Cheshire Cat Computing

Hi,

I have nagevlog 1.8.3 agent on Windows 2003 Server and nagios Server Version 3.0.4.

When I click "test NCSA Daemon" it will work once and display messages on nagios.log. The next test will hang the agent. The following are the errors on window event viewer.

- Hanging application NagEvLogCtrl.exe, version 1.8.0.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

- Winsock error 997 trying to send to NSCA. Check the error logs for the NSCA server!

- Error: Could not connect to host x.x.x.x on port 5667

- Connection refused or timed out

Though the telnet x.x.x.x 5667 connects every time.

When I restart nsca. It will work again but only one time.

Sending of eventlog work the same. When a notification is already sent, it will no longer accept any new notification, unless I restart nsca.

Any ideas?

Thanks!

BTW, I tried also using nagevlog 1.9.1 and still the same.

If it's also important the Nagios Server has multiple interface but I already bind to specific interface the agent is connecting to.

- )

Microsoft have apparently changed (again) the winsock interface in win2k3 and a few things no longer appear to work as expected (this 997 error did not exist before). I've not heard of the control app hangin before, alhtough it could be only the 'send nsca test' bit that's at fault.
Can you confirm if the agent itself is running correctly or not?
The 1.9.1 package has a bit of extra code in the agent to handle the 997 error so things should be OK - also make sure you have not fallen afoul of the new windows execution prevention system which can cause issues on occasion

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11

the agent seems to be running fine. though I really cannot tell where the problem is; the agent or the server configuration... as i said earlier, once the agent send an alert, there will be no more update eventhough there are new events on system logs.

One more thing that I noticed is that there is always a connection between the server and agent. This is the ouput on a netstat -an.

tcp 0 0 10.x.x.x:5667 10.x.x.x:3842 ESTABLISHED

it will only be removed when i restart nsca.

this is how I restart
# kill -9 pid
# /usr/local/nagios/bin/nsca -c /usr/local/nagios/etc/nsca.cfg

It sounds as if the agent is getting stuck after it sends the NSCA alert and never closes the connection, so never returns to polling. This is actually a big help in tracking down the location of the problem! I'll check the section on return codes from the socket writes which are probably where the issue is.

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11

Just an additional that I've observed...

when NSCA is already running on the server and start the agent. on netstat there'll be already a

tcp 0 0 10.x.x.x:5667 10.x.x.x:3929 ESTABLISHED

this will not happen if, agent is started first then start NSCA.

hi steve, is this issue can be fixed? I hope that there will be resolution soon.

Thanks!

Sorry, not been able to work on this for last few months due to family issues (father passed away) and work pressures; hopefully I can get back to things after I get back to NZ

_________________
Steve Shipway
UNIX Systems, ITSS, University of Auckland, NZ
Woe unto them that rise up early in the morning... -- Isaiah 5:11

sorry to hear that.

If you need further information (debugging files or other output ie netstat), just let me know.

Thanks!