Nagios Server is monitoring my Server which hosts Windows Sharepoint.

I am getting the following 2 alerts in my inbox from Nagios Server

1. Service: C:\ Drive Space


Additional Info:

CRITICAL - Socket timeout after 10 seconds

2. Service: CPU Load


Additional Info:

CRITICAL - Socket timeout after 10 seconds

What do I infer from these?


That the check can't contact the network service that it uses to monitor your server. I'd expect it's either WMI or NSClient. You haven't said that the host is down, so I'll assume that nagios can ping the host okay. If the service wasn't running, you'd get a connection refused message, but you're getting socket timeout, which means it's failed to establish a connection within a certain amount of time. Given that you can ping the machine and that you can't reach the socket, I'd say there's probably a firewall in the way.


More information is needed, such as:

  • if you are always getting these, or if it intermittent.
  • What does the network look like between Nagios and the Host.
  • Was it working before, or did it just start?

That being said, if you are getting these intermittently, it could mean that either the Nagios server, the server being checked, or the network is under very high load and can't respond in time, in addition to whatever one else has said.

It could even be something like an IP conflict.

You could also trying increase the global timeout in the nagios.cfg , and / or the timeout for the particular plug-in ( usually the -t switch).


As a first step ensure the check commands can be run locally, then try running them manually from remote (all covered in the documentation). Depending on the results you may need to ensure the Windows firewall has the appropriate ports open and that the Nagios machine is allowed to connect to the Windows host. For what it's worth, those 2 checks are normally very fast, so there's no way they should time out.


Whenever I see an alert like this, it usually means that the server agent isn't running, or is otherwise blocked from responding properly to the check command.

The examples you posted are both active checks (that require an agent to be installed on the server) rather than passive ones that just do an HTTP request or ping, so make sure that the agent is running; NSClient will report itself as "Nagios Agent" in the service control manager on your target machine, while NSClient++ calls itself NSClientpp.

  • NSClient++ is running on my server. – user12213 Jul 27 '09 at 9:15
  • Okay, so you'll need to check that the "NSClientpp" service is running, and that your server's firewall (assuming it has one) is allowing connections on port 12489. – RainyRat Jul 27 '09 at 9:40

If this service was working before, it could be a network intermittent failure.

At work it help us to discover some erratic access problem to our offsite datacenter.

  • u were right.it was a network connectivity issue.thanx. – user12213 Jul 28 '09 at 6:34

Well given as you haven't given enough information regarding how these service checks are configured I'll hazard a guess that you're using SNMP or NRPE.

If you're using NRPE I'd highly suggest getting rid of it as I've had nothing but problems with it in the past and makes management a nightmare as you have to update the plugins on all servers when you make a change to correct a problem.

If on the otherhand you're using SNMP to monitor the CPU load and drive space, it would appear that your SNMP process is running into problems responding. From personal experience I have to ask if the machine is heavily utilized? I've seen this behavior in MS Windows before where it gives the SNMP process low priority when under high utilization and thus SNMP checks begin to fail with timeout issues. If this has never worked then I'd check to make sure you're using the correct SNMP community string and/or if you're utilizing IP based authentication that the poller's IP is properly allowed access in the SNMP configuration on the machine.

Again without knowing how it's configured it makes it really difficult to give much more detailed assistance.


Agree with everything above. The only thing I would make sure to look at is checking to see if you somehow enabled SSL on the check (that will cause havoc) or visa versa, if you are requiring SSL that it is enabled.

And as previously mentioned, review the local config (nsclient.ini or nrpe.cfg) and find out what port you are trying to connect to. Then run a telnet from a remote machine and see if you are able to get to it.


if this is an intermittent issue for you, i.e. you only get these warnings every now and then with no warnings etc however the server and services are working as expected, its most likely the same problem ive been running into, its due to the plugin timeout being a little short (in some cases as low as 10 seconds).

the answer is to consult the documentation for the plugins your using to see if you can extend there timeouts, then either ammend your commands.cfg file or each server config so that it increases the timeout period for each check.

hope this helps :)


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.