Not able to execute a service remotely on node server

Icinga 2
, ,
1

Created a custom script /usr/lib/nagios/plugins/check_clamd_virus.sh in the master node and want to execute this to an Icinga node. But the script still runs on the server itself. Want to monitor clamd in Icinga node

getting below error if I use command_endpoint = host.vars.client_endpoint in the services.conf

root@Icinga2-server:~# icinga2 daemon -C --dump-objects
[2024-05-30 08:53:02 +0000] information/cli: Icinga application loader (version: r2.14.2-1)
[2024-05-30 08:53:02 +0000] information/cli: Loading configuration file(s).
[2024-05-30 08:53:02 +0000] information/ConfigItem: Committing config item(s).
[2024-05-30 08:53:02 +0000] information/ApiListener: My API identity: Icinga2-server
[2024-05-30 08:53:02 +0000] critical/config: Error: Validation failed for object 'icinga-node!clamd_virus' of type 'Service'; Attribute 'command_endpoint': Checkable with command endpoint requires a zone. Please check the troubleshooting documentation.
Location: in /etc/icinga2/conf.d/services.conf: 124:1-124:27
/etc/icinga2/conf.d/services.conf(122): 
/etc/icinga2/conf.d/services.conf(123): 
/etc/icinga2/conf.d/services.conf(124): apply Service "clamd_virus" {
                                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^
/etc/icinga2/conf.d/services.conf(125):     import "clamd_virus_template"
/etc/icinga2/conf.d/services.conf(126): 
[2024-05-30 08:53:02 +0000] critical/config: 1 error
[2024-05-30 08:53:02 +0000] critical/cli: Config validation failed. Re-run with 'icinga2 daemon -C' after fixing the config.
root@Icinga2-server:~# 

root@Icinga2-server:~# cat /usr/lib/nagios/plugins/check_clamd_virus.sh 
#!/bin/bash

## Check if clamd is running

if ! systemctl is-active clamav-daemon; then
	curl ifconfig.me
	echo "CRITICAL - clamd is not running"
	exit 2
fi

CLAMD_LOG="/var/log/clamav/clamd.log"
CLAMSCAN_LOG="/var/log/clamav/clamscan.log"

DETECTIONS_CLAMD=$(grep "FOUND" "$CLAMD_LOG" | tail -n 10)
DETECTIONS_CLAMSCAN=$(grep "FOUND" "$CLAMSCAN_LOG" | tail -n 10)

if [ -z "$DETECTIONS_CLAMD" ] && [ -z "$DETECTIONS_CLAMSCAN" ]; then
	    echo "OK - clamd is running, no viruses detected"
	    exit 0
else
	echo "WARNING - clamd is running, recent detections found:"
	echo "$DETECTIONS_CLAMD"
	echo "$DETECTIONS_CLAMSCAN"
	exit 1
fi

commands.conf

root@Icinga2-server:~# tail /etc/icinga2/conf.d/commands.conf 
  }
}

*/

object CheckCommand "check_clamd_virus" {
  import "plugin-check-command"
  command = [ PluginDir + "/check_clamd_virus.sh" ]

}
root@Icinga2-server:~#

services.conf

root@Icinga2-server:~# tail -20 /etc/icinga2/conf.d/services.conf 
  check_command = "users"

  assign where host.name == NodeName
}

template Service "clamd_virus_template" {
    check_command = "check_clamd_virus"
    check_interval = 1m
    retry_interval = 30s
    enable_notifications = true
}


apply Service "clamd_virus" {
    import "clamd_virus_template"

    assign where host.vars.os == "Linux" && host.vars.clam == "Yes"
    #command_endpoint = host.vars.client_endpoint
	
}
root@Icinga2-server:~#

hosts.conf

root@Icinga2-server:~# tail -34 /etc/icinga2/conf.d/hosts.conf 
}


object Host "icinga-node" {

  import "generic-host"

  address = "x.x.x.x"

  vars.os = "Linux"

  vars.clam = "Yes"
  
  vars.client_endpoint = "icinga-node"
 
  vars.disks["disk /"] = { 
    disk_partitions = "/"
  }

  vars.disks["disk /var"] = {
    disk_partitions = "/var" 
  }

  vars.http_vhosts["Web Server"] = {
    http_uri = "/"
  }

  vars.ssl_vhosts["Web Server"] = {
    ssl_cert_path = "/path/to/cert.pem"
  }

}


root@Icinga2-server:~#

zones.conf

root@Icinga2-server:~# cat /etc/icinga2/zones.conf
/*
 * Generated by Icinga 2 node setup commands
 * on 2024-05-22 13:03:03 +0000
 */

object Endpoint "Icinga2-server" {
}

object Endpoint "icinga-node" {
  host = "x.x.x.x"
  port = "5665" // Default Icinga 2 port, adjust if necessary
}


object Zone "master" {
	endpoints = [ "Icinga2-server" ]
}


object Zone "icinga-node" {
  parent = "master"
  endpoints = [ "icinga-node" ]
}

object Zone "global-templates" {
	global = true
}

object Zone "director-global" {
	global = true
}


root@Icinga2-server:~#

versions

root@Icinga2-server:~# icinga2 --version
icinga2 - The Icinga 2 network monitoring daemon (version: r2.14.2-1)

server is Debian 12

2

You need to add command_endpoint = host.name to the service definition and store command object and script on the icinga agent.

2 Likes
3

I have removed the address from the server and replaced it with x.x.x.x

1 Like
4

I have reinstalled everything and now added a director also
my setup is one master server and one node server, I will add additional nodes later.
I was trying to add the server and node via director so that I could see both of them in the Icinga Web 2 UI but while adding the server or node there is an error coming for both the nodes. Please let know if I need to modify something

Screenshot from 2024-06-02 06-49-07
Screenshot from 2024-06-02 06-49-071194×677 66.5 KB

Screenshot from 2024-06-02 06-50-10
Screenshot from 2024-06-02 06-50-102395×881 158 KB

image
image2560×1440 178 KB

I didn’t add any zone named Icinga-server but the master node hostname is Icinga-server

zones.conf in the master node

root@Icinga-server:~# cat /etc/icinga2/zones.conf
/*
 * Generated by Icinga 2 node setup commands
 * on 2024-06-02 00:43:53 +0000
 */

object Endpoint "Icinga-server" {
}

object Zone "master" {
	endpoints = [ "Icinga-server" ]
}

object Zone "global-templates" {
	global = true
}

object Zone "director-global" {
	global = true
}
root@Icinga-server:~#

zones.conf in the client node

root@icinga-node1:~# cat /etc/icinga2/zones.conf
/*
 * Generated by Icinga 2 node setup commands
 * on 2024-06-02 01:02:42 +0000
 */

object Endpoint "Icinga-server" {
	host = "x.x.x.x"
	port = "5665"
}

object Zone "master" {
	endpoints = [ "Icinga-server" ]
}

object Endpoint "icinga-node1" {
}

object Zone "icinga-node1" {
	endpoints = [ "icinga-node1" ]
	parent = "master"
}

object Zone "global-templates" {
	global = true
}

object Zone "director-global" {
	global = true
}
root@icinga-node1:~#
5

did you run:

icinga2 node wizard

before the director kickstarter?

otherwise your zones are not set up correctly.
since there is nothing important in the director database yet, I would recreate it after the node wizard.

one more thing:
in director you need a host template with icinga agent => yes, accepts-config=>yes, and establish connection based on then direction of the connection.

in addition to this template you need a service template with the setting run on agent => yes

1 Like