|
1
2
|
nagios-plugins
==============
|
|
3
4
|
This repository contains my small collection of modified and custom written
nagios check plugins and scripts for [Nagios](http://www.nagios.org).
|
|
5
|
|
|
6
7
|
Most of these are very custom solutions or modified versions of standard plugins
so distributing them through [NagiosExchange](https://exchange.nagios.org/) is
|
|
8
9
10
11
|
not really appropriate. I am publishing them separately so that others may
benefit from these as well. Use them freely and please let me know is you
encounter any issues or require changes.
|
|
12
13
|
Please note: as of December 2024 python scripts were upgraded to python3
|
|
14
|
The latest versions, documentation and bugtracker available on my
|
|
15
|
[GitLab instance](https://gitlab.lindenaar.net/scripts/nagios-plugins)
|
|
16
|
|
|
17
|
Copyright (c) 2015 - 2024 Frederik Lindenaar. free for distribution under
|
|
18
|
the GNU General Public License, see [below](#license)
|
|
19
|
|
|
20
21
22
|
contents
========
This repository contains the following scripts:
|
|
23
24
|
* [check_dns_replication](#check_dns_replication)
check DNS zone replication by comparing zone serial numbers on DNS servers
|
|
25
26
27
28
29
30
|
* [check_memory](#check_memory)
patched version of nagios-plugins check_memory script for Linux procps v3.3+
* [check_multiple_host_addresses](#host_addresses)
monitor multi-home and dual-stack (i.e. ipv4 and ipv6) servers.
* [check_otp](#check_otp)
plugin to monitor PrivacyIDEA (and LinOTP) OTP validation
|
|
31
|
* [check_temperature](#check_temperature)
|
|
32
33
|
plugin to monitor the RaspberryPi CPU temperature or that of an 1-wire
(DS18b20) or I2C (MCP9080) sensor attached to a RaspberryPi
|
|
34
35
|
* [nagiosstatus](#nagiosstatus)
CGI-BIN script to report the status of nagios (to monitor nagios itself)
|
|
36
|
|
|
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
|
<a name=check_dns_replication>plugins/check_dns_replication</a>
---------------------------------------------------------------
With this check plugin / script, Nagios can monitor the replication of DNS zones
between the authoritative DNS server for a domain and one or more of it's slave
(or secondary) DNS servers. The script can check one or multiple DNS zones and
can be pointed at one ore more specific DNS slave server(s) or us the NS records
of the zone to check all DNS servers of that domain (or a combination of this)
The script expects a (comma separated list of) DNS zone(s) to validate as its
first command line parameter. It optionally also accepts one or more DNS servers
to check as further parameters (either separate parameters or comma separated).
If no DNS Servers are provided or the `-n` command line option is passed it will
lookup the DNS Servers from the NS records in de DNS zone.
The script will first fetch the authoritative DNS server from the SOA record, so
that server must be reachable. This first lookup will be done against the first
DNS server, if provided, or the default nameserver of the host. Next it will
fetch the DNS zone's SOA record from each server and compare it with the master.
Installation is straightforward, after installing the script on your server, add
the following to your `commands.cmd` configuration file to make it available:
~~~
# 'check-dns-replication' command definition to check DNS replication of one or more zones
define command {
command_name check-dns-replication
command_line [install_path]/plugins/check_dns_replication -n '$ARG1$' '$HOSTADDRESS$'
}
# 'check-dns-slave' command to check DNS replication of one or more zones against a single server
define command {
command_name check-dns-slave
command_line [install_path]/plugins/check_dns_replication '$ARG1$' '$HOSTADDRESS$'
}
~~~
The example below shows how to check DNS zone replication for the primary DNS
server (which checks replication to all secondaries) and how to check an extra
secondary DNS server that is not listed as NS record in the zone.
