NTFS Permissions Tip

[tymbow]

We ran into a problem with the CPU and disk scripts not working on a Windows Cacti box and thought I'd share the solution.

We normally install Cacti (and other applications) on a different partition to the system partition (say D:). We are also in the habit of changing the default NTFS permissions on the root of the D: partition such that by default only Administrators and System have access (Full Control in this case). The reason we do this is to ensure that by default any newly created files are only accessible to admins and the system. This forces us to ensure anything placed on the D: partition is given the explicit NTFS permissions it needs. It can be a pain in the arse, but it means that my default any new file is protected (in a sense).

After installing a new Cacti server today, we could not get the CPU and DISK scripts to run on the local server - they always returned 0 Items, 0 Rows. As it turns out, the tight NTFS permissions on D: were stopping Cacti, which does not run with Administrator permissions from creating the D:\USR folder and files that seem to be part of PHP SNMP. Once we created the folder and gave the Cacti account change permissions on it all was OK.

In case your wondering the accounts that need access are whatever account IIS runs under (e.g. Network Service) and what ever account you run the poller with.

Hope this is useful to someone.

[BSOD2600]

Did you read my installation guide / FAQ? If so, what things would make this more clear?

You eventually figure out the permissions/directory needs with the help of Sysinternal Process monitor? Odd that the net-snmp directory was the issue, since cacti shouldn't need net-snmp anything for v1 and v2 snmp queries.

[tymbow]

Yeah I've read your guide - it's good. I've installed quite a few Cacti systems so I'm comfortable with what I'm doing. We just complicate things because we tighten NTFS permissions down so much which means we have to be meticulous during installs.

Yes I used Filemon - gotta love the Sysinternals tools.

No it's not NET-SNMP, I only use PHPs inbuilt SNMP.

It's been a while since I installed a Cacti box and I admit I had forgotten about the USR directories. Maybe I had been in the habit of creating them and assigning correct permissions before I ran Cacti? I can't remember.

Regarding your guide, it might be worth highlighting that if you want to run the Win32 native version of RRDTool don't use 1.2.28 because it still seems to be broken with regard to fonts. I've seen a few posts with font issues (and your replies) and this seems to be a common problem.

[BSOD2600]

Updated the install guide with the rrdtool version info stuff.

I'll have to play around on my test install with that USR directory...

[tymbow]

I may have spoke too soon about RRDTool 1.2.28. It is bugged, but it can be used.

If you just update the default font in the "Settings > Path" tab, then yes there is the problem with the fonts due to the known bug in this build. However, if you specify the paths for the Title, Legend, Axis and Units on the "Settings > Visual" tab then it works.

So 1.2.28 can be used with a few little changes. Now on to 3.4...