Process checks on Server 2012 problem


#1

Hi, I don’t know if I should raise a bug for this. I haven’t found anyone else with this problem.

Some process checks on Windows Server 2012 don’t seem to work:

[[email protected] libexec]# ./check_nt -p 12489 -H <2008server> -v PROCSTATE -l "csrss.exe"
OK:
[[email protected] libexec]# ./check_nt -p 12489 -H <2012server> -v PROCSTATE -l "csrss.exe"
CRITICAL: csrss.exe: not running

This only seems to affect a minority of processes:

[[email protected] libexec]# ./check_nt -p 12489 -H <2008server> -v PROCSTATE -l "svchost.exe"
OK:
[[email protected] libexec]# ./check_nt -p 12489 -H <2012server> -v PROCSTATE -l "svchost.exe"
OK:

The NSClient configuration on these servers is identical.

Anyone else experience this? Should I raise a bug?


Windows 2012 - csrss.exe
#2

Check privileges, if nsclient++ runs as a non privileged user it wont see all processes.

Check that you have the right architecture, 32bit nsclient++ cannot see 64bit processes on a 64bit os.

// Michael Medin


#3

NSClient runs as SYSTEM and this is 64 bit NSClient. I tried running the service with a domain admin account and it still fails.


#4

Right,

Which version of nsclient++ is it?
I will investigate, perhaps something broken…

// Michael Medin


#5

0.4.2.88

Thanks.


#6

Hi,

I’ve run into this problem as well on 2012R2. Was ever resolved or should I raise a bug?

check_process services.exe
d rvice\NSClient++.cpp:960 Injecting: check_process…
d stem\CheckSystem.cpp:1120 PROC>>> enumerate_processes
d stem\CheckSystem.cpp:1120 PROC>>> enable_token_privilege
d stem\CheckSystem.cpp:1123 PROC<<<enable_token_privilege
d stem\CheckSystem.cpp:1120 PROC>>> FEnumProcesses
d stem\CheckSystem.cpp:1123 PROC<<<FEnumProcesses
d stem\CheckSystem.cpp:1117 PROC::: Failed to open process: 4:
d stem\CheckSystem.cpp:1117 PROC::: Failed to open process: 228:
d stem\CheckSystem.cpp:1117 PROC::: Failed to open process: 312:
d stem\CheckSystem.cpp:1117 PROC::: Failed to open process: 380:
d stem\CheckSystem.cpp:1117 PROC::: Failed to open process: 480:
d stem\CheckSystem.cpp:1120 PROC>>> find_crashed_pids
d stem\CheckSystem.cpp:1123 PROC<<<find_crashed_pids
d stem\CheckSystem.cpp:1123 PROC<<<enumerate_processes
d rvice\NSClient++.cpp:985 Result check_process: CRITICAL
l ce\simple_client.hpp:80 CRITICAL:CRITICAL: services.exe: stopped < critical
l ce\simple_client.hpp:82 Performance data: ‘services.exe’=0;0;1

version (0,4,1,102 2013-07-15)

Thanks!


#7

Hello, I have the same problem you have a solution? thanks