NSClient++ : MISSING TOKEN error

Gaetan · May 12, 2026, 7:26am

Hello,

I have a setup consisting of several windows server machines monitored by an Icinga2 instance installed on a Debian 13 server. Each machine has an Icinga2 agent installed (v2.16), as well as NSClient++ (with versions 9 and 10). On the Icinga2 side of things, I call the nscp api like this: https://icinga.com/docs/icinga-2/snapshot/doc/06-distributed-monitoring/#distributed-monitoring-windows-nscp-check-api

The setup works well, but I added a new machine and installed NSClient++ v11.8 on it and I am getting 403 errors in Icinga2. Looking in nsclient.log I am getting these errors every time I try to run a service that uses NSClient. Icinga2 basic services work fine. I have not altered the nsclient.ini file.

Locally NSClient++ seems to run its own checks just fine:

I have pinpointed the exact NSClient++ version where this stops working as 0.11.6. The error occurs both on a fresh install of nscp and upon upgrading a previous version.

Icinga2 version: r2.16.0-1

Enabled features: api checker command icingadb influxdb mainlog notification

icinga2 daemon -C is green

Don’t hesitate if you need more details.

Thank you.

lorenz · May 12, 2026, 9:02am

It looks like there are breaking changes in NSclient++.
But I am not sure how to adapt to this.

Gaetan · May 12, 2026, 9:38am

Thanks. Yes I can see that there is some mention of tokens:

I just don’t do anything myself with the tokens so I don’t really know what to change. I wonder if this is something to do with the nscp plugin for Icinga2 itself. I’d be curious to see if anyone has the same problem (I haven’t found anything online right now).

lorenz · May 12, 2026, 9:57am

This is the first time I am seeing this, but we commonly no longer deploy NSclient++ in our customer setup since it became stagnant a few years ago, so there is not a lot of data.

Thank you for reporting this. This might be a good starting point for people with the same issue.

apenning · May 12, 2026, 10:08am

AFAIK, Icinga 2’s check_nscp_api does not make any use of tokens, but passes the password as an additional HTTP request header.

github.com/Icinga/icinga2

plugins/check_nscp_api.cpp

f50f6ec88


      
          
          	// NSClient++ uses `time=1m&time=5m` instead of `time[]=1m&time[]=5m`
          	url->SetArrayFormatUseBrackets(false);
          
          	http::request<http::string_body> request (http::verb::get, std::string(url->Format(true)), 10);
          
          	request.set(http::field::user_agent, "Icinga/check_nscp_api/" + String(VERSION));
          	request.set(http::field::host, host + ":" + port);
          
          	request.set(http::field::accept, "application/json");
          	request.set("password", password);
          
          	if (l_Debug) {
          		std::cout << "Sending request to " << url->Format(false, false) << "'.\n";
          	}
          
          	try {
          		http::write(*tlsStream, request);
          		tlsStream->flush();
          	} catch (const std::exception& ex) {
          		std::cerr << "Cannot write HTTP request to REST API at URL '" << url->Format(false, false) << "': " << ex.what();

It was a bit hard for me to skim over the latest changelogs and pinpoint something specific, so I would guess reporting this to the nscp bug tracker would be a good idea.

Peer-Mario · May 18, 2026, 6:36am

That’s why we use SNClient

lorenz · May 18, 2026, 7:20am

That would be this one and I would recommend to try this as a replacement.

Gaetan · May 18, 2026, 8:34am

Thanks for the replies and suggestions. NSClient++ has since reportedly patched the issue in version 0.12.4. I haven’t had time to test it yet but I will report when I have.

Gaetan · May 26, 2026, 9:06am

I have tested the newest version of NSClient++ and it works fine. Thanks everyone.