check runs with free version, pro (former enterprise edition) tested with 2.3.x, 2.4.x, probably works on 2.5.x
No need to hazzle with OU and filters with the delivered Active Directory plugin/checks
testing of Active Directory connection from Linux client, alerts with critical if ONE of the criteria results with a failure. Requires samba-/winbind-Installation and AD-joined Linux-host.
place it in /usr/local/checkmk/local, make it executable and rediscover the host.
ad_connections.sh:
#
#!/bin/bash
# Checkmk Local Check: Active Directory Connection
# Installation: #/usr/lib/check_mk_agent/local/ad_connection_check.sh
SERVICE_NAME="AD_Connection"
STATUS=0
DETAILS=()
TIMEOUT=10
# --- wbinfo -t (Trust-Secret-Check) ---
TRUST_OUTPUT=$(timeout "$TIMEOUT" wbinfo -t 2>&1)
TRUST_RC=$?
if [[ $TRUST_RC -eq 0 ]] && echo "$TRUST_OUTPUT" | grep -qi "succeeded"; then
DETAILS+=("wbinfo -t: OK")
else
STATUS=2
# Zeilenumbrüche durch Semikolon ersetzen für Checkmk-Output
TRUST_CLEAN=$(echo "$TRUST_OUTPUT" | tr '\n' ';' | sed 's/;$//')
DETAILS+=("wbinfo -t: FAILED (rc=$TRUST_RC: $TRUST_CLEAN)")
fi
# --- wbinfo --ping-dc (Domain-Controller-Ping) ---
PINGDC_OUTPUT=$(timeout "$TIMEOUT" wbinfo --ping-dc 2>&1)
PINGDC_RC=$?
if [[ $PINGDC_RC -eq 0 ]] && echo "$PINGDC_OUTPUT" | grep -qi "succeeded\|is alive"; then
DETAILS+=("wbinfo --ping-dc: OK")
else
STATUS=2
PINGDC_CLEAN=$(echo "$PINGDC_OUTPUT" | tr '\n' ';' | sed 's/;$//')
DETAILS+=("wbinfo --ping-dc: FAILED (rc=$PINGDC_RC: $PINGDC_CLEAN)")
fi
# --- Checkmk Local Check Output ---
# Format: <status> <service_name> <perfdata> <details>
DETAIL_STRING=$(IFS=', '; echo "${DETAILS[*]}")
echo "${STATUS} ${SERVICE_NAME} - ${DETAIL_STRING}"