Monitor Windows via WMI from Cacti on Linux

[claymen]

WMI + Cacti + Linux...

I've used the cacti plugin and i've looked at a few alternatives and nothing really fit the bill for our monitoring at work. So after some stuffing about i've put together a package of bits and pieces which we now use to monitor a number of statistics on our windows servers from our linux cacti server.

The images below are examples of what I have and I can easily add more without any trouble. Apologies for the size of the images (dimension wise) as I have wide screen monitors at work and home

The current "release" so to speak is via SVN repository which you can grab here http://svn.parkingdenied.com/CactiWMI/tags/ or alternatively grab the attached zip file which should include everything you need minus the wmic binary which you can grab from the latest debian package wmi-client. Newer releases can be found throughout this thread or alternatively by grabbing a release from the tags section of SVN.

The following instructions are now defunct. Please see the included readme which is included in each release.

Extract the wmi.php and wmi-logins.php file to your cacti scripts folder.

Open the wmi-logins.php file and add in your own credential. Rather than use a username/password specified in cacti I use a simple reference to the credential which makes adding a lot of data sources much faster and also means you don't see your passwords spammed throughout the cacti log file.

So simply update the line with another like the following and also update the data templates if you don't want to use the default one I have been using during testing which was credential...

Code: Select all

$logins['cacti'] = array('Domain/Username','Password');

Now by default the wmi.php script looks for the wmi-logins.php file in the same location as itself which should be your scripts folder. You will need to update this if you wish to separate these and it can be done by editing the line below in the wmi.php file.

Code: Select all

include('/path/to/wmi-logins.php');

Now you will need to make sure your windows hosts allow remote WMI queries from the credential you use, you can find this info on MSDN as I don't have it on hand but can dig it up if need be. Alternatively if you want to live dangerously you can use an admin credential.

Now that that's done you should be able to add in the templates which are in the attached zip file and start graphing your hosts. I've tried to make these as simple as possible but if you do have any issues check the paths to things and make sure its all ok and also check your poller cache and try running exactly what cacti would be running to confirm you get output.

Have fun!

Bugtracker: http://mantis.parkingdenied.com
Latest SVN: http://svn.parkingdenied.com/CactiWMI/trunk

Memory Usage

Disk Space

Disk I/O

CPU Usage (1,2,4 and 8 core tested)

SQL Performance

NTDS LDAP Connections

NTDS LDAP Performance

NTDS DS Performance

NTDS Auth Performance


Merry Christmas!

http://www.parkingdenied.com

[camaya]

Hello Claymen,

your script works fine at command line but cacti does not graph any data.

What would I'm missing in cacti configuration?

I'm using Script/Command as input type.

Thanks in advance for your help.

Cacti is getting these warnings referring to my win xp pc and your data source template:
12/29/2008 01:20:04 AM - CMDPHP: Poller[0] Host[3] DS[12] WARNING: Result from CMD not valid. Partial Result:
12/29/2008 01:20:04 AM - CMDPHP: Poller[0] Host[3] DS[11] WARNING: Result from CMD not valid. Partial Result:
12/29/2008 01:20:04 AM - CMDPHP: Poller[0] Host[3] DS[10] WARNING: Result from CMD not valid. Partial Result:
12/29/2008 01:20:03 AM - CMDPHP: Poller[0] Host[3] DS[9] WARNING: Result from CMD not valid. Partial Result:
12/29/2008 01:20:03 AM - CMDPHP: Poller[0] Host[3] DS[8] WARNING: Result from CMD not valid. Partial Result:

[claymen]

Whats your cacti output look like at the time its being polled?

A few things to try anyway would be to ensure that the paths are correct and if needed set the path to wmi-logins.php within wmi.php rather than let it assume its location. I've seen this trip up one cacti install but work on another.

Additionally try taking what the poller cache is running and run that exactly from the command line, see if that's ok as I know you said it works from command line but was this exactly what was shown in the poller cache.

And one last thing are you running spine or cmd.php?

[camaya]

I'm not quite sure whether I understand your first question, I'm a beginner at cacti. I attached an image anyway.

I changed the path of wmi-logins.php in wmi.php like this include('/usr/share/cacti/site/scripts/wmi-logins.php');
but still does not work.

the command #/usr/bin/rrdtool create /var/lib/cacti/rra/mi_pc_cpu0_9.rrd --step 300 DS:CPU0:GAUGE:600:0:100 DS:Total:GAUGE:600:0:100 RRA:AVERAGE:0.5:1:500 RRA:AVERAGE:0.5:1:600 RRA:AVERAGE:0.5:6:700 RRA:AVERAGE:0.5:24:775 RRA:AVERAGE:0.5:288:797 RRA:MAX:0.5:1:500 RRA:MAX:0.5:1:600 RRA:MAX:0.5:6:700 RRA:MAX:0.5:24:775 RRA:MAX:0.5:288:797
does not return nothing at command line. no error.

I'm not using spine but cmd.php

Thanks for your time.

[claymen]

Whats your poller cache look like, what exactly is it trying to execute? If you execute the same thing from the command line does it return results?

For example you should have something like this in your poller cache.

Code: Select all

Script: /usr/bin/php -q /tmp/wmi.php xx.xx.xx.xx credential Win32_PerfRawData_PerfDisk_LogicalDisk DiskWritesPersec,DiskWriteBytesPersec,DiskReadsPersec,DiskReadBytesPersec,CurrentDiskQueueLength Name C\:

And it should return something like this when run from the command line

Code: Select all

CurrentDiskQueueLength:0 DiskReadBytesPersec:167366015488 DiskReadsPersec:15149498 DiskWriteBytesPersec:600825942016 DiskWritesPersec:12386212 Name:C

Is this what you are seeing?

