Launchd with keepalive is restarting already running daemon

Question

I'm trying to start the Nagios nrpe daemon via launchd and want to use the keepalive feature. However, as soon as I load the plist with launchctl, launchd keeps starting the daemon every 10 seconds although it is already running.
Here's the .plist I'm using:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>KeepAlive</key>
<true/>
<key>Label</key>
<string>org.nagios.nrpe</string>
<key>UserName</key>
<string>nagios</string>
<key>ProgramArguments</key>
<array>
<string>/usr/sbin/nrpe</string>
<string>-c</string>
<string>/etc/nagios/nrpe.cfg</string>
<string>-d</string>
</array>
</dict>
</plist>
And this is from the system.log:
12:37:25 com.apple.launchd[1] (org.nagios.nrpe): Throttling respawn: Will start in 10 seconds
12:37:25 nrpe[1269]: Starting up daemon
12:37:35 com.apple.launchd[1] (org.nagios.nrpe): Throttling respawn: Will start in 10 seconds
12:37:35 nrpe[1272]: Starting up daemon
12:37:35 nrpe[1272]: There's already an NRPE server running (PID 1269). Bailing out...
Any ideas?

Answer 1

I've struggled a bit with getting this running on 10.5.5 server but this is what I found.
Using the "-d" argument to run nrpe as a standalone daemon may be causing the respawn. I would suggest changing that to "-i" which is to run it as a service under inetd or xinetd. This seems to be working even though it is really running under launchd. Attempting to run it with no argument does not allow connections, it may not even be starting.
I also could not get the nagios server (debian) to talk to the OS X server. It kept giving me the following error:
CHECK_NRPE: Error - Could not complete SSL handshake.
I added the -n argument to tell it to not use SSL, and it now works. This is what the plist looks like:
<dict>
        <key>KeepAlive</key>
        <dict>
                <key>NetworkState</key>
                <true/>
        </dict>
        <key>Label</key>
        <string>org.nagios.nrpe;/string>
        <key>Program</key>
        <string>/usr/local/nagios/bin/nrpe</string>
        <key>ProgramArguments</key>
        <array>
                <string>-n</string>
                <string>-c</string>
                <string>/usr/local/nagios/etc/nrpe.cfg;/string>
                <string>-i</string>
        </array>
        <key>Sockets</key>
        <dict>
                <key>Listeners</key>
                <dict>
                        <key>SockServiceName</key>
                        <string>5666</string>
                        <key>SockType</key>
                        <string>stream</string>
                        <key>SockFamily</key>
                        <string>IPv4</string>
                </dict>
        </dict>
        <key>UserName</key>
        <string>nagios</string>
        <key>GroupName</key>
        <string>nagios</string>
        <key>inetdCompatibility</key>
        <dict>
                <key>Wait</key>
                <false/>
        </dict>
</dict>
</plist>
If you want to check whether the nrpe application is running and listening you can telnet to the machine on port 5666. If it just drops the connection, something is not right. If it leaves the connection open once connected you should be good.
Disclaimer: Running nrpe without SSL sends all of your data unencrypted. Depending on your environment, and the data moving back and forth, you should approach this carefully.
Hope that helps.