Centos Tlog

標籤：xinetd   nrpe   ngios   

今天檢查系統日誌發現有，日誌中都是以下格式的日誌：

Apr 22 09:26:26jsmapp4 xinetd[3158]: EXIT: nrpe status=0 pid=14006 duration=0(sec)

Apr 22 09:26:27jsmapp4 xinetd[3158]: EXIT: nrpe status=0 pid=14316 duration=1(sec)

Apr 22 09:26:27jsmapp4 xinetd[3158]: EXIT: nrpe status=0 pid=14323 duration=1(sec)

Apr 22 09:26:27jsmapp4 xinetd[3158]: START: nrpe pid=15937 from=::ffff:192.168.1.60

Apr 22 09:26:27jsmapp4 xinetd[3158]: EXIT: nrpe status=0 pid=15937 duration=0(sec)

Apr 22 09:27:19jsmapp4 pptp[27991]: anon log[logecho:pptp_ctrl.c:677]: Echo Reply received.

Apr 22 09:27:26jsmapp4 xinetd[3158]: START: nrpe pid=7318 from=::ffff:192.168.1.60

Apr 22 09:27:26jsmapp4 xinetd[3158]: START: nrpe pid=7327 from=::ffff:192.168.1.60

Apr 22 09:27:26jsmapp4 xinetd[3158]: START: nrpe pid=7332 from=::ffff:192.168.1.60

Apr 22 09:27:26jsmapp4 xinetd[3158]: EXIT: nrpe status=0 pid=7318 duration=0(sec)

Apr 22 09:27:26jsmapp4 xinetd[3158]: EXIT: nrpe status=0 pid=7327 duration=0(sec)

Apr 22 09:27:26jsmapp4 xinetd[3158]: EXIT: nrpe status=0 pid=7332 duration=0(sec)

Apr 22 09:27:26jsmapp4 xinetd[3158]: START: nrpe pid=7652 from=::ffff:192.168.1.60

Apr 22 09:27:26jsmapp4 xinetd[3158]: EXIT: nrpe status=0 pid=7652 duration=0(sec)

Apr 22 09:27:27jsmapp4 xinetd[3158]: START: nrpe pid=8952 from=::ffff:192.168.1.60

Apr 2209:27:27 jsmapp4 xinetd[3158]: EXIT: nrpe status=0 pid=8952 duration=0(sec)

 

通過分析以上日誌發現：

xinetd是新一代的網路守護進程服務程式，又叫超級Internet伺服器,常用來管理多種輕量級Internet服務。

這個進程來自於192.168.1.60這個ip，明顯是內網ip，以前沒有發現這個問題，奇怪。

去60這台伺服器查看發現，有nagios警告的日誌：

Apr 22 09:50:02jsmbak1 nagios: Warning: The check of host ‘jsmapp1‘ looks like it was orphaned(results never came back).  I‘mscheduling an immediate check of the host...

Apr 22 09:50:24jsmbak1 nagios: Warning: The check of service ‘check_mem‘ on host ‘jsmapp4‘looks like it was orphaned (results never came back).  I‘m scheduling an immediate check of theservice...

Apr 22 09:51:02jsmbak1 nagios: Warning: The check of service ‘Current Load‘ on host‘Nagios-Server‘ looks like it was orphaned (results never came back).  I‘m scheduling an immediate check of theservice...

Apr 22 09:51:02jsmbak1 nagios: Warning: The check of service ‘SSH‘ on host ‘Nagios-Server‘looks like it was orphaned (results never came back).  I‘m scheduling an immediate check of theservice...

Apr 22 09:51:02jsmbak1 nagios: Warning: The check of service ‘Total Processes‘ on host‘Nagios-Server‘ looks like it was orphaned (results never came back).  I‘m scheduling an immediate check of theservice...

Apr 22 09:51:02jsmbak1 nagios: Warning: The check of service ‘HTTP‘ on host ‘jsmapp2‘ lookslike it was orphaned (results never came back). I‘m scheduling an immediate check of the service...

Apr 22 09:51:02jsmbak1 nagios: Warning: The check of service ‘HTTP‘ on host ‘jsmapp3‘ lookslike it was orphaned (results never came back). I‘m scheduling an immediate check of the service...

Apr 22 09:51:46jsmbak1 xinetd[16796]: START: nrpe pid=17625 from=::ffff:127.0.0.1

Apr 22 09:51:46jsmbak1 xinetd[16796]: EXIT: nrpe status=0 pid=17625 duration=0(sec)

Apr 22 09:52:50jsmbak1 xinetd[16796]: START: nrpe pid=17890 from=::ffff:127.0.0.1

Apr 22 09:52:50jsmbak1 xinetd[16796]: EXIT: nrpe status=0 pid=17890 duration=0(sec)

 

Nagios是一款開源的免費網路監視工具，能有效監控Windows、Linux和Unix的主機狀態、交換器、路由器等網路設定，印表機等。

Nagios 可以監控的功能有： 

1、監控網路服務（SMTP、POP3、HTTP、NNTP、PING等）；

2、監控主機資源（處理器負荷、磁碟利用率等）；

3、簡單地外掛程式設計使得使用者可以方便地擴充自己服務的檢測方法；

4、並行服務檢查機制；

5、具備定義網路分層結構的能力，用"parent"主機定義來表達網路主機間的關係，這種關係可被用來發現和明晰主機宕機或不可達狀態；

6、當服務或主機問題產生與解決時將警示發送給連絡人（通過EMail、簡訊、使用者定義方式）；

7、具備定義事件控制代碼功能，它可以在主機或服務的事件發生時擷取更多問題定位；

8、自動的日誌復原；

9、可以支援並實現對主機的冗餘監控；

10、可選的WEB介面用於查看當前的網路狀態、通知和故障曆史、記錄檔等；

 

查看nagios進程發現，有多個進程

[[email protected] ~]# ps-ef|grep "bin/nagios"

root      4913 4095  0 11:12 pts/2    00:00:00 grep bin/nagios

nagios    5146    1  0 Feb18 ?        01:12:40 /usr/local/nagios/bin/nagios-d /usr/local/nagios/etc/nagios.cfg

nagios    5286    1  0 Feb19 ?        01:15:13 /usr/local/nagios/bin/nagios-d /usr/local/nagios/etc/nagios.cfg

nagios    9767    1  0 Feb18 ?        01:13:52 /usr/local/nagios/bin/nagios-d /usr/local/nagios/etc/nagios.cfg

 

使用[[email protected]~]$ killall nagios，殺掉所有nagios，然後重啟

/usr/local/nagios/bin/nagios-d /usr/local/nagios/etc/nagios.cfg

 

如果想停止nrpe服務在xinetd下的日誌輸出

修改設定檔，禁用成功狀態下的日誌

 

[[email protected]tomcat]# vi /etc/xinetd.conf

# Define generallogging characteristics.

        log_type        = SYSLOG daemon info

        log_on_failure  = HOST

#       log_on_success  = PID HOST DURATION EXIT

 

重新服務xinetd後再次查看日誌，不再出現nrpe相關日誌

[[email protected]tomcat]# service xinetd restart

Stopping xinetd:[  OK ]

Starting xinetd:[  OK ]

Centos Tlog