Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an etch nagios server (I will call this NagiosServer), successfully monitoring lots of stuff, including another etch server (MonitorEtch). Using check_nrpe and check_procs I'm able to check the process list for running daemons such as '/usr/sbin/squid'.

Check MonitorEtch from NagiosServer (correct results):

/usr/lib/nagios/plugins/check_nrpe -H MonitorEtch -c check_process -a /usr/sbin/squid 1:1 1:1
PROCS OK: 1 process with args '/usr/sbin/squid'

/usr/lib/nagios/plugins/check_nrpe -H MonitorEtch -c check_process -a whatever 1:1 1:1
PROCS CRITICAL: 0 processes with args 'whatever'

I've built a new server I want to monitor, running Lucid (MonitorLucid). No matter what process I try and monitor from NagiosServer, I get an extra result than I should.

Check MonitorLucid from NagiosServer (incorrect results):

/usr/lib/nagios/plugins/check_nrpe -H MonitorLucid -c check_process -a whatever 1:1 1:1
PROCS OK: 1 process with args 'whatever'

ps ax|grep sophie
12737 ?        Ss     0:00 /usr/sbin/sophie -D
12738 ?        S      0:03 /usr/sbin/sophie -D
19591 pts/0    S+     0:00 grep --color=auto sophie

/usr/lib/nagios/plugins/check_nrpe -H -c check_process -a sophie 1:1 1:1
PROCS CRITICAL: 3 processes with args 'sophie'

Contents of /etc/nagios/nrpe_local.cfg on MonitorLucid/MonitorEtch:

command[check_process]=/usr/lib/nagios/plugins/check_procs -a $ARG1$ -m PROCS -w $ARG2$ -c $ARG3$

Yet if I perform the check locally, it returns the correct results!

Check MonitorLucid from MonitorLucid (correct results):

/usr/lib/nagios/plugins/check_procs -a whatever -m PROCS -w 1:1 -c 1:1
PROCS CRITICAL: 0 processes with args 'whatever'

/usr/lib/nagios/plugins/check_procs -a sophie -m PROCS -w 1:1 -c 1:1
PROCS CRITICAL: 2 processes with args 'sophie'

I'm out of ideas at this point, short of checking for 1 more instance than I should.

share|improve this question
up vote 3 down vote accepted

I had a similar problem. check_procs is internally calling /bin/ps axwo 'stat uid pid ppid vsz rss pcpu comm args', it's listing the processes and then counting them. If you have configured nagios to run with a different user, it's using sudo to execute the command. And here is the problem. If you type sudo ps -AF | grep sudo, some distribution return "grep sudo", others return "sudo ps -AF" and "grep sudo". As check_procs is counting all processes, you will get different results on different machines. Unfortunately I do not have a solution yet how to force check_procs to not count sudo processes.

share|improve this answer
No need to use sudo with check_procs plugin. You can write your own simple plugin to check if a process is running, for e.g: ps -ef | grep sud[o] | wc -l. – quanta Oct 25 '11 at 12:47

Sounds like the version of check_procs in Lucid is buggy (or at least has changed it's behaviour); the fact that it's always finding one extra suggests that it's doing a substring match on any part of the process name and arguments and finding one of the processes associated with running the plugin. Worth reporting a bug to Ubuntu about it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.