Check_MK Agent 2.1.0p28 False Detection for PostgreSQL Database

[scotsie (Scott Crace)]

CMK version: 2.1.0p28
OS version: CentOS 7 (checkmk server), CentOS 7 (monitored host)

Error message:
No error other than detecting a non-existent postgreSQL instance and alarming about MAIN not running.

Background
This server wasn’t using the agent (SNMP only) even though it was installed. While reviewing the agent updater, I noticed this and modified the host configuration to use API and Check_MK agent.
Rescan and discovery showed postgres but there is no postgreSQL service

A local investigation for this server shows it is a logstash server which has a subfolder containing patterns for grok filters with ‘postgres’ being one of the folders but otherwise no old postgreSQL processes or services disabled, etc.

We are deploying the postgreSQL plugin to all agents to allow it to detect undocumented postgresql instances.
I understand as a workaround I can exclude this single server using an ignore section rule explicitly defining this host. For the short term, I have manually disabled the services as seen in the screenshot above.
This is more to report a potential issue with the plug-in logic or to isolate what might be causing a false positive on this particular server and potential cleanup.
.
Output of “cmk --debug -vvn hostname”: (If it is a problem with checks or plugins)

Section output from Check_MK server

<<<postgres_instances>>> / Transition HostSectionParser -> HostSectionParser
<<<postgres_stat_database:sep(59)>>> / Transition HostSectionParser -> HostSectionParser
<<<postgres_version:sep(1)>>> / Transition HostSectionParser -> HostSectionParser
<<<postgres_conn_time>>> / Transition HostSectionParser -> HostSectionParser

Section output from localhost (elk01-ls01) plugins

/usr/lib/check_mk_agent/plugins/mk_postgres.py

WARNING 2023-06-16 11:39:43 __main__: Could not determine postgres user, using "postgres" as default
which: no psql in (/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin)
su: user postgres does not exist
su: user postgres does not exist
su: user postgres does not exist
su: user postgres does not exist
<<<postgres_instances>>>
[[[main]]]

<<<postgres_stat_database:sep(59)>>>
[[[main]]]

<<<postgres_version:sep(1)>>>
[[[main]]]

<<<postgres_conn_time>>>
[[[main]]]
0.002

/usr/lib/check_mk_agent/plugins/mk_postgres_2.py

WARNING 2023-06-16 11:40:01 __main__: Could not determine postgres user, using "postgres" as default
which: no psql in (/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin)
su: user postgres does not exist
su: user postgres does not exist
<<<postgres_instances>>>
[[[main]]]

su: user postgres does not exist
<<<postgres_stat_database:sep(59)>>>
[[[main]]]

su: user postgres does not exist
<<<postgres_version:sep(1)>>>
[[[main]]]

<<<postgres_conn_time>>>
[[[main]]]
0.003

Sincerely,
Scotsie

[scotsie (Scott Crace)]

As a follow up, I am seeing some other agent based hosts reporting these missing services including a cleanly installed rhel7 instance I just created and put the agent on.

Scotsie

[r.sander (Robert Sander)]

@scotsie

We are deploying the postgreSQL plugin to all agents to allow it to detect undocumented postgresql instances.

The agent plugin mk_postgres does not support finding undocumented instances. It assumes that at least a main instance should be running and is accessible via the postgres user.

If you want to “scan” for undocumented PostgreSQL instances you should use the “Process Discovery” ruleset. Create a regex that finds running databases in the process list. You could even let checkmk set a label when PostgreSQL has been found and then deploy the agent plugin based on the label via agent bakery.

[scotsie (Scott Crace)]

@r.sander

The agent plugin mk_postgres does not support finding undocumented instances. It assumes that at least a main instance should be running and is accessible via the postgres user.

Ahh, that was an assumption on my part then. The older agent/plugin seemed to behave that way as it was deployed to every host but seemed to only add the services on hosts with postgresql actually running.

@r.sander

If you want to “scan” for undocumented PostgreSQL instances you should use the “Process Discovery” ruleset. Create a regex that finds running databases in the process list. You could even let checkmk set a label when PostgreSQL has been found and then deploy the agent plugin based on the label via agent bakery.

This worked great and I will be making more use of this instead of some convoluted rules I have been using. I had honestly overlooked the checkbox in the process discovery list rules portion because I thought it would behave more like the conditions section. Marking your response as the answer and thank you for your time.

Sincerely,
Scotsie

[scotsie (Scott Crace)]

@r.sander,
Just watched your presentation in Checkmk #9 Day 2. Well done and I appreciate your contributions, plugins and responses in these forums as well.

Sincerely,
Scotsie