NSClient is a small and flexible tool that runs on your windows machine, it runs as a service and can therefor run as any user. Access can be limited to IP address and shared secret, and encryption method. NSClient can also schedule its own checks of the server and pass them back to nagios via NSCA. In a busy nagios environment this can save you quite a few cycles. It is also compatible with active checks using standard check_nrpe for your nagios box, so now you can use the same check commands and service definitions from your server to check both your windows servers and your *nix servers.

That was a breif rave about nsclient, now into the details.

• scan your windows logs for any type or event and report back.
• execute custom local applications / scripts for systems checks.
• execute custom local applications as event handlers.
• get system stats from any counter.
• do any wmi queries. run multiple check commands and bundle the reults.

What else do you need when you want to monitor a windows box.

NSClient also comes as a .msi and can be pushed out with SCCM or any other standard windows software distribution tool. For environments without software distribution systems, I use a custom vbscript that can install the software over the network using psexec. It will also deploy / update the configuration files remotely.

nsc.ini

[modules]
FileLogger.dll
CheckSystem.dll
CheckDisk.dll
NRPEListener.dll
CheckEventLog.dll
CheckHelpers.dll
CheckWMI.dll
CheckExternalScripts.dll
NSCAAgent.dll
 
[Settings]
allowed_hosts=10.0.0.0/24
use_file=1
shared_session=0
 
[log]
debug=0
;file=nsclient.log
;date_mask=%Y-%m-%d %H:%M:%S
;root_folder=exe
 
[NSClient]
[NRPE]
port=5666
command_timeout=60
allow_arguments=0
use_ssl=1
socket_timeout=30
 
[Check System]
CPUBufferSize=1h
CheckResolution=10
 
[External Script]
command_timeout=60
allow_arguments=0
allow_nasty_meta_chars=0
 
[External Scripts]
[External Alias]
[EventLog]
buffer_size=512000
 
 
[NSCA Agent]
interval=300
encryption_method=3
password=S3CR3t
#hostname=
nsca_host=10.10.10.10
 
[NSCA Commands]
CPU Usage=checkCPU ShowAll warn=80 crit=90 time=5m time=1m time=30s
Disk Usage=CheckDriveSize ShowAll MinWarnFree=10% MinCritFree=5% FilterType=FIXED
Memory Usage=CheckMultiple command=checkMem MaxWarn=90% MaxCrit=95% ShowAll type=physical command=checkMem MaxWarn=90% MaxCrit=95% ShowAll type=page
Service: Upfront Data Store=checkServiceState ShowAll "Name of Service in Service Manager"
 
[NRPE Handlers]
check_cpu=inject checkCPU ShowAll warn=80 crit=90 time=5m time=1m time=30s
check_eventlog=inject CheckEventLog file=application file=system filter=new filter=out MaxWarn=1 MaxCrit=1 filter-generated=>1d filter-severity==success filter-severity==informational truncate=1023 unique descriptions "syntax=%severity%: %source%: %message% (%count%)"
check_disks=inject CheckDriveSize ShowAll MinWarnFree=10% MinCritFree=5% FilterType=FIXED
check_mem=inject CheckMultiple command=checkMem MaxWarn=90% MaxCrit=95% ShowAll type=physical command=checkMem MaxWarn=90% MaxCrit=95% ShowAll type=page
check_service_uds=inject checkServiceState ShowAll "Name of Service in Service Manager"