~~~
# check DNS replication for an DNS zone to ensure all secondaries are in sync
define service {
host auth.dns.mydomain.tld
service_description DNS Zone Replication
check_command check-dns-replication!mydomain.tld
use generic-service
}
# check DNS replication to a specific secondary DNS server
define service {
host sec1.dns.mydomain.tld
service_description DNS Zone Replication to secondary
check_command check-dns-slave!mydomain.tld
use generic-service
}
~~~
|
|
97
98
|
<a name=check_memory>plugins/check_memory</a>
---------------------------------------------
|
|
99
|
Nagios check script to monitor the memory on Linux systems. Due to changes in
|
|
100
101
102
103
104
105
106
|
the output of procps v3.3 (the changelog refers to it as modernizing it), it's
output changed and breaks the the check_memory script as shipped with many linux
distributions. This version supports both the old and the new format so that
is indifferent of which version of procps (to date) is used. No other changes
were made to the script.
|
|
107
108
|
<a name=host_addresses>plugins/check_multiple_host_addresses</a>
----------------------------------------------------------------
|
|
109
110
111
112
113
114
115
116
117
118
|
This script is a first attempt to monitor multi-home and dual-stack (i.e. ipv4
and ipv6) servers. In my setup a server should only considered availble if it is
available on all of its primary addresses (i.e. both ipv4 and ipv6). It uses the
excellent check_multi script to perform multiple a ping check to see if a host
is available and reports the consolidated status. Using check_multi has the
advantage that pnp4nagios and other scripting graphing solutions will support
this solution as well.
Installation is straightforward, after installing the script on your server, add
the following to your `commands.cmd` configuration file to make it available:
|
|
119
|
|
|
120
|
~~~
|
|
121
122
123
124
125
|
# 'check-host-alive' command definition for multi-homed/dual-stack servers
define command {
command_name check-addresses-alive
command_line [install_path]/plugins/check_multiplehost_addresses '$HOSTADDRESS$' '$_HOSTADDRESS6$'
}
|
|
126
|
~~~
|
|
127
|
|
|
128
129
|
The example above assumes that the IPv6 address of the host is provided as part
of the host configuration, i.e.:
|
|
130
|
|
|
131
|
~~~
|
|
132
133
134
135
136
137
|
define host {
...
address 192.168.0.1
_address6 fdf8:f340:ab9d:c213::1
...
}
|
|
138
|
~~~
|
|
139
140
|
To use the script either add `check_command check-addresses-alive`
|
|
141
142
143
144
|
to the specific hosts that should use the check or to the generic host used as
template.
|
|
145
146
147
148
149
150
151
152
153
154
155
156
|
<a name=check_otp>plugins/check_otp</a>
---------------------------------------
Plugin (check) to monitor OTP validation, currently implemented for PrivacyIDEA
(and LinOTP). The check can validate a provided password/secret or calculate an
HOTP or TOTP value and use that to validate (with or without a password). Other
methods and interfaces can be plugged in easily (please raise a request or
provide a patch).
Please run `check_otp -h` for an actual overview of the available options. The
script currently supports 3 modes of operation:
* password - simply authenticate with the provided secret (no calculations)
|
|
157
158
159
|
* totp - calculate the TOTP code using a key and current time
* hotp - calculate the HOTP code using a key and a count (automatically
increments the count in case a count file is used)
|
|
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
|
Generic parameters (connection parameters, critical/warning thresholds, etc.)
should be provided before the mode of operation is specified, mode-specific
parameters should follow the mode selected. Keys, passwords and HOTP counts can
be read from a file as well. Checks can be performed based on token
serial or a login and a password (only mandatory for password authentication).
HOTP/TOTP modes require a Base16/32/64 encoded key provided on the command-line
or in a file. The generated HOTP/TOTP value is appended to the password/secret
(if provided), the order can be changed with the `-m` command line parameter.
