DISK CRITICAL - /run/user/0/doc is not accessible: Permission denied, Fedora 34

from the hosts.conf file:

object Host NodeName {
  /* Import the default host template defined in `templates.conf`. */
  import "generic-host"

  /* Specify the address attributes for checks e.g. `ssh` or `http`. */
  address = "127.0.0.1"
  address6 = "::1"

  /* Set custom variable `os` for hostgroup assignment in `groups.conf`. */
  vars.os = "Linux"

  /* Define http vhost attributes for service apply rules in `services.conf`. */
  vars.http_vhosts["http"] = {
    http_uri = "/"
  }
  /* Uncomment if you've sucessfully installed Icinga Web 2. */
  vars.http_vhosts["Icinga Web 2"] = {
    http_uri = "/icingaweb2"
  }

  /* Define disks and attributes for service apply rules in `services.conf`. */
  vars.disks["disk"] = {
    /* No parameters. */
  }
  vars.disks["disk /"] = {
    disk_partitions = "/"
  }

  /* Define notification mail attributes for notification apply rules in `notifications.conf`. */
  vars.notification["mail"] = {
    /* The UserGroup `icingaadmins` is defined in `users.conf`. */
    groups = [ "icingaadmins" ]
  }
}

object Host "server1.ourdomain.edu" {
  import "generic-host"
  address = "y.y.y.y"
  vars.http_vhosts["http"] = {
    http_uri = "/"
    http_port = 8443
    http_ssl = true
  }
    vars.disks["disk"] = {
     disk_partitions_excluded = ["/run","/run/0/doc", "/run/user/0/doc"]
    }
  vars.disks["disk /"] = {
    disk_partitions = "/"
  }

  check_command = "hostalive"
}
object Host "server2.ourdomain.edu" {
  import "generic-host"
  address = "x.x.x.x."

  vars.http_vhosts["http"] = {
    http_uri = "/"
    http_port = 8443
    http_ssl = true
  }
    vars.disks["disk"] = {
      disk_partitions_excluded = ["/run","/run/0/doc", "/run/user/0/doc"]
    }
  vars.disks["disk /"] = {
    disk_partitions = "/"
    vars.disk_ignore_eregi_path = [ "/run" ]
    vars.disk_exclude_type = ["overlay","tmpfs","nsfs","sysfs","shm","debugfs","tracefs","nfs"]
    vars.disk_ignore_ereg_path = ["/run/0/doc"]
    vars.disk_partitions_excluded = ["/run","/run/0/doc", "/run/user/0/doc"]

  }
  vars.disk_exclude_type = [
          "tmpfs",
          "sysfs",
          "proc",
          "configfs",
          "devtmpfs",
          "devfs",
          "mtmfs",
          "tracefs",
          "cgroup",
          "fuse.gvfsd-fuse",
          "fuse.gvfs-fuse-daemon",
          "fdescfs",
          "overlay",
          "nsfs",
          "squashfs"
      ]
  check_command = "hostalive"

}

However now all I see is the Icinga2 host’s paritions:

Side note tried to install Director getting this error when creating schema in GUI and choosing the icingaweb_db DB:

Migration 0 failed (SQLSTATE[42S01]: Base table or view already exists: 1050 Table 'director_activity_log' already exists) while running CREATE TABLE director_activity_log ( id BIGINT(20) UNSIGNED AUTO_INCREMENT NOT NULL, object_type VARCHAR(64) NOT NULL, object_name VARCHAR(255) NOT NULL, action_name ENUM('create', 'delete', 'modify') NOT NULL, old_properties TEXT DEFAULT NULL COMMENT 'Property hash, JSON', new_properties TEXT DEFAULT NULL COMMENT 'Property hash, JSON', author VARCHAR(64) NOT NULL, change_time TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP, checksum VARBINARY(20) NOT NULL, parent_checksum VARBINARY(20) DEFAULT NULL, PRIMARY KEY (id), INDEX sort_idx (change_time), INDEX search_idx (object_name), INDEX search_idx2 (object_type(32), object_name(64), change_time), INDEX search_author (author), INDEX checksum (checksum) ) ENGINE=InnoDB DEFAULT CHARSET=utf8 (Migration.php:60)

Edit: I followed the instructions to create a new database and resource in the GUI and I have Director working. So what do I need to configure to get the -x option to work?

