CHECK_NRPE: Receive header underflow - only 0 bytes received (4 expected)


I’m currently struggling with check_nrpe querying a Windows server running NSClient++. Testing from the Icinga2 server I am able to connect to the remote server ( so there’s no firewall or allowed hosts issue:

jonathan@icinga2:/usr/lib/nagios/plugins$ telnet 5666
Connected to
Escape character is '^]'.

When attempting to query NRPE itself I’ve noted TLS/SSL is not configured at the remote host (to be fixed later) so I’ve used the -n argument. A basic check yields:

CHECK_NRPE: Receive header underflow - only 0 bytes received (4 expected).

which was generated via

jonathan@icinga2:/usr/lib/nagios/plugins$ ./check_nrpe -n -H
CHECK_NRPE: Receive header underflow - only 0 bytes received (4 expected).

I’ve tried with the -2 argument which gives the same error. Additional nsclient.ini settings of relevance:

NRPEServer = 1

allow arguments = true
insecure = false
timeout = 70

Searching for that error gives a lot of results that seem to be based around SSL/TLS, which is not in scope here, or around the need to downgrade check_nrpe. Before I go down that path I wanted to check I’d not missed anything obvious, so any advice would be appreciated. I’m also reading that it may be necessary to switch to Icinga Agent instead.

Thanks in advance :slight_smile: .

Software versions

  • check_npre: 3.2.1
    • SSL/TLS Available: OpenSSL 0.9.6 or higher required
  • Icinga2 OS: Ubuntu 18.04.5 LTS
  • Remote OS: Windows Server 2016
  • NSClient++: 2018-01-28

Hi @anon9497968,

please have a look at NSClient NRPE Settings.

use ssl

defaults to true here so maybe

use ssl=false

in the nrpe part of your nsclient.ini may work for you (although i would recommend using encrypted connections :slight_smile:).

Kind regards,

Interesting, thanks for that @ritzgu. Setting use ssl = false does allow the connection:

jonathan@icinga2:/usr/lib/nagios/plugins$ ./check_nrpe -n -H
I ( 2018-01-28) seem to be doing fine...

However, as you say, that’s not a desired configuration. Having re-enabled the SSL usage I’m now back to an issue with the SSL handshake:

jonathan@icinga2:/usr/lib/nagios/plugins$ ./check_nrpe -H
CHECK_NRPE: (ssl_err != 5) Error - Could not complete SSL handshake with 1

Further reading on the page you linked (thanks, I’d not found that in my travels) showed there was a certificate that could be specified, along with the private key. I’ll look into that next, including how to get check_nrpe how to trust certificiates from our internal CA / PKI. Do you know of any guidance on that? We check our hosts via IP, rather than DNS, and creating a certificate for every server’s IP would be a very lengthy process given the number of servers involved. If we can direct check_nrpe to trust a specific certificate that may be a better option.

Many thanks for your help so far!


I’m not using NRPE anymore, but you can add the parameter ‘-g’ to create a log file for the check_nrpe command like
./check_nrpe -H <HOST> -g /tmp/nrpe.log
for further investigation. On my test installation, this results in the error dh key too small which has been discussed here.


Change “dont_blame_nrpe=0” to “dont_blame_nrpe=1” in /etc/nagios/nrpe.cfg
Then restart Nagios service