Check_nrpe returns 'Bad Command'


I am running nagios 5.3.1 on Centos 6 and nsclient++ on Windows 2012 R2

One of my servers has started returning ‘bad command’ for all of its checks…

From the Nagios box-

[[email protected] ~]# /usr/local/nagios/libexec/check_nrpe -H server
JNRPE library V. 2.0.5
[[email protected] ~]# /usr/local/nagios/libexec/check_nrpe -H server -c checkcpu
Bad command
[[email protected] ~]# /usr/local/nagios/libexec/check_nrpe -H server -c check_cpu
Bad command
[[email protected] ~]# /usr/local/nagios/libexec/check_nrpe -H server -c checkmem
Bad command

When I run the commands locally however they work fine-

D  w32system Created command: "detail-syntax=${time}: average load ${load}%"
L        cli OK: OK: CPU load is ok.
L        cli  Performance data: 'total 5m'=0%;80;90 'total 1m'=2%;80;90 'total 5
D  w32system Created command: "detail-syntax=%(type): Total: %(size) - Used: %(u
sed) (%(used_pct)%) - Free: %(free) (%(free_pct)%)"
L        cli OK: OK: committed: Total: 22GB - Used: 5.875GB (26%) - Free: 16.125
GB (73%), physical: Total: 16GB - Used: 5.088GB (31%) - Free: 10.911GB (68%)
L        cli  Performance data: 'committed'=5.87489GB;17.59964;19.7996;0;21.9995
6 'committed %'=27%;80;90;0;100 'physical'=5.08836GB;12.79964;14.3996;0;15.99956
 'physical %'=32%;80;90;0;100

I have never seen a ‘bad command’ error before… any Idea what is causing this?

here is the full output from the nrpe test command-

L     client Module: CommandClient
L     client Command:
L     client Extra Query:
L     client Mode: 3
L     client Boot: 1
L     client Load All: 0
L     client Warning module and boot specified only THAT module will be loaded
L     client Arguments:
D       core NSClient++ 2016-09-14 x64 Loading settings and logger...
D       core Settings not ready so we cant lookup: base-path
D       core Settings not ready so we cant lookup: exe-path
D   settings Boot.ini found in: D:\Program Files\NSClient++/boot.ini
D   settings Activating: registry://HKEY_LOCAL_MACHINE/software/NSClient++
D   settings Creating instance for: registry://HKEY_LOCAL_MACHINE/software/NSCli
D       core NSClient++ 2016-09-14 x64 booting...
D       core Booted settings subsystem...
D       core On crash: restart: NSCP
D       core Archiving crash dumps in: D:\Program Files\NSClient++/crash-dumps
D       core booting::loading plugins
D       core Found: CheckDisk
D       core Found: CheckEventLog
D       core Found: CheckExternalScripts
D       core Found: CheckHelpers
D       core Found: CheckNSCP
D       core Found: CheckSystem
D       core Found: NRPEServer
D       core D:\Program Files\NSClient++/modules\CheckDisk.dll.dll
D       core adding D:\Program Files\NSClient++/modules\CheckDisk.dll
D       core D:\Program Files\NSClient++/modules\CheckEventLog.dll.dll
D       core adding D:\Program Files\NSClient++/modules\CheckEventLog.dll
D       core D:\Program Files\NSClient++/modules\CheckExternalScripts.dll.dll
D       core adding D:\Program Files\NSClient++/modules\CheckExternalScripts.dll

D       core D:\Program Files\NSClient++/modules\CheckHelpers.dll.dll
D       core adding D:\Program Files\NSClient++/modules\CheckHelpers.dll
D       core D:\Program Files\NSClient++/modules\CheckNSCP.dll.dll
D       core adding D:\Program Files\NSClient++/modules\CheckNSCP.dll
D       core D:\Program Files\NSClient++/modules\CheckSystem.dll.dll
D       core adding D:\Program Files\NSClient++/modules\CheckSystem.dll
D       core D:\Program Files\NSClient++/modules\NRPEServer.dll.dll
D       core adding D:\Program Files\NSClient++/modules\NRPEServer.dll
D       core Loading plugin: CheckDisk
D       core Loading plugin: CheckEventLog
D       core Loading plugin: CheckExternalScripts
D ext-script No aliases found (adding default)
D ext-script Detected a $ARG??$ expression with allowed arguments flag set to fa
lse (perhaps this is not the intent)
D       core Loading plugin: CheckHelpers
D       core Loading plugin: CheckNSCP
D check_nscp Crash folder is: D:\Program Files\NSClient++/crash-dumps
D       core Loading plugin: CheckSystem
D       core Loading plugin: NRPEServer
D       nrpe Allowed hosts definition:,
D       nrpe Server config: address: :5666, ssl enabled: none, no certificate, d
h: D:\Program Files\NSClient++/security/nrpe_dh_512.pem, ciphers: ADH, ca: D:\Pr
ogram Files\NSClient++/security/ca.pem, options:
D       nrpe Binding to: [::]:5666(ipv6)
D       nrpe Attempting to bind to: [::]:5666(ipv6)
D       nrpe Binding to:, reopen: true, reuse: true
D       nrpe Attempting to bind to:
D       core NSClient++ - 2016-09-14 Started!
D       core D:\Program Files\NSClient++/modules\CommandClient.dll.dll
D       core adding D:\Program Files\NSClient++/modules\CommandClient.dll
D       core Loading plugin: CommandClient...
D        cli Enter command to execute, help for help or exit to exit...
D  w32system Loading counter: disk_queue_length_0 C: = \\CLI7U3NRC1PD1\PhysicalD
isk(0 C:)\% Disk Time
D  w32system Loading counter: disk_queue_length_1 D: = \\CLI7U3NRC1PD1\PhysicalD
isk(1 D:)\% Disk Time
D  w32system Loading counter: disk_queue_length__Total = \\CLI7U3NRC1PD1\Physica
lDisk(_Total)\% Disk Time


It actually turned out that the customer had installed an app monitoring program which appears to have nrpe built into it so it was using the same port but had none of the standard checks and modules loaded!

Once it was disabled it agent started working perfectly