Installation for is straightforward, after installing the script on the server
add the following to your Nagios `commands.cmd` configuration file:
~~~
# 'check_totp_serial' command definition to test TOTP based on token serial (no password)
# parameters: token serial (ARG1), key (ARG2), additional parameters in ARG3
define command {
command_name check_totp_serial
command_line [install_path]/plugins/check_otp -H $HOSTNAME$ -w 3 -c 8 -P /token totp -s $ARG1$ -k $ARG2$ $ARG3$
}
# 'check_totp_serial' command definition to test TOTP based on token serial and password
# parameters: token serial (ARG1), key (ARG2), password (ARG3), additional parameters in ARG4
define command {
command_name check_totp_serial_pwd
command_line [install_path]/plugins/check_otp -H $HOSTNAME$ -w 3 -c 8 -P /token totp -s $ARG1$ -k $ARG2$ -p $ARG3$ $ARG4$
}
# 'check_totp_login' command definition to test TOTP based on login and password
# parameters: login (ARG1), key (ARG2), password (ARG3), additional parameters in ARG4
define command {
command_name check_totp_login
command_line [install_path]/plugins/check_otp -H $HOSTNAME$ -w 3 -c 8 -P /token totp -l $ARG1$ -k $ARG2$ -p $ARG3$ $ARG4$
}
# 'check_totp_serial_dir' command definition to test TOTP based on token serial
# parameters: directory (ARG1), token serial (ARG2) additional parameters in ARG3
define command {
command_name check_totp_serial_dir
command_line [install_path]/plugins/check_otp -H $HOSTNAME$ -w 3 -c 8 -P /token totp -s $ARG2$ -K $ARG1$/$ARG2$.key $ARG3$
}
# 'check_totp_serial_dir_pwd' command definition to test TOTP based on token serial and password
# parameters: directory (ARG1), token serial (ARG2), additional parameters in ARG3
define command {
command_name check_totp_serial_dir_pwd
command_line [install_path]/plugins/check_otp -H $HOSTNAME$ -w 3 -c 8 -P /token totp -s $ARG2$ -K $ARG1$/$ARG2$.key -P $ARG1$/$ARG2$.pwd $ARG3$
}
# 'check_totp_login_dir' command definition to test TOTP based on login
# parameters: directory (ARG1), login (ARG2), additional parameters in ARG3
define command {
command_name check_totp_login_dir
command_line [install_path]/plugins/check_otp -H $HOSTNAME$ -w 3 -c 8 -P /token totp -l $ARG2$ -K $ARG1$/$ARG2$.key $ARG3$
}
# 'check_totp_login_dir_pwd' command definition to test TOTP based on login and password
# parameters: directory (ARG1), login (ARG2) additional parameters in ARG3
define command {
command_name check_totp_login_dir_pwd
command_line [install_path]/plugins/check_otp -H $HOSTNAME$ -w 3 -c 8 -P /token totp -l $ARG2$ -K $ARG1$/$ARG2$.key -P $ARG1$/$ARG2$.pwd $ARG3$
}
# 'check_hotp_serial_dir' command definition to test HOTP based on token serial
# parameters: directory (ARG1), token serial (ARG2), additional parameters in ARG3
define command {
command_name check_hotp_serial_dir
command_line [install_path]/plugins/check_otp -H $HOSTNAME$ -w 3 -c 8 -P /token hotp -s $ARG2$ -K $ARG1$/$ARG2$.key -C $ARG1$/$ARG2$.count $ARG3$
}
# 'check_hotp_serial_dir_pwd' command definition to test HOTP based on token serial and password
# parameters: directory (ARG1), token serial (ARG2), additional parameters in ARG3
define command {
command_name check_hotp_serial_dir_pwd
command_line [install_path]/plugins/check_otp -H $HOSTNAME$ -w 3 -c 8 -P /token hotp -s $ARG2$ -K $ARG1$/$ARG2$.key -C $ARG1$/$ARG2$.count -P $ARG1$/$ARG2$.pwd $ARG3$
}
# 'check_hotp_login_dir' command definition to test HOTP based on login
# parameters: directory (ARG1), login (ARG2), additional parameters in ARG3
define command {
command_name check_hotp_login_dir
command_line [install_path]/plugins/check_otp -H $HOSTNAME$ -w 3 -c 8 -P /token hotp -l $ARG2$ -K $ARG1$/$ARG2$.key -C $ARG1$/$ARG2$.count $ARG3$
