Problem with new Icinga2 Server & Windows Setup

Icinga 2
1

I have a new Icinga2 server, running on a new VM running a new Ubuntu 24.04.
Icinga 2 with Director was installed and setup ok without errors.
Installed Linuxfabrik without errors.
Trying to setup hosts now and running into issues.
We have 2 previous hosts that I thought were setup ok but not communicating with server. I’m ignoring those for now.
I got a script from @rivad to setup/install on a new host server that I edited to put in the variables but it’s giving an error “Failed to start Icinga for Windows installation, caused by an error while communicating with Icinga Director” which doesn’t make sense. We don’t have an internal firewall, I can ping the Icinga Director from this host, I can bring up the Icinga Director website from Edge on the host. And the error doesn’t say exactly what/why it’s having a problem communicating.

This is the error:

image
image1425×459 150 KB

This is the script from @rivad that I’m running:

[Net.ServicePointManager]::SecurityProtocol = 'tls12, tls11';
$ProgressPreference                         = 'SilentlyContinue';
[string]$ScriptFile                         = 'C:\Users\Public\IcingaForWindows.ps1';

Invoke-WebRequest `
    -UseBasicParsing `
    -Uri 'https://packages.icinga.com/IcingaForWindows/IcingaForWindows.ps1' `
    -OutFile $ScriptFile;

& $ScriptFile `
    -ModuleDirectory 'C:\Program Files\WindowsPowerShell\Modules\' `
    -InstallCommand '{"IfW-DirectorSelfServiceKey":{"Values":[" f024e252bcd908284d6dbfaa464ffcb8196a0718"]},"IfW-DirectorUrl":{"Values":["http://10.32.8.49/icingaweb2/director/"]}, "IfW-CAServer":{"Values":["ICINGA-CONFIG-MASTER.EXAMPLE.COM"]}
}'; 

$pkg = "linuxfabrik-monitoring-plugins.msi"; # https://download.linuxfabrik.ch/monitoring-plugins/lfmp-2.1.1-1.signed-packaged.windows.x86_64.zip

Write-Host "[Notice]:" -ForegroundColor Green -NoNewline
Write-Host " Starting installation of $pkg"

$process = Start-Process msiexec.exe `
    -ArgumentList "/i `"$pkg`" /norestart /qn" `
    -Wait `
    -PassThru

$exitCode = $process.ExitCode

# Map common MSI exit codes
$messages = @{
    0    = "Success"
    1603 = "Fatal error during installation"
    3010 = "Success, reboot required"
    1618 = "Another installation is already in progress"
    1619 = "MSI file not found or could not be opened"
    1620 = "Invalid or corrupt MSI package"
}

if ($messages.ContainsKey($exitCode)) {
    switch ($exitCode) {
        0 {
            Write-Host "[Notice]:" -ForegroundColor Green -NoNewline
            Write-Host " MSI exited with code $exitCode ($($messages[$exitCode]))"
        }
        3010 {
            Write-Host "[Warning]:" -ForegroundColor White -NoNewline
            Write-Host " MSI exited with code $exitCode ($($messages[$exitCode]))"
        }
        default {
            Write-Host "[Error]:" -ForegroundColor Yellow -NoNewline
            Write-Host " MSI exited with code $exitCode ($($messages[$exitCode]))"
        }
    }
} else {
    Write-Host "[Warning]:" -ForegroundColor White -NoNewline
    Write-Host " MSI exited with unmapped code $exitCode"
}
2

did you use your own self-service-key?

3

I didn’t give him mine :wink:

4

Yes. I generated it via the self-service agent page.

5

You still need to fix this by removing the parameter or replace the all caps with your Icinga server.

6

I did. I took out the setting. Didn’t make a difference. Same error.

7

there is also a space in the apikey

9

THANK YOU!

Not sure how I missed that stupid mistake.

So that got me a LOT further now. And I got really excited because I saw a bunch of “passed” lines but then it gave a ‘warning’ for the Icinga for windows service saying it’s not marked for installation, which is odd because I DID mark it for installation, so it should be installing the service.
And then it gives two more warnings at the end saying “icingapowershell” is not installed.
Then a final error saying “MSI exited with code 1619 (MSI file not found or could not be opened)”

image
image1419×989 323 KB

10

I ran the script on one of the other servers which already had the agent/etc installed but wasn’t communicating with the Icinga Server, just to see what would happen and it got a slightly different result but ended with the same error:

image
image1199×629 221 KB

11

did you download the linuxfabrik msi from somewhere? because that is not part of icinga

and for the powershell part, you didn’t tell the install command to install the powershell service.

If you only use the linuxfabrik plugins (Python) that is ok to leave that out, if you want to use the powershell plugins you need to adapt the install command

1 Like
12

I’m only planning on using the linuxfabrik plugins for now, unless/until we have a need for a monitor that it doesn’t cover. (unlikely)

So if I don’t need install command for the powershell service, (what service does the linuxfabrik use then?), I thought the script itself was downloading the linuxfabrik-monitoring-plugins.msi.

Why is this file needed on the host side?

13

As @moreamazingnick already wrote, we don’t use the Icinga GmbH’s PowerShell service because we don’t use the PowerShell checks.

what service does the linuxfabrik use then?),

None, the check plugins get called by the Icinga2 Agent service with parameters and the exit code and stdout are the return channel - same as on Linux. No separate icingapowershell service required :smile:

Does the problematic host now communicate with the icinga master?

I thought the script itself was downloading the linuxfabrik-monitoring-plugins.msi.

I didn’t put in the linuxfabrik-monitoring-plugins.msi download and extraction into the script as our server team is temporarily attaching a share containing the script and msi while new servers gets provisioned.

If you want to download the msi in the script, it should be a quick search to figure out how to or just ask an AI to give you a PowerShell code snipped that downloads a .zip and extracts it.

If you’re not shure about what a script does, I advice you to post scripts like this into an AI and ask it to explain, what the script does, to avoid security risks. I know I’m a person with a reputation on here but it’s still better to never trust a script and examine it’s content before running it!

1 Like