Nagios check_http.c Patch to Display Result Page Snippet

Here’s a minor change to the nagios plugin check_http.c that shows the first 128 bytes of the page body if the -s match option is used:

  /* check elapsed time */
  if (strlen(string_expect) && strlen(page)) {
#define MAX_BUFFER_PAGE_SAMPLE 128
     char s[MAX_BUFFER_PAGE_SAMPLE];
     strncpy(s, page, MAX_BUFFER_PAGE_SAMPLE);
     s[MAX_BUFFER_PAGE_SAMPLE-1] = 0;
     /* Need to strip JavaScript here to prevent XSS */
     strip_xss(s);
     strip(s);

     asprintf (&msg,
            _("%s - %d bytes in %.3f second response time %s%s|%s %s"),
            msg, page_len, elapsed_time,
            (display_html ? "" : ""), s,
            perfd_time (elapsed_time), perfd_size (page_len));
  }
  else {
     asprintf (&msg,
            _("%s - %d bytes in %.3f second response time %s|%s %s"),
            msg, page_len, elapsed_time,
            (display_html ? "" : ""),
            perfd_time (elapsed_time), perfd_size (page_len));
  }

void
strip_xss (char *t)
{
   char *s;

   for (s=t;*t;*t++) {
       if (*t == ' ' ||
           *t == '.' ||
           *t == '-' ||
           *t == '\'' ||
           *t == ':' ||
           *t == ',' ||
           *t == '/' ||
           isalnum(*t)) {
          *s++ = *t;
       }
   }
   *s = 0;
}

Then you can use the usual Nagios check_http command with the -s option:

# 'check_http_str' command definition with options:
# -u URI without leading scheme and hostname
# -s "string" to match
# -M seconds is max acceptable age of page
# -L $HOSTADDRESS$ makes it a hyperlink to source page

define command{
        command_name    check_http_str
        command_line    $USER1$/check_http -I $HOSTADDRESS$ -u "$ARG1$" -s "$ARG2$" -M $ARG3$
        }

The result looks like:

HTTP OK: HTTP/1.1 200 OK - 377 bytes in 0.163 second response time
OK - System: 'PowerEdge 2950', SN: 'N1234', hardware working fine,
11 logical drives, 51 physical drives

The improved status display allows me to more easily use HTTP for remote nagios monitoring, instead of NRPE. Almost worth dropping into C for.