Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have been monitoring a gluster FS mount with the following script, but have issues executing the script via NRPE.

Here's my script on the remote box. /usr/lib64/nagios/plugins/check_gluster.pl

#!/usr/bin/perl

@output=`/usr/sbin/gluster volume heal static info split-brain | egrep "Number of entries"`;

if($output[0] !~ m/0/){ 
        print "CRITICAL: Possible m4_2b split brain issues - $output[0]";
}elsif($output[0] !~ m/0/) {
        print "CRITICAL: Possible m4_2c split brain issues";
}else {
        print "OK";
}

In my NRPE, I have the following configuration

command[check_glusterfs]=/usr/bin/sudo /usr/lib64/nagios/plugins/check_gluster.pl 

When I run check_nrpe on Nagios, I have the following:

# /usr/lib/nagios/plugins/check_nrpe -t 60 -H myhost.domain.com -c check_glusterfs
NRPE: Unable to read output

On the remote box, I have the following error,

type=AVC msg=audit(1397547577.720:1183140): avc:  denied  { execute } for  pid=20524 comm="sh" name="sudo" dev=xvde ino=11029 scontext=unconfined_u:system_r:nrpe_t:s0 tcontext=system_u:object_r:sudo_exec_t:s0 tclass=file
type=SYSCALL msg=audit(1397547577.720:1183140): arch=c000003e syscall=59 success=no exit=-13 a0=89f800 a1=89ecd0 a2=89e1f0 a3=7fff72151910 items=0 ppid=20523 pid=20524 auid=512 uid=497 gid=498 euid=497 suid=497 fsuid=497 egid=498 sgid=498 fsgid=498 tty=(none) ses=120914 comm="sh" exe="/bin/bash" subj=unconfined_u:system_r:nrpe_t:s0 key=(null)
type=AVC msg=audit(1397547577.720:1183141): avc:  denied  { execute } for  pid=20524 comm="sh" name="sudo" dev=xvde ino=11029 scontext=unconfined_u:system_r:nrpe_t:s0 tcontext=system_u:object_r:sudo_exec_t:s0 tclass=file
type=SYSCALL msg=audit(1397547577.720:1183141): arch=c000003e syscall=21 success=no exit=-13 a0=89f800 a1=1 a2=0 a3=7fff72151910 items=0 ppid=20523 pid=20524 auid=512 uid=497 gid=498 euid=497 suid=497 fsuid=497 egid=498 sgid=498 fsgid=498 tty=(none) ses=120914 comm="sh" exe="/bin/bash" subj=unconfined_u:system_r:nrpe_t:s0 key=(null)

[Updated] Anyone has any idea how I can resolve this? Unfortunately, I am not allowed to disable selinux on the box.

I am running Cento 6.5

Regards, Alan

share|improve this question

1 Answer 1

The problem is that SELinux blocks Nagios plugins which use sudo.

To make sure this is caused by SELinux you can disable it or set it to permissive:

/etc/sysconfig/selinux
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#       enforcing - SELinux security policy is enforced.
#       permissive - SELinux prints warnings instead of enforcing.
#       disabled - SELinux is fully disabled.
SELINUX=permissive

The policy change will work on next boot.

share|improve this answer
    
I am not very familiar with SElinux, could you advise how I can add the policy? –  AlanC Apr 15 at 8:02
    
updated my answer on how to disable or set selinux to permissive instead –  edvinas.me Apr 15 at 8:07
    
Unfortunately, I cannot disable or set it to permissive....Were there some problems with the previous answer? –  AlanC Apr 15 at 8:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.