First, If you click on the check that is failing, do you see a link to Inspect? I’m not sure it will work unless the check was created through Director.


Some progress. First the client has firewalld running so I had open TCP ports 5665 & 5666. Now I get a slightly different error, on what happens to be my username’s ID See screenshot. The command that shows with Inspect is:
'/usr/lib64/nagios/plugins/check_disk' '-c' '10%' '-w' '20%' '-X' 'none' '-X' 'tmpfs' '-X' 'sysfs' '-X' 'proc' '-X' 'configfs' '-X' 'devtmpfs' '-X' 'devfs' '-X' 'mtmfs' '-X' 'tracefs' '-X' 'cgroup' '-X' 'fuse.gvfsd-fuse' '-X' 'fuse.gvfs-fuse-daemon' '-X' 'fdescfs' '-X' 'overlay' '-X' 'nsfs' '-X' 'squashfs' '-m'

Right that’s what I’m asking for a little guidance on. I created a command template see screenshot:
cmmandtemplate

How do I apply this? On a host? On a Service Template?

-x /run/user/0/doc is not in the command being executed (shown by Inspect). You’ll want to modify the disk command/service to specify that field (see Data Fields). The Service is shows as disk-usage. I’m not sure where the Preview you are sharing fits in. You should not need that command, as Director allows you to add fields as needed rather than hard-coding them for each CheckCommand.

As mentioned, it’s my attempt to use Command Template. I take it that’s not advised?

Is this where you mean? So Director → Services choose disk-usage → Fields? Which is lower case -x?

Looks like it, my install years ago didn’t import the arguments/fields (which could have been possible and I just didn’t). What if you add your path there and check Inspect again (should show up)? You’ll have to Deploy the changes from Director as well.

By “there” what do you mean?

Add the field you have highlighted in the screenshot. Then it should up as a Custom Vars if you click “Modify” on your service check (near “Inspect”).

No difference. Just making sure you also noticed when I switched to Director the path was no longer to the ‘0’ root user it’s now my user ID that is getting permission denied.

exclude2

Update: so this does work for the specified path, but once I added my user ID another user ID appears with permission denied. Does the path take a * to include all? Doesn’t seem to work here:
crticial
excludeservice

I would suggest testing it from the command line. It can also be provided multiple times. Once it’s working configure Icinga2 accordingly.

I re-read the options and it looks like -l is what should do the trick. You’ll still want to exclude by filesystem type (I had to include tracefs, but you’d probably not want some others as well).

"-l" = {
  set_if = "$disk_local$"
  description = " Only check local filesystems"
}

With Director where do I configure this? Or which config file?

Edit from CLI:

su - icinga -s /bin/bash -c "/usr/lib64/nagios/plugins/check_disk -l"
DISK CRITICAL - /run/user/0/doc is not accessible: Permission denied

2nd edit, this is very odd:

su - icinga -s /bin/bash -c "/usr/lib64/nagios/plugins/check_disk -x /run"
DISK CRITICAL - /run/user/0/doc is not accessible: Permission denied

 su - icinga -s /bin/bash -c "/usr/lib64/nagios/plugins/check_disk -x /run/user"
DISK CRITICAL - /run/user/0/doc is not accessible: Permission denied

su - icinga -s /bin/bash -c "/usr/lib64/nagios/plugins/check_disk -x /run/user/0"
DISK CRITICAL - /run/user/0/doc is not accessible: Permission denied

su - icinga -s /bin/bash -c "/usr/lib64/nagios/plugins/check_disk -x /run/user/0/doc"
DISK OK - free space: /dev 31801 MiB (100.00% inode=100%); /dev/shm 31821 MiB (99.99% inode=100%); /run 12726 MiB (99.98% inode=100%); / 598839 MiB (97.46% inode=100%); /tmp 31820 MiB (99.99% inode=100%); /home 75968 MiB (98.96% inode=100%); /scratch 363355 MiB (6.49% inode=83%); /boot 1462 MiB (84.34% inode=100%); /var 468136 MiB (98.22% inode=100%); /run/user/0 6364 MiB (99.99% inode=100%); /usr/local 76072 MiB (99.10% inode=100%); /local/mail 655548 MiB (98.24% inode=100%);| /dev=0MiB;;;0;31801 /dev/shm=0MiB;;;0;31821 /run=2MiB;;;0;12728 /=15584MiB;;;0;614423 /tmp=0MiB;;;0;31821 /home=793MiB;;;0;76762 /scratch=5230640MiB;;;0;5593996 /boot=271MiB;;;0;1845 /var=8470MiB;;;0;476607 /run/user/0=0MiB;;;0;6364 /usr/local=689MiB;;;0;76762 /local/mail=11703MiB;;;0;667251

I was testing as root for -l to work. The issue you said earlier was there were other users. What was ls -l /run/user when it worked versus when it does not work? Or run it with sudo and use -l -x ....