}
# 'check_hotp_login_dir_pwd' command definition to test HOTP based on login and password
# parameters: directory (ARG1), login (ARG2), additional parameters in ARG3
define command {
command_name check_hotp_login_dir_pwd
command_line [install_path]/plugins/check_otp -H $HOSTNAME$ -w 3 -c 8 -P /token hotp -l $ARG2$ -K $ARG1$/$ARG2$.key -C $ARG1$/$ARG2$.count -P $ARG1$/$ARG2$.pwd $ARG3$
}
~~~
Please check / adjust the following:
* replace `[install_path]/plugins` with the location of the script
* assumption is that the `$HOSTNAME$` can be used for an SSL connection (and
that the certificate is valid for this host, use the -u parameter and an
URL if this is not the case)
* path on the server is assumed to be /token (API endpoints will be added)
* check the thresholds for Warning (3s) and Critical (8s), adjust if needed
The `dir` and `dir_pwd` commands allow to store all sensitive data for tokens in
a folder and hence only require a folder name and token serial or login. This
expects the folder specified to contain the following files:
* [serial/login].key - HOTP/TOTP key in Base16/32/64 format on first line
* [serial/login].pwd - password (only first line is used)
* [serial/login].count - numeric HOTP count on first line, autoincremented
Please note that required files must exist or the check will fail with an error.
To use the it define a service check like below:
~~~
# check that TOTP authentication is working for token serial and provided key
define service {
host hostname.mydomain.tld
service_description Check TOTP Authentication
check_command check_totp_serial!TOTP0001234X!82f37371367b7e8aafb320b2d9b2721f66bbf161
use generic-service
}
# check that TOTP authentication is working for token serial and info from folder
define service {
host hostname.mydomain.tld
service_description Check TOTP Authentication
check_command check_totp_serial_dir!/etc/nagios3/tokeninfo!TOTP0001234X
use generic-service
}
# check that HOTP authentication is working for token serial and info from folder
define service {
host hostname.mydomain.tld
service_description Check TOTP Authentication
check_command check_hotp_serial_dir!/etc/nagios3/tokeninfo!HOTP0004321Y
use generic-service
}
~~~
|
|
303
304
|
<a name=check_temperature>plugins/check_temperature</a>
-------------------------------------------------------
|
|
305
306
|
Plugin (check) to monitor monitor the Raspberry Pi CPU temperature or that of a
temperature sensor connected to a RaspberryPi. This implementation currently
|
|
307
308
309
310
311
312
313
314
315
316
317
318
319
|
supports the following sensors:
* 1-wire:
* Maxim Integrated [DS18B20](https://learn.adafruit.com/adafruits-raspberry-pi-lesson-11-ds18b20-temperature-sensing)
* I2C
* Bosch Sensortec [BME280](https://learn.adafruit.com/adafruit-bme280-humidity-barometric-pressure-temperature-sensor-breakout)
* Bosch Sensortec [BMP280](https://learn.adafruit.com/adafruit-bmp280-barometric-pressure-plus-temperature-sensor-breakout)
* Microchip [MCP9080](https://learn.adafruit.com/adafruit-mcp9808-precision-i2c-temperature-sensor-guide)
Other methods and interfaces can be plugged in easily (just raise a request or
provide a patch). For information on how to connect sensor to the RaspberryPi
and to get it working please click on the links in the list above. As per these,
most sensors require some configuration to make them available:
* No setup is required to read the CPU temperature.
|
|
320
|
|
|
321
|
* To enable 1-wire interface support on the RaspberryPi use the command:
|
|
322
|
|
|
323
324
325
|
~~~
sudo raspi-config nonint do_onewire 0
~~~
|
|
326
|
|
|
327
328
|
or use `raspi-config` interactively (1. Interfacing Options --> P7. 1-Wire).
