OSMC 2012 | Distributed Monitoring mit NSClient++ by Michael Medin
0 likes40 views
The document discusses nsclient++, a program used for secure monitoring in Windows and Linux environments, detailing its features and usage. It includes various commands for configuration, module management, and real-time logging. Additionally, it provides examples of settings and commands to guide users in effectively utilizing the tool.
![nscp Display all(?) available context
nscp --help Get help (can be used in many places)
nscp <context or alias> [options] [-- [module options]]
General usage syntax
General usage](https://image.slidesharecdn.com/michaelmedinnsclient-190123101024/85/OSMC-2012-Distributed-Monitoring-mit-NSClient-by-Michael-Medin-22-320.jpg)
![nscp settings --help
nscp settings --add-missing --generate [--load-all]
Will update your configuration with ALL keys
nscp settings --add-missing --activate-module <module>
Great way to "enable a new module“
nscp settings --remove-defaults --generate
Will remove all default keys/sections
nscp settings --validate
Show problems with the settings file
Settings (Configuration)](https://image.slidesharecdn.com/michaelmedinnsclient-190123101024/85/OSMC-2012-Distributed-Monitoring-mit-NSClient-by-Michael-Medin-25-320.jpg)
![[/modules]
CheckLogFile = enabled
SimpleFileWriter = enabled
[/settings/logfile/real-time/checks/sample]
critical = column2 like 'crit'
destination = FILE
file = ./test.txt
filter = column1 like 'hello'
warning = column2 like 'warn'
[/settings/logfile/real-time]
enabled = true
Resulting config from DEMO](https://image.slidesharecdn.com/michaelmedinnsclient-190123101024/85/OSMC-2012-Distributed-Monitoring-mit-NSClient-by-Michael-Medin-29-320.jpg)
![[/settings/logfile/real-time]
enabled = true
[/settings/NSCA/client/targets/default]
address = 127.0.0.1
encryption = xor
password = secret
Resulting config from DEMO
[/modules]
CheckLogFile = enabled
NSCAClient = enabled
SimpleFileWriter = enabled
[/settings/logfile/real-time/checks/sample]
critical = column2 like 'crit'
destination = FILE,NSCA
file = ./test.txt
filter = column1 like 'hello'
warning = column2 like 'warn'](https://image.slidesharecdn.com/michaelmedinnsclient-190123101024/85/OSMC-2012-Distributed-Monitoring-mit-NSClient-by-Michael-Medin-30-320.jpg)
![[/settings/logfile/real-time]
enabled = true
[/settings/NSCA/client/targets/default]
address = 127.0.0.1
encryption = xor
password = secret
Resulting config from DEMO
[/modules]
CheckLogFile = enabled
NSCAClient = enabled
SimpleFileWriter = enabled
SimleCache = enabled
[/settings/logfile/real-time/checks/sample]
critical = column2 like 'crit'
destination = FILE,NSCA,CACHE
file = ./test.txt
filter = column1 like 'hello'
warning = column2 like 'warn'](https://image.slidesharecdn.com/michaelmedinnsclient-190123101024/85/OSMC-2012-Distributed-Monitoring-mit-NSClient-by-Michael-Medin-34-320.jpg)
OSMC 2012 | Distributed Monitoring mit NSClient++ by Michael Medin
- 1. NSClient++ in the new millenium! ( )Discovering NSClient++ Name: Michael Medin (@mickem) Email: michael@medin.name Blog: http://blog.medin.name Project: NSClient++ Web: http://nsclient.org ∘•
- 5. About NSClient++ (the program)
- 6. About NSClient++ (the project)
- 7. NSClient++ (What can I do?)
- 9. Thank you!
- 10. More then a 1000 words?
- 11. …for windows…
- 14. More then a 1000 words?
- 16. More then a 1000 words?
- 19. Security
- 21. Time to get real…
- 22. nscp Display all(?) available context nscp --help Get help (can be used in many places) nscp <context or alias> [options] [-- [module options]] General usage syntax General usage
- 23. help Get help client Act as a client. (think check_nrpe) Usually aliases we can use instead. service (un)Install and display windows service settings Work with configuration test Find errors and problems unit Run unit test scripts Contexts
- 24. lua Run lua scripts python Run python scripts nrpe Think check_nrpe nsca Think send_nsca sys Nice pdh front-end (more to come) wmi WMI front end eventlog Add event log message from command line Aliases
- 25. nscp settings --help nscp settings --add-missing --generate [--load-all] Will update your configuration with ALL keys nscp settings --add-missing --activate-module <module> Great way to "enable a new module“ nscp settings --remove-defaults --generate Will remove all default keys/sections nscp settings --validate Show problems with the settings file Settings (Configuration)
- 26. nscp nrpe -- --help The -- is important nscp nrpe -- -H 127.0.0.1 -c foo -a foo bar Execute nrpe query from nsclient++ 0.4.2 will introduce: nrpe_client -H 127.0.0.1 -c foo -a foo bar nsca_client … …_client … check_nrpe
- 27. Time to get real…
- 28. CheckLogFile Subscribes to filechanges SimpleFileWriter Write notifications to file NSCAClient Submit NSCA messages Modules NSCA FILE SimpleFileWriter NSCAClient CheckLogFile NSCP
- 29. [/modules] CheckLogFile = enabled SimpleFileWriter = enabled [/settings/logfile/real-time/checks/sample] critical = column2 like 'crit' destination = FILE file = ./test.txt filter = column1 like 'hello' warning = column2 like 'warn' [/settings/logfile/real-time] enabled = true Resulting config from DEMO
- 30. [/settings/logfile/real-time] enabled = true [/settings/NSCA/client/targets/default] address = 127.0.0.1 encryption = xor password = secret Resulting config from DEMO [/modules] CheckLogFile = enabled NSCAClient = enabled SimpleFileWriter = enabled [/settings/logfile/real-time/checks/sample] critical = column2 like 'crit' destination = FILE,NSCA file = ./test.txt filter = column1 like 'hello' warning = column2 like 'warn'
- 31. ./nscp test tail –f ./output.txt echo –e “hellotworld” echo –e “hellotwarn” echo –e “hellotcrit” Run the following
- 32. Time to get real…
- 33. CheckLogFile Subscribes to filechanges SimpleCache Store our result NRPEClient Accept remote checks (if there is time) Modules CACHE SimpleCacheCheckLogFile NSCP NRPEServer
- 34. [/settings/logfile/real-time] enabled = true [/settings/NSCA/client/targets/default] address = 127.0.0.1 encryption = xor password = secret Resulting config from DEMO [/modules] CheckLogFile = enabled NSCAClient = enabled SimpleFileWriter = enabled SimleCache = enabled [/settings/logfile/real-time/checks/sample] critical = column2 like 'crit' destination = FILE,NSCA,CACHE file = ./test.txt filter = column1 like 'hello' warning = column2 like 'warn'
- 35. ./nscp test echo –e “hellotworld” echo –e “hellotwarn” echo –e “hellotcrit” In nsclient console execute: check_cache index=sample Run the following
- 36. Photo by Olga Berrios