Icinga for Windows: "Access is denied" on checks

Service Monitoring
,
1

Hello,
I need support with Icinga for Windows. I have installed the modules and all seems to work on server side:

image
image1131×105 51.1 KB

I was following this documentation:Manual Integration - Icinga for Windows

Icinga was already installed and configured on the host using the PowerShell script.

Adding the service check I get a message with “Access is denied.”

image
image1116×92 6.28 KB

Any hints how to troubleshoot this?

Icinga Web 2 Version 2.10.1
PHP Version 7.3.11

On host: Icinga 2.13.1

Thanks,
Adrian

2

Hello Adrian,

“Access is denied” sounds a lot like a permission thing.

Have you tried changing the service user that the Icinga agent runs as?
Or maybe a not fitting powershell execution policy?

3

I have tried with a admin user and the check still doesn’t work.
The policy is enforced by GPO so I can’t bypass that.

am not sure if the command is OK:

Command “C:\Program Files\ICINGA2/sbin/"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"” -C “Use-Icinga; exit Invoke-IcingaCheckCPU” -Warning 50 -Critical 70 -NoPerfData true failed to execute: 5, “Access is denied.”

Can I somehow test this on the server directly?

Thanks,
Adrian

4

download psexec from Sysinternals

do you use the icinga powershell service?
If No:
spawn a powershell as the user of the icinga2 service and try:

Use-icinga; Invoke-IcingaCheckCPU -Warning 50 -Critical 70 -NoPerfData true

If yes:
spawn a powershell as the user of the icingapowershell service and try:

Use-icinga; Invoke-IcingaCheckCPU -Warning 50 -Critical 70 -NoPerfData true
5

This indeed looks kind of weird with the C:\Program Files\ICINGA2/sbin/ in there.
Can you post your command definition please?

6

image
image764×631 12.9 KB

image
image793×364 12.5 KB

image
image765×624 9.03 KB

But I don’t know from where C:\Program Files\ICINGA2/sbin/ is taken.

7

You need to remove the " from the Command field of the PowerShell Base command.

Otherwise Icinga Director will render the config as

object CheckCommand "test-command" {
    import "plugin-check-command"
    command = [ PluginDir + "/\"C:\\my-test-command.ps1\"" ]
}

and will add the PluginDir + to the command, which resolves to C:\Program Files\ICINGA2/sbin/ on the agent.

Without the " it should work:

object CheckCommand "test-command" {
    import "plugin-check-command"
    command = [ "C:\\my-test-command.ps1" ]
}

Also you can remove the multiple \, as the Director will escape them automatically.

For the command creation/import you can also use the supplied Director Baskets:
https://icinga.com/docs/icinga-for-windows/latest/doc/200-Icinga-Integration/01-Director-Baskets/

With those you should get all the commands ready to use into the Director

8

Hi log1c,

Thanks for the support! I am making progress! now I see the check like this:
image
Executed command:

‘C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe’ ‘-C’ ‘Use-Icinga; exit Invoke-IcingaCheckCPU’ ‘-Warning’ ‘50’ ‘-Critical’ ‘70’ ‘-NoPerfData’ ‘true’

I have tested the basket and I see lots of DataLists and Commands. For PowerShell Base and Invoke-IcingaCheckCPU I have some errors:

image
image834×133 2.35 KB

I see this in the snapshot but I have no idea how I can add this commands to Icinga Director. I don’t see them in commands.
I have this basket:

image
image722×800 7.39 KB

I don’t know what to do from here to have the commands. I hope you can help me with this.

Thanks,
Adrian

9

To import something from a basket you have to restore the snapshot if that basket.
You were on the right way, where you got the error about the missing datalist for the PowerShell Base command and the info that you Invoke-IcingaCheckCPU command will be modified by the import.

As I have never really used the PowerShell framework or it’s commands I can’t help with the datalist error and were it originates from. You could try creating an empty datalist with the mentioned name by hand and see if that helps.
Same goes for the error message of the check.
Maybe @cstein or someone else has an idea.

10

Thanks @log1c !

Your hints helped a lot!
to sum this up:
following the link Director Baskets - Icinga for Windows I have imported output to Icinga Director - Configuration Basket.
Then I selected the snapshot and Restore - this will deploy everything that you have in there. It will create the DataFields, commands.

Very easy if you have the proper guidance.
Thanks again @log1c !

1 Like