Default localhost ping check fails

[jjethwa]

Default localhost ping check fails

[bebehei]

The image is working correct:

[bebe:~] 1 % docker run --pull --rm -ti --entrypoint /bin/bash jordan/icinga2
root@6282c151c20d:/# sudo -u nagios ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=122 time=16.9 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=122 time=16.4 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=122 time=16.0 ms
^C
--- 8.8.8.8 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2002ms
rtt min/avg/max/mdev = 16.059/16.480/16.926/0.384 ms
root@6282c151c20d:/# ls -la /bin/ping
-rwsr-sr-x 1 root root 61240 Nov 10  2016 /bin/ping

Please verify, that your ping executable has got +s permissions. If it lacks them, you have to check your docker host filesystem. It may be, that setuid isn't allowed there.

I had the same CRITICAL error message. Docker Host: Debian GNU/Linux 8 (jessie) with Linux 3.16.0-4-amd64 on a Hyper-V-Host. chmod u+s /bin/ping and chmod u+s /bin/ping6 solved the problem.

[jjethwa]

Hi @tfohlmeister

Sorry about missing the comment on Docker Hub. I don't get notifications for comments so I usually miss them.

What version of the container are you using? The only two checks that should fail with the default setup is the SSH and swap check.

[tfohlmeister]

No worries! I am running the latest container version on Docker 1.6.2.
SSH fails as expected, swap check is fine. Because the ping check fails, it marks the whole host as down though.
Do you have any idea how to debug this issue?

[tfohlmeister]

By the way, the IPv6 check fails as well:
/bin/ping6 -n -U -w 10 -c 5 ::​1
Output: CRITICAL - Could not interpret output from ping command
As there seems to be an error, is there any way to look up the output of the above command as seen by Icinga?

[jjethwa]

Hi @tfohlmeister

That's strange. You should be able to see it in the icinga2.log under /var/logs/icinga2
I'll run some more tests tomorrow with the version of docker you're using so I can (hopefully) reproduce the issue

[bebehei]

We had a similar issue while upgrading from ubuntu 14.04 to 16.04, but I don't remember the correct fix.

[jjethwa]

Hi @tfohlmeister

I can't reproduce this issue still 😞

Do you mind running this inside the container and see if it works?

chmod u+s /bin/ping 

[tfohlmeister]

Thanks for your suggestions! I tested further and can't reproduce the error on my OSX docker host either.
I also realized that the docker container on my original host (which is a Synology DSM NAS) can't establish network connections at all (so no internet access). It's really weird. Still, as this seems to be a host specific problem, I will close the issue here.

[tfohlmeister]

Thanks @nbickel - that fixed it for me as well!

[jjethwa]

Thanks @nbickel

Changes are in: f006814

[martinhjartmyr]

Hi @jjethwa, I'm testing this image (jordan/icinga2:latest) in Kubernetes v1.11.6.
I have the exact same problem.

Plugin Output
/bin/ping -n -U -w 30 -c 5 127.0.0.1
CRITICAL - Could not interpret output from ping command

Running ping as root in the container works. But when I try running it as the user 'nagios' (which i guess icinga is using) I get the following error:

root@icinga-568cbffdc7-dbd5t:/# sudo -u nagios /bin/ping www.google.com
ping: socket: Operation not permitted

I tried to manually chmod u+s /bin/ping and chmod u+s /bin/ping6 but no luck there.

[martinhjartmyr]

Thank you @bebehei.

I solved it with adding the following to my deployment in kubernetes:

securityContext:
allowPrivilegeEscalation: true