2

Running a Mac mini with server app. (El Capitan 10.11.4 & Server.app 5.1)

Installed Xcode, brew, and nrpe via brew. Works fine as such. It's not sensible to have to remote desktop to it and log in just to get monitoring up and running. Given that FileVault is active logging in automatically is not an option.

How do I make nrpe start if the machine gets rebooted without interaction?

EDIT1: OK, couldn't find an easy way to make this work; so I disabled filevault after a brief discussion with the team. But on boot (and with an automatic login) nrpe still doesn't start automatically ...

  • Are you looking for help using a tool like LaunchCenter to make a plist to have launchd run the job or just instructions to set a script file to run as a startup item and have a user log in to the Mac when it boots and then lock the screen? – bmike Apr 18 '16 at 20:09
  • Hi @bmike, nrpe installs a plist, so it's just the launch. Since the box has a FileVault keychain set automated logins aren't possible. – tink Apr 18 '16 at 20:18
  • Aah. So you need to modify the startup script to read the password from the security binary and store things there or otherwise automate things with expect ? – bmike Apr 18 '16 at 20:19
  • Heh @bmike; I don't know what I need to know about MacOS/X. In Linux land (my home ;}) services (demons) work just fine w/o anyone having to log in or having to start things using a password. Seems to be possible on MacOS/X, too, e.g. seeing as I can ssh to the thing w/o prior human interaction after a reboot. – tink Apr 18 '16 at 20:22
1

Citing http://launchd.info:

  1. ~/Library/LaunchAgents and /Library/LaunchAgents are used for the currently logged in user.
  2. /Library/LaunchDaemons is for running things as root ( or the user specified with the UserName key) when the machine boots.

The key (no pun intended), however, is that plists placed in /Library/LaunchDaemons/ must be owned by root:wheel and should be chmod 644.

So, just because nrpe creates a plist does not mean that it will run on boot without login.

I installed it via brew myself, and at the end it says:

To have launchd start nrpe at login:
  ln -sfv /usr/local/opt/nrpe/*.plist ~/Library/LaunchAgents
Then to load nrpe now:
  launchctl load ~/Library/LaunchAgents/homebrew.mxcl.nrpe.plist

I would recommend that you do this, instead:

chmod 644 /usr/local/opt/nrpe/homebrew.mxcl.nrpe.plist

sudo chown root:wheel /usr/local/opt/nrpe/homebrew.mxcl.nrpe.plist

sudo ln /usr/local/opt/nrpe/homebrew.mxcl.nrpe.plist /Library/LaunchDaemons/homebrew.mxcl.nrpe.plist

The first line makes sure that the permissions are correct.

The second line makes sure that the ownership is correct

The third/last line links the file from /usr/local/opt/nrpe/ to /Library/LaunchDaemons (note the absence of a ~ which is intentional).

Then you need to make sure that the file does not exist in ~/LaunchAgents, which would be confusing:

rm -f "$HOME/Library/LaunchAgents/homebrew.mxcl.nrpe.plist"

That will delete the file (if it exists).

Important

By placing the file in /Library/LaunchDaemons you will be telling nrpe to run as root. That may be OK, or it may be a very bad idea. I don't know the answer to that question. However, to be safe I would make it explicitly run as a user other than root unless I was absolutely sure. Also, I would use launchd's ability to log errors to see if it is running OK.

To do this you will need to edit the plist mentioned above. Here is the file as it is originally created, as of 2016/04/20:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>
  <string>org.nrpe.agent</string>
  <key>ProgramArguments</key>
  <array>
    <string>/usr/local/bin/nrpe</string>
    <string>-c</string>
    <string>/usr/local/etc/nrpe.cfg</string>
    <string>-d</string>
  </array>
  <key>RunAtLoad</key>
  <true/>
  <key>ServiceDescription</key>
  <string>Homebrew NRPE Agent</string>
  <key>Debug</key>
  <true/>
</dict>
</plist>

and here is the version that I would recommend:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Debug</key>
    <true/>
    <key>GroupName</key>
    <string>staff</string>
    <key>InitGroups</key>
    <true/>
    <key>Label</key>
    <string>org.nrpe.agent</string>
    <key>ProgramArguments</key>
    <array>
        <string>/usr/local/bin/nrpe</string>
        <string>-c</string>
        <string>/usr/local/etc/nrpe.cfg</string>
        <string>-d</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
    <key>ServiceDescription</key>
    <string>Homebrew NRPE Agent</string>
    <key>StandardErrorPath</key>
    <string>/tmp/org.nrpe.agent.stderr.log</string>
    <key>StandardOutPath</key>
    <string>/tmp/org.nrpe.agent.stdout.log</string>
    <key>UserName</key>
    <string>INSERTUSERNAMEHERE</string>
</dict>
</plist>

Replace INSERTUSERNAMEHERE with the actual username of the user that you want nrpe to run as.

Deprecated

Note that according to LaunchControl (which is the best app out there for managing launchd plists) the Debug key is deprecated for OS X 10.10 and will be ignored.

Reboot

Once you have the file in place, the best way to test it will be to reboot the system and do NOT log in on console. Instead, after the boot process is complete, log in via ssh and make sure that the process is running, and check the two log files to see what, if anything, you see there.

I hope this helps.

ps - spend $10 on LaunchControl. It's a great app. There is no registration code so you don't have to pay for it, but you should because the developer trusts you to if you use the app.

  • thank you very much; I had done the move and link prior to this post, but autostart kept failing on boot. With the modified plist everything is hunky-dory. :} – tink Apr 20 '16 at 21:02
  • Glad to hear it – TJ Luoma Apr 25 '16 at 9:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .