[Pkg-nagios-devel] Bug#860802: nagios-nrpe-server: nrpe daemon doesn't log client IP address

[Ralf G. R. Bergs]

Package: nagios-nrpe-server
Version: 2.15-1
Severity: wishlist

Dear Maintainer,

I'm seeing scans from hosts on the internet like follows:

2017-04-17T06:27:33.100900+00:00 myhost nrpe[7751]: Error: Request packet type/version was invalid!
2017-04-17T06:27:33.100902+00:00 myhost nrpe[7751]: Client request was invalid, bailing out...

It would be very important to see the client's address, so that you can tell whether it's "hammering" by a single IP, or a distributed scan, and to also block these IPs.

Thanks for considering to include this in a future version.

Kr,

Ralf


-- System Information:
Debian Release: 8.7
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 3.16.0-4-amd64 (SMP w/8 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: sysvinit (via /sbin/init)

Versions of packages nagios-nrpe-server depends on:
ii  adduser      3.113+nmu3
ii  libc6        2.19-18+deb8u7
ii  libssl1.0.0  1.0.1t-1+deb8u6
ii  libwrap0     7.6.q-25
ii  lsb-base     4.1+Debian13+nmu1

Versions of packages nagios-nrpe-server recommends:
ii  nagios-plugins        2.1.1-1
ii  nagios-plugins-basic  2.1.1-1

nagios-nrpe-server suggests no packages.

-- Configuration Files:
/etc/nagios/nrpe.cfg changed [not included]
/etc/nagios/nrpe_local.cfg changed [not included]

-- no debconf information