Please note that changing this requires a reboot.
|
|
329
|
|
|
330
|
* To enable I2C interface support on the RaspberryPi use the command:
|
|
331
|
|
|
332
333
334
|
~~~
sudo raspi-config nonint do_i2c 0
~~~
|
|
335
|
|
|
336
337
338
339
|
or use `raspi-config` interactively (1. Interfacing Options --> P5. I2C).
Please note that changing this requires a reboot.
The I2C interface also requires the `SMBus` or `SMBus2` library, to install
the `SMBus` library on Raspbian Linux run:
|
|
340
|
|
|
341
342
343
|
~~~
sudo apt install python-smbus
~~~
|
|
344
|
|
|
345
346
347
348
349
350
|
`SMBus2` is a pure Python implementation that requires system-wide or a
`virtualenv`-based installation, less trivial than installing the package.
Configuration of Nagios to use the script is straightforward, after installing
the script on the server add the following to your Nagios `commands.cmd`
configuration file to enable checking the CPU temperature:
|
|
351
|
~~~
|
|
352
353
354
|
# 'check_cpu_temperature' command definition to monitor CPU temperature in C
# parameters: warning (ARG1) and critical (ARG2) temperature in Celcius
define command {
|
|
355
|
command_name check_cpu_temperature
|
|
356
357
358
359
360
361
|
command_line [install_path]/plugins/check_temperature -w $ARG1$ -c $ARG2$ rpi_cpu
}
# 'check_cpu_ftemperature' command definition to monitor CPU temperature in F
# parameters: warning (ARG1) and critical (ARG2) temperature in Celcius
define command {
|
|
362
|
command_name check_cpu_ftemperature
|
|
363
364
|
command_line [install_path]/plugins/check_temperature -F -w $ARG1$ -c $ARG2$ rpi_cpu
}
|
|
365
|
~~~
|
|
366
|
|
|
367
368
|
To monitor a supported temperature sensor on its default address, add:
~~~
|
|
369
370
371
|
# 'check_temperature' command definition to monitor a single temperature in C
# parameters: warning (ARG1) and critical (ARG2) temperature in Celcius
define command {
|
|
372
373
|
command_name check_cpu_temperature
command_line [install_path]/plugins/check_temperature -w $ARG1$ -c $ARG2$ <<sensor>>
|
|
374
375
376
377
378
|
}
# 'check_ftemperature' command definition to monitor a single temperature in F
# parameters: warning (ARG1) and critical (ARG2) temperature in Farenheit
define command {
|
|
379
380
|
command_name check_cpu_temperature_f
command_line [install_path]/plugins/check_temperature -F -w $ARG1$ -c $ARG2$ <<sensor>>
|
|
381
|
}
|
|
382
383
|
~~~
With `<<sensor>>` replaced by the sensor, e.g. w1_ds18b20 for a 1-wire DS18B20,
|
|
384
385
386
387
|
i2c_mcp9808 for an I2C MCP9808 sensor or i2c_bme280 for an I2C BME280. Run
`check_temperature -h` to get the list of supported sensors. In case you have
multiple sensors, add a separate definition for each sensor with a different
value for `command_name`.
