1

I want to check the availability of a SSL Web site (https) with nagios.

I have add a command to the command.cfg:

define command{
  command_name    check_http_myserver_Demo
  command_line    $USER1$/check_http -H www.mydomain.de -u /Demo -p 443 -S
}

Then I have add also a service in the localhost.cfg:

define service {
   use                             local-service
   host_name                       myServer
   service_description             HTTP myserver Response Check
   check_command                   check_http_myserver_Demo
   max_check_attempts              2
   normal_check_interval           5
   retry_check_interval            1
   notification_interval           240
   notification_period             24x7
   notification_options            w,u,c,r
}

If I check the configuration file with "nagios -v nagios.cfg" I'm getting no errors.

The nagios server check of this service is negativ and says "HTTP CRITICAL - Fehler beim Empfangen" (it's german; my translation: "error while receiving"). But the service is definitive available. I can open a browser and can open the URL without problems.

Any ideas?

EDIT:

If I run the check manually I get:

/usr/lib64/nagios/plugins/check_http -v -H www.c-onDocFlow.de -u / -S
GET / HTTP/1.1
User-Agent: check_http/v1.4.15 (nagios-plugins 1.4.15)
Connection: close
Host: www.c-onDocFlow.de

HTTP CRITICAL - Fehler beim Empfangen

Without "-S" it runs ok. Also if I take a other https side (of a other domain) it's ok. May be something is with the certificate wrong, but I cannot see any problem.

Improve this question
4
  • 1
    If you run the check command by hand on your nagios server, does it still fail?
    – Flup
    May 20, 2013 at 10:51
  • FWIW when I try this from here, I get a 400 error from your webserver.
    – Flup
    May 20, 2013 at 11:38
  • If you try connecting using openssl directly from the command line, does it tell you anything about problems with the site certificate? (e.g. openssl s_client -connect servername:443)
    – Jenny D
    May 20, 2013 at 11:39
  • Found it! Thanks "Jenny D". Your command returns a wrong SSL certificate (for a second domain of this server). The other domain will be no longer used. I have correct the httpd configuration and now it works! Many thanks also to Flup for your help!
    – Steffen
    May 20, 2013 at 11:52

2 Answers 2

Reset to default
1

You may not be able to see anything else wrong, but I can:

[me@risby]$ openssl s_client -connect www.c-onDocFlow.de:443
CONNECTED(00000003)
[...]
Certificate chain
 0 s:/OU=Domain Control Validated/OU=PositiveSSL/CN=www.dbregio-nwn.de
   i:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=PositiveSSL CA 2
 1 s:/C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=PositiveSSL CA 2
   i:/C=SE/O=AddTrust AB/OU=AddTrust External TTP Network/CN=AddTrust External CA Root
---
[much certificate stuff deleted]
---
GET /
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>503 Service Temporarily Unavailable</title>
</head><body>
<h1>Service Temporarily Unavailable</h1>
<p>The server is temporarily unable to service your
request due to maintenance downtime or capacity
problems. Please try again later.</p>
</body></html>

You say you can get the root page from the webserver with a browser no problem ("the service is definitive available"); is it from the NAGIOS server that you succeed in doing that, and could we see some evidence? At the moment, it looks like NAGIOS is quite rightly telling you that the server's not giving out any content at all.

Improve this answer
3
  • It was a httpd config error. The openssl command returns a certificate of a old (second) domain of this server (and your request is going on that domain). See also the comment of "Jenny D" and my last comment. Thanks
    – Steffen
    May 20, 2013 at 11:58
  • 1
    Well done on solving your own problem, given a few pointers! May I encourage you to write your answer up and accept it (you may have to wait 48 hours to be able to do so)? Or suggest to JennyD that she write her comment up as an answer so you can accept that?
    – MadHatter
    May 20, 2013 at 12:27
  • 1
    This issue has bit me a couple of times before as well. I use digicert.com/help for a quick SSL tester when I don't want to bother with the command line.
    – jeffatrackaid
    May 20, 2013 at 13:46
0

Heres how to fix this!

You have to edit the /usr/local/nagios/etc/objects/commands.cfg and change the https arument "-I" to "-H"

This will tell it to lookup hostname instead of an dip-address specified in your http_check block in server config: /usr/local/nagios/etc/servers/yourserver.cfg

from:

    # 'check_http' command definition
define command{
        command_name    check_http
        command_line    $USER1$/check_http -I $HOSTADDRESS$ $ARG1$
        }

To:

    # 'check_http' command definition
define command{
        command_name    check_http
        command_line    $USER1$/check_http -H $HOSTADDRESS$ $ARG1$
        }
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .