Directory

For NagiosXI users, this is what I had to do to get this working.

1. Add the vbs script to C:\Program Files\NSClient++\scripts
I renamed mine to: check_iis_apppool_state.vbs
Also assumed you have installed the 64bit version.

2. In your NSCLIENT.ini file, add the following:

a. Settings for your external scripts
[/settings/external scripts]
allow arguments = 1
allow nasty characters = 1
timeout = 90

b. A Wrapped scripts section
[/settings/external scripts/wrapped scripts]
check_iis_apppool_state=cscript.exe scripts\\check_iis_apppool_state.vbs $ARG1$

c. the wrappings section
[/settings/external scripts/wrappings]
vbs = cscript.exe //T:30 //NoLogo scripts\\lib\\wrapper.vbs %SCRIPT% %ARGS%
exe = cmd /c %SCRIPT% %ARGS%

* You don't need to create an alias.
The way this works is that nagios will use npre to call check_iis_apppool_state, which in turn will call csript, which since it's an exe will require the exe wrapper. And since your calling a vbs, you need the vbs wrapper.


3. In Nagios, create a new command. For those of you who have not created commands before, This is done in Core Config.

I called my command: check_iis_apppool_state

The important part of the command is that whatever is after the -c , must match what you put in your ini file.

Mine looks like this:
$USER1$/check_nrpe -H $HOSTADDRESS$ -t 30 -c check_iis_apppool_state -a "$ARG1$"

MAKE SURE YOU QUOTE $ARG1$ or else you will spend hours trying to figure out why it is not working. In other words, copy and paste exactly what it looks like.

4. In Nagios, again in Core Config, create a service that references the command.

In $ARG1$, simply put the name of the Application Pool.
Go ahead and test the check command, it should work.
Save it then apply the configuration.

Hint- if you have not created services before, an easy way to do it is to simply copy it from an existing service on the host you are aiming for so you get the correct alert settings.

***SPECIAL NOTE*****

If your AppPool name has a space and - , you will have to change the name of the AppPool.
I've tried using the old faithful method of quoting along with escaping, but it just does not get passed correctly to NPRE and it will fail. You can have hyphens, just no space hyphen.

If you followed my directions and it still does not work, well then you probably did not follow my directions. Go thru the steps and try again (-;

Good Luck and May the Force be With you.

For anyone having issues with co.uk or any other domains, the fix is actually quite easy.

vi the script and edit this line:

elif [ $TYPE == 'nic' ];
then
expiration=`cat ${FILE} | awk '/Expiration date:/' | cut -d ':' -f2`

Change Expiration to Expiry, so it should look like this.

elif [ $TYPE == 'nic' ];
then
expiration=`cat ${FILE} | awk '/Expiry date:/' | cut -d ':' -f2`

---------

Basically, what is occurring is that when the whois record is returned, the script is looking for the string "expiration date" which no longer exists.

And this fix works for any TLD that is not working. From the same nagios server, run a whois query: ' whois DomainName ' and see what the results turn back.

Then it is as simple as altering the check_domain script to match what is returned by whois.

If you are used to this working out of the box with other versions of Windows Server, there are some catches you should be aware of.

**The following has only been tested using NagiosXI 2012R2.3 and Nagevlog 1.9.2 under server 2012)

1. The encryption no longer works. If you have a mixed environment and are running nsca encryption, you need to change it all to "NONE".

For whatever reason, on server 2012, when it is encrypted with say 3Des, the alerts never make it to the inbound transfer. The underlying OS does see the traffic, just something in NagiosXI does not like the way server 2012 nagevlog is doing the encryption.

2. Alerting; Once NagiosXI receives in and sends it to the passive filter, you will not get a email alert. UNLESS, you go into the service, press the Advanced Tab, and enable Active Checks.

Not sure why that is, but that is the only way I was able to get email alerts to come thru. Just be prepared that you are going to get 2 alerts; the first one on the event and the second one saying it has recovered. Hopefully you understand that the recovery is not on the actual event, but the passive listener resetting itself.

Hopefully this saves you a weekend of beating yourself up like I did. It is the loss of my life for the past 72 hours that I dropped my rating down to Good rather than excellent...

Enjoy!