Slight difference, the 2nd command includes a NFS share. Note this is on the Icinga2 host server, but the screenshot is from the client that is being monitored. That always gets permission denied even as root user.

su - icinga -s /bin/bash -c "/usr/lib64/nagios/plugins/check_disk -l -x /run/user/0/doc"
DISK OK - free space: /dev 31801 MiB (100.00% inode=100%); /dev/shm 31821 MiB (99.99% inode=100%); /run 12726 MiB (99.98% inode=100%); / 598839 MiB (97.46% inode=100%); /tmp 31820 MiB (99.99% inode=100%); /home 75968 MiB (98.96% inode=100%); /scratch 361866 MiB (6.46% inode=83%); /boot 1462 MiB (84.34% inode=100%); /var 468134 MiB (98.22% inode=100%); /run/user/0 6364 MiB (99.99% inode=100%); /usr/local 76072 MiB (99.10% inode=100%);| /dev=0MiB;;;0;31801 /dev/shm=0MiB;;;0;31821 /run=2MiB;;;0;12728 /=15584MiB;;;0;614423 /tmp=0MiB;;;0;31821 /home=793MiB;;;0;76762 /scratch=5232129MiB;;;0;5593996 /boot=271MiB;;;0;1845 /var=8472MiB;;;0;476607 /run/user/0=0MiB;;;0;6364 /usr/local=689MiB;;;0;76762


 su - icinga -s /bin/bash -c "/usr/lib64/nagios/plugins/check_disk  -x /run/user/0/doc"
DISK OK - free space: /dev 31801 MiB (100.00% inode=100%); /dev/shm 31821 MiB (99.99% inode=100%); /run 12726 MiB (99.98% inode=100%); / 598839 MiB (97.46% inode=100%); /tmp 31820 MiB (99.99% inode=100%); /home 75968 MiB (98.96% inode=100%); /scratch 361856 MiB (6.46% inode=83%); /boot 1462 MiB (84.34% inode=100%); /var 468134 MiB (98.22% inode=100%); /run/user/0 6364 MiB (99.99% inode=100%); /usr/local 76072 MiB (99.10% inode=100%); /local/mail 655548 MiB (98.24% inode=100%);| /dev=0MiB;;;0;31801 /dev/shm=0MiB;;;0;31821 /run=2MiB;;;0;12728 /=15584MiB;;;0;614423 /tmp=0MiB;;;0;31821 /home=793MiB;;;0;76762 /scratch=5232139MiB;;;0;5593996 /boot=271MiB;;;0;1845 /var=8472MiB;;;0;476607 /run/user/0=0MiB;;;0;6364 /usr/local=689MiB;;;0;76762 /local/mail=11703MiB;;;0;667251

What command is it running where it is still not working?

'/usr/lib64/nagios/plugins/check_disk' '-c' '10%' '-w' '20%' '-X' 'none' '-X' 'tmpfs' '-X' 'sysfs' '-X' 'proc' '-X' 'configfs' '-X' 'devtmpfs' '-X' 'devfs' '-X' 'mtmfs' '-X' 'tracefs' '-X' 'cgroup' '-X' 'fuse.gvfsd-fuse' '-X' 'fuse.gvfs-fuse-daemon' '-X' 'fdescfs' '-X' 'overlay' '-X' 'nsfs' '-X' 'squashfs' '-m' '-x' '/run/user/16836/doc'
that returns:

DISK CRITICAL - /run/user/18796/doc is not accessible: Permission denied

It seems you’ll need access to the doc directory in order to exclude it. If it is not accessible by the user executing the check, the arguments aren’t doing the trick. (I’m assuming uid 18796 is not the user you executed the check as?)

That’s correct, it belongs to another non root user. Is there a work around?