Check Kaspersky Server License Expiration with Nagios

Written by Claudio Kuenzler - 0 comments

Published on November 28th 2011 - Listed in Nagios Windows Monitoring

---

On Nagios Exchange there's a cool plugin which can be launched on the Kaspersky Server to check for several things, for example the expiration date of the license: check_KAV.bat by Olivier Mazan.
There is only one problem: It doesn't work.
Note: It didn't work under a Windows 2003 Server (32bit) with SQL Express 2005 and special instance name. Maybe the original script, which was written back in 2009, worked then and maybe under another environment.

Let's start the troubleshooting! Ready? Go!

Round 1

The batch script, once defined in NSClient++ was launched from the Nagios server by using check_nrpe. First argument is the number 6 (check license). In the NSClient++ command definition I hard coded the very first argument which is usually the hostname to check, I set the same host (kavserver):

/usr/local/nagios/libexec # ./check_nrpe -H kavserver -t 30 -c check_kav -a 6 7 14
Licence has expired
KAV - Expiration Time : ve/at/SQL  at Client]L
CRITICAL

As one can see, the plugin outputs strange information. Looks like Windows batch is trying to tell 'verify at SQL at Client' ....

What actually happens in the batch file is the following command (by taking in account all the variables for the specific check):

C:\>OSQL -E -Q "SELECT tmExpirationTime FROM KAV.dbo.apphostskeys,KAV.dbo.hosts"
[SQL Native Client]Named Pipes Provider: Could not open a connection to SQL Server [2].
[SQL Native Client]Login timeout expired
[SQL Native Client]An error has occurred while establishing a connection to the server.
When connecting to SQL Server 2005, this failure may be caused by
the fact that under the default settings SQL Server does not allow remote
connections.

No wonder the batch file/plugin is not able to find anything from the database. By searching for this error, I came across this blog page, which didn't solve the issue but gave me a hint to check for the right server name by using this command:

C:\>sqlcmd -L
Servers:
    KAVSERVER
    KAVSERVER\EPOSERVER

Clearly, the host KAVSERVER has an instance called EPOSERVER which is used for Kaspersky. No wonder the OSQL command didn't work. Let's try it by setting the server name in the OSQL command:

C:\>OSQL -S KAVSERVER\EPOSERVER -E -Q "SELECT tmExpirationTime FROM KAV.dbo.apphostskeys,KAV.dbo.hosts"
 tmExpirationTime
 -----------------------
 2011-11-21 23:59:59.000
 2011-11-21 23:59:59.000
 2011-11-21 23:59:59.000
 2011-11-21 23:59:59.000

(4 rows affected)

Now that looks better! To apply this to the batch file, you need to change line 105 (note the -S option which was added):

OSQL -S KAVSERVER\EPOSERVER -E -Q "SELECT %req01% FROM %req02% WHERE %req05%" > "%TMP%\dateus011.txt"

There are seven other OSQL commands, which need to be adjusted. The fastest thing is to search for "OSQL -E" and replace it by "OSQL -S KAVSERVER\EPOSERVER -E".

Now let's check the plugin again on the Nagios server:

/usr/local/nagios/libexec # ./check_nrpe -H kavserver -c check_kav -a 6 7 14
4 was unexpected at this time.

Argh... again, another problem. Let's get ready for Round 2:

Now we launch the exact same command which is used in the batch plugin (with WHERE):

C:\>OSQL -S EPO4\EPOSERVER -E -Q "SELECT tmExpirationTime FROM KAV.dbo.apphostskeys,KAV.dbo.hosts WHERE KAV.dbo.hosts.nId=KAV.dbo.apphostskeys.nIdhost AND strwinhostname='kavserver'"
 tmExpirationTime
 -----------------------
(0 rows affected)

So there's no information. Let's leave away the second WHERE input (remove AND strwinhostname='kavserver'):

C:\>OSQL -S EPO4\EPOSERVER -E -Q "SELECT tmExpirationTime FROM KAV.dbo.apphostskeys,KAV.dbo.hosts WHERE KAV.dbo.hosts.nId=KAV.dbo.apphostskeys.nIdhost"
 tmExpirationTime
 -----------------------
 2011-11-21 23:59:59.000
(1 row affected)

That looks better. Now I had to adapt the script again. This time line 89 and 90. Simply remove "AND strwinhostname='%1'" from both lines:

set req04=(SELECT %req01% FROM %req02% WHERE KAV.dbo.hosts.nId=KAV.dbo.apphostskeys.nIdhost)
set req05=KAV.dbo.hosts.nId=KAV.dbo.apphostskeys.nIdhost

Another thing we change is the handling of the created file, which uses the command findstr. Change the line 108 to the following:

FOR /F "tokens=1,* delims=:" %%i in ('findstr /n /R : "%TMP%\dateus011.txt"') do set var201=%%j

Let's check it in Nagios again:

/usr/local/nagios/libexec # ./check_nrpe -H kavserver -c check_kav -a 6 1 5
Licence has expired
KAV - Expiration Time : 21/11/2011 at 23:59:59
CRITICAL

YES! This looks good now. The expiration check finally works. It would be nice though, if the expiration date would be written in the output, right after "License has expired".
That's easy now, let's get to Round 3:

Just change line 253 to the following (I added the variable of the date after the text):

echo Licence has expired since %date_kav201%

And in Nagios again:

/usr/local/nagios/libexec # ./check_nrpe -H kavserver -c check_kav -a 6 1 5
Licence has expired since 21/11/2011
KAV - Expiration Time : 21/11/2011 at 23:59:59
CRITICAL

And you're done!

Important: The modified check_KAV.bat script can be downloaded here (link) from my website.
It contains all modifications necessary to have it working and it also contains a new parameter at the begin of the batch file:

:: Define Name of SQL Server instance
:: example: set sqlinst=KAVSERVER\KAV
:: Check manually on the KAV Server with command 'sqlcmd -L'
set sqlinst=KAVSERVER\KAV

Use this parameter 'sqlinst' to select the correct SQL server/instance.

Add a comment

Show form to leave a comment

Comments (newest first)

No comments yet.