nov 21 '12 at 19:51
    
Why the downvote? –  Kyle Feb 26 '13 at 13:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.