[Day 4] 4. Remote Machine Monitoring (Nagios)

NCPA Plugin

To monitor a remote machine (Windows), we'll use the Nagios plugin NCPA (Nagios Cross Platform Agent) in a Windows VM, which helps keep your base Windows machine clean. Keep the Windows VM in NAT mode.

Steps for Installation:

Do this in Windows Machine:

Install NCPA Plugin:
- Install the NCPA plugin using the setup file provided by your Manu Sir.
- Go through the installation steps (Next, Next).
- When asked, set a token (password) for the installation.
- Keep the default port 5693.
- Finish the installation.
Check Windows Virtual Machine Details:
- Find the IP address of the Windows virtual machine (for example:
```
192.168.80.133
```
  ).
- Ensure the firewall is turned off. If it's on, turn it off.
Access NCPA from Browser:
- On your base Windows machine, open a browser.
- In the browser, visit
```
https://192.168.80.133:5693
```
  (use the Windows Virtual machine's IP address). Please note that this is
```
https
```
  and not
```
http
```
  .
- Enter the necessary information, and you should be able to view the machine's statistics.

Troubleshooting Steps (If Problems Occur)

Check the Firewall: Ensure the firewall is not blocking the connection.
Check NCPA Service: Press
```
Windows + R
```
, type
```
services.msc
```
, and ensure the
```
ncpa
```
service is running.
Verify URL: Double-check the URL for accuracy.

Next Steps for Plugin Communication:

Download the Plugin:

shell
wget http://192.168.0.52/sw/security_tools/nagios/check_ncpa.tar.gz

Extract the Plugin:

shell
tar -zxf check_ncpa.tar.gz

Copy the Plugin:

shell
sudo cp check_ncpa.py /usr/local/nagios/libexec/

Check Permissions:
- Verify that
```
check_ncpa.py
```
  has executable permissions.
Edit the Shebang Line:
- Open
```
check_ncpa.py
```
  and change the shebang to:
```
#!/usr/bin/env python3
```

Check Plugin Version:

bash
cd /usr/local/nagios/libexec/
sudo ./check_ncpa.py -V

Plugin Communication:

bash
sudo ./check_ncpa.py -t <your_token> -H <windows_vm_ip> -M memory/virtual

```
-t
```
: Token (password)
```
-H
```
: Host IP address (IP of machine you want to monitor)
```
-M
```
: Metric to monitor (e.g., memory/virtual)

Edit Configuration File:

Navigate to
```
/usr/local/nagios/etc/objects
```
.

Open

commands.cfg

and define the plugin:

bash
define command {
    command_name        check_ncpa
    command_line        $USER1$/check_ncpa.py -H $HOSTADDRESS$ $ARG1$
}

Configure Nagios to Monitor the Machine:

Edit

/usr/local/nagios/etc/nagios.cfg

and uncomment this line

cfg_dir=/usr/local/nagios/etc/servers

. (line 51)

Create a directory
```
servers
```
under
```
/usr/local/nagios/etc/
```
.

Create a new file

win_10_1.cfg

inside

/servers

with the following content:

plaintext
define host{
    use                        windows-server
    host_name                  win-10_1
    alias                      Windows 10 System 1
    address                    <windows_server_ip>
    max_check_attempts         5
}
define service{
    use                        generic-service
    host_name                  win-10_1
    service_description        NCPA Agent Version
    check_command              check_ncpa!-t '<your_token>' -p -P 5693 -M system/agent_version
}
define service{
    use                        generic-service
    host_name                  win-10_1
    service_description        CPU Average
    check_command              check_ncpa!-t '<your_token>' -p -P 5693 -M cpu/percent -w 20 -c 40 -q 'aggregate=avg'
}

Comment out the line

hostgroups windows-servers

in the

templates.cfg

file from

/usr/local/nagios/etc/objects

because the Nagios developers included this reference but did not define the corresponding host group.

Restart and check status of Nagios:

bash
sudo systemctl restart nagios
sudo systemctl status nagios

Monitoring the Status: Open any browser in your host machine:
```
http://<nagios_server_ip>/nagios
```

Explanation of Configuration Details:

Templates:
- ```
windows-server
```
  and
```
generic-service
```
  are predefined templates in Nagios (found in
```
templates.cfg
```
  ).
- These templates define the structure of services and hosts.
Check Command Explanation:
- ```
check_ncpa
```
  is the function you defined in
```
commands.cfg
```
  .
- ```
-t
```
  : Token/password for authentication.
- ```
-p
```
  : Port number (5693). This is default port used by NCPA.
- ```
-M
```
  : Metric to monitor (e.g., CPU or memory).
- ```
-w
```
  : Warning threshold (percentage).
- ```
-c
```
  : Critical threshold (percentage).
- ```
-q
```
  : Query parameter (e.g., 'aggregate=avg').

[Day 4] 4. Remote Machine Monitoring (Nagios)

NCPA Plugin

Steps for Installation:

Troubleshooting Steps (If Problems Occur)

Next Steps for Plugin Communication:

Explanation of Configuration Details:

Read Next

[Day 4] 5. Reverse Proxy Setup with Nginx and Apache

[Day 4] 6. SQUID