Windows Monitoring - netways

NSClient++ in the new millenium!
( )Discovering NSClient++
Name: Michael Medin (@mickem)
Email: michael@medin.name
Blog: http://blog.medin.name
Project: NSClient++
Web: http://nsclient.org
∘ •

Michael Medin

About NSClient++ (the program)

About NSClient++ (the project)

NSClient++ (What can I do)

NSClient++ (What’s new)

Thank you!

More then a 1000 words

…for windows…

Building on Linux

Building on windows…

More then a 1000 words

…daemon
Tobias Leeger

More then a 1000 words

Secure monitoring

Secure monitoring

Security

Time to get real…

General usage
nscp Display all() available context
nscp --help Get help (can be used in many places)
nscp [options] [-- [module options]]
General usage syntax

Contexts
help Get help
client Act as a client. (think check_nrpe)
Usually aliases we can use instead.
service (un)Install and display windows service
settings Work with configuration
test Find errors and problems
unit Run unit test scripts

Aliases
lua Run lua scripts
python Run python scripts
nrpe Think check_nrpe
nsca Think send_nsca
sys Nice pdh front-end (more to come)
wmi WMI front end
eventlog Add event log message from command line

Settings (Configuration)
nscp settings --help
nscp settings --add-missing --generate [--load-all]
Will update your configuration with ALL keys
nscp settings --add-missing --activate-module
Great way to "enable a new module“
nscp settings --remove-defaults --generate
Will remove all default keys/sections
nscp settings --validate
Show problems with the settings file

check_nrpe
nscp nrpe -- --help
The -- is important
nscp nrpe -- -H 127.0.0.1 -c foo -a foo bar
Execute nrpe query from nsclient++
0.4.2 will introduce:
nrpe_client -H 127.0.0.1 -c foo -a foo bar
nsca_client …
…_client …

Time to get real…

Modules
CheckLogFile
Subscribes to filechanges
SimpleFileWriter
Write notifications to file
NSCAClient
Submit NSCA messages
CheckLogFile
NSCP
NSCA
FILE
NSCAClient
SimpleFileWriter

Resulting config from DEMO
[/modules]
CheckLogFile = enabled
SimpleFileWriter = enabled
[/settings/logfile/real-time/checks/sample]
critical = column2 like 'crit'
destination = FILE
file = ./test.txt
filter = column1 like 'hello'
warning = column2 like 'warn'
[/settings/logfile/real-time]
enabled = true

Resulting config from DEMO
[/modules]
CheckLogFile = enabled
NSCAClient = enabled
SimpleFileWriter = enabled
[/settings/logfile/real-time/checks/sample]
critical = column2 like 'crit'
destination = FILE,NSCA
file = ./test.txt
filter = column1 like 'hello'
warning = column2 like 'warn'
[/settings/logfile/real-time]
enabled = true
[/settings/NSCA/client/targets/default]
address = 127.0.0.1
encryption = xor
password = secret

Run the following
./nscp test
tail –f ./output.txt
echo –e “hello\tworld”
echo –e “hello\twarn”
echo –e “hello\tcrit”

Time to get real…

Modules
CheckLogFile
Subscribes to filechanges
SimpleCache
Store our result
NRPEClient
Accept remote checks (if there is time)
NRPEServer
CheckLogFile
NSCP
CACHE
SimpleCache

Resulting config from DEMO
[/modules]
CheckLogFile = enabled
NSCAClient = enabled
SimpleFileWriter = enabled
SimleCache = enabled
[/settings/logfile/real-time/checks/sample]
critical = column2 like 'crit'
destination = FILE,NSCA,CACHE
file = ./test.txt
filter = column1 like 'hello'
warning = column2 like 'warn'
[/settings/logfile/real-time]
enabled = true
[/settings/NSCA/client/targets/default]
address = 127.0.0.1
encryption = xor
password = secret

Run the following
./nscp test
echo –e “hello\tworld”
echo –e “hello\twarn”
echo –e “hello\tcrit”
In nsclient console execute:
check_cache index=sample

Photo by Olga Berrios

Thank You!
michael@medin.name
http://www. .com/in/mickem
http://blog.medin.name/
http://nsclient.org
facebook.com/nsclient
http://nsclient.org/nscp/conferances/osmc/2012/