|
|
388
|
|
|
389
390
391
|
If you need to pass on additional parameters, e.g. the sensor serial for an
1-wire DS18B20, you can do that like this:
~~~
|
|
392
393
394
|
# 'check_temperature_sensor' command definition to monitor a single temperature in C
# parameters: sensor serial (ARG1), warning (ARG2) and critical (ARG3) temperature in Celcius
define command {
|
|
395
|
command_name check_ds18b20_sensor
|
|
396
|
command_line [install_path]/plugins/check_temperature -w $ARG2$ -c $ARG3$ w1_ds18b20 -s $ARG1$
|
|
397
398
399
400
401
|
}
# 'check_ftemperature_sensor' command definition to monitor a single temperature in F
# parameters: sensor serial (ARG1), warning (ARG2) and critical (ARG3) temperature in Farenheit
define command {
|
|
402
|
command_name check_ds18b20_sensor_f
|
|
403
|
command_line [install_path]/plugins/check_temperature -F -w $ARG2$ -c $ARG3$ w1_ds18b20 -s $ARG1$
|
|
404
405
406
407
|
}
~~~
|
|
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
|
Likewise, to pass the I2C address for an I2C MCP9808 use something like:
~~~
# 'check_temperature_sensor' command definition to monitor a single temperature in C
# parameters: sensor address (ARG1), warning (ARG2) and critical (ARG3) temperature in Celcius
define command {
command_name check_mcp9808_sensor
command_line [install_path]/plugins/check_temperature -w $ARG2$ -c $ARG3$ i2c_mcp9808 -a $ARG1$
}
# 'check_ftemperature_sensor' command definition to monitor a single temperature in F
# parameters: sensor address (ARG1), warning (ARG2) and critical (ARG3) temperature in Farenheit
define command {
command_name check_mcp9808_sensor_f
command_line [install_path]/plugins/check_temperature -F -w $ARG2$ -c $ARG3$ i2c_mcp9808 -a $ARG1$
}
~~~
|
|
426
427
|
For the list of supported sensors run `check_temperature -h` and to get the
options sensor ``<<sensor>>`` supports run `check_temperature <<sensor>> -h`.
|
|
428
|
|
|
429
|
Make sure to replace `[install_path]/plugins` with the location of the script.
|
|
430
431
432
|
To use the it define a service check like below:
~~~
|
|
433
434
435
436
437
438
439
440
|
# check RaspberryPi CPU temperature in Celcius
define service {
host hostname.mydomain.tld
service_description CPU Temperature
check_command check_cpu_temperature!55!75
use generic-service
}
|
|
441
|
# check temperature in Celcius using a sensor connected to a RaspberryPi
|
|
442
443
444
445
446
447
448
449
450
451
452
|
define service {
host hostname.mydomain.tld
service_description Check Temperature
check_command check_temperature!30!35
use generic-service
}
# check temperature with DS18B20 sensor 0000a31ea3de connected to a RaspberryPi
define service {
host hostname.mydomain.tld
service_description Check Temperature
|
|
453
454
455
456
457
458
459
460
461
|
check_command check_ds18b20_sensor!0000a31ea3de!30!35
use generic-service
}
# check temperature with MCP9808 sensor 0x19 connected to a RaspberryPi
define service {
host hostname.mydomain.tld
service_description Check Temperature
check_command check_mcp9808_sensor!0x19!30!35
|
|
462
463
464
|
use generic-service
}
~~~
|
|
465
466
467
468
469
|
Please run `check_temperature -h` after installation for an overview of the
available command line options (e.g. to enable logging to a file).
|
|
470
471
|
<a name=nagiosstatus>cgi-bin/nagiosstatus.sh</a>
------------------------------------------------
|
|
472
473
474
|
Very simplistic CGI-BIN script that checkes whether nagios is still running and
still updating its status. It wil always return an HTTP Status 200 (OK) and a
simple text page with one of the following texts:
|
|
475
476
477
|
- `STOPPED` - in case the nagios process is not running
- `STALLED` - in case the nagios status file has not been updated for 5 minutes
- `OK` - when Nagios is running and updated its status file < 5 minutes ago
|
|
478
479
480
481
482
483
|
I wrote this script to be used with an external monitoring system, I use it with
the free subscription from [Pingdom](http://www.pingdom.com) to get alerts when
my Nagios monitoring system is no longer reachable.
|
|
484
485
486
487
488
489
490
491
492
493
494
495
496
497
|
<a name="license">License</a>
-----------------------------
These scripts, documentation & configration examples are free software: you can
redistribute and/or modify it under the terms of the GNU General Public License
as published by the Free Software Foundation, either version 3 of the License,
or (at your option) any later version.
This script, documenatation and configuration examples are distributed in the
hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
General Public License for more details.
You should have received a copy of the GNU General Public License along with
this program. If not, download it from <http://www.gnu.org/licenses/>.
|