Also one last thing, make sure when specifying the drive letter that you escape the colon. E.g. C: is C\: because else either cacti or bash will misinterpret things.

[zag]

Hello,
i have same problem.

I execute this command for disk I/O:

Code: Select all

/usr/bin/php -q /usr/share/cacti/site/scripts/wmi.php XX.XX.XX.XX credential Win32_PerfRawData_PerfDisk_LogicalDisk DiskWritesPersec,DiskWriteBytesPersec,DiskReadsPersec,DiskReadBytesPersec,CurrentDiskQueueLength Name C\:

and the result is:

Code: Select all

CurrentDiskQueueLength:0 DiskReadBytesPersec:2926962176 DiskReadsPersec:647225 DiskWriteBytesPersec:10396928512 DiskWritesPersec:1850073 Name:C

which is correct but the graph is empty. all values = "nan"

this line is from cacti log and is for disk I/O:

Code: Select all

12/30/2008 02:50:04 PM - CMDPHP: Poller[0] Host[6] DS[399] WARNING: Result from CMD not valid. Partial Result: 

Give me please some hints where is the problem?

Only the graph for "Available Disk Space (WMI)" start to work ok but after that stop again.
All others are empty, and "Windows - Memory Usage (WMI)" is even without a graph.

Code: Select all

command for Windows - Memory Usage (WMI):
/usr/bin/php -q /usr/share/cacti/site/scripts/wmi.php XX.XX.XX.XX credential Win32_PerfRawData_PerfOS_Memory CommittedBytes,AvailableBytes,CommitLimit

result:

Code: Select all

AvailableBytes:1555779584 CommitLimit:4141809664 CommittedBytes:436682752

in my opinion this result is ok but still no graph.

few hints from me:
in wmi-login.php replace "cacti" with "credential" or just change the name of credential with cacti when you create the graph in the last window.

[claymen]

It sounds almost like an issue within the environment that is calling the script. Especially when it works without any issues when run from the cmd line by a regular shell user.

Are the rrd files being written to? e.g. is the data at least being stored?

Can I get a bit more info about your environment. Such as Cacti, Spine/Cactid, PHP and wmic versions?

[zag]

yes. all rrd files are created.

Ubuntu server 8.10 / kernel 2.6.27-7
Apache Version Apache/2.2.9 (Ubuntu)
PHP 5.2.6-2ubuntu4 with Suhosin-Patch 0.9.6.2
Cacti Version 0.8.7b
SNMP Version net-snmp Version 5.4.1
RRDTool Version RRDTool 1.2.27
vmic - Version 4.0.0tp4-SVN-build-UNKNOWN

Poller Information
Type cmd.php

if you need some additional info go ahead.

This is a wonderful tool and i want to use it. Many thanks for the help.

[camaya]

Good news!!! It works. What I did was to change my credentials name in wmi-logins.php to credential, add the

Code: Select all

\:

where needed.

Zag, make sure you have disabled the debug mode in wmi.php.

Thank you both.

[camaya]

Now I'm having another issue with the Memory Usage template. The data is not being graphed.

again, what would I be doing wrong?

Thanks!

[claymen]

Now I'm having another issue with the Memory Usage template. The data is not being graphed.

again, what would I be doing wrong?

Thanks!

Whats it give you from the cmd line any results at all?

[camaya]

Now I'm having another issue with the Memory Usage template. The data is not being graphed.

again, what would I be doing wrong?

Thanks!

Whats it give you from the cmd line any results at all?

[camaya]

RRDTool Command:

Code: Select all

/usr/bin/rrdtool graph - \
--imgformat=PNG \
--start=-86400 \
--end=-300 \
--title="mi pc - Memory Usage" \
--base=1024 \
--height=120 \
--width=500 \
--alt-autoscale-max \
--lower-limit=0 \
--vertical-label="bytes" \
--slope-mode \
--font TITLE:12: \
--font AXIS:8: \
--font LEGEND:10: \
--font UNIT:8: \
DEF:a="/var/lib/cacti/rra/mi_pc_committedbytes_25.rrd":CommitLimit:AVERAGE \
DEF:b="/var/lib/cacti/rra/mi_pc_committedbytes_25.rrd":CommitLimit:MAX \
DEF:c="/var/lib/cacti/rra/mi_pc_totalphysicalmemory_26.rrd":TotalPhysicalMemory:AVERAGE \
DEF:d="/var/lib/cacti/rra/mi_pc_totalphysicalmemory_26.rrd":TotalPhysicalMemory:MAX \
DEF:e="/var/lib/cacti/rra/mi_pc_committedbytes_25.rrd":AvailableBytes:AVERAGE \
DEF:f="/var/lib/cacti/rra/mi_pc_committedbytes_25.rrd":AvailableBytes:MAX \
DEF:g="/var/lib/cacti/rra/mi_pc_committedbytes_25.rrd":CommittedBytes:AVERAGE \
DEF:h="/var/lib/cacti/rra/mi_pc_committedbytes_25.rrd":CommittedBytes:MAX \
CDEF:cdefi=e,i,- \
CDEF:cdefbb=e,i,- \
AREA:a#562B29FF:"Commit Limit\:"  \
GPRINT:a:LAST:"  Current\:%8.2lf %s"  \
GPRINT:a:AVERAGE:"Average\:%8.2lf %s"  \
GPRINT:b:MAX:"Maximum\:%8.2lf %s\n"  \
AREA:c#FF5700FF:"Total RAM\:"  \
GPRINT:c:LAST:"     Current\:%8.2lf %s"  \
GPRINT:c:AVERAGE:"Average\:%8.2lf %s"  \
GPRINT:d:MAX:"Maximum\:%8.2lf %s\n"  \
AREA:cdefi#8F005CFF:"Used RAM\:"  \
GPRINT:cdefi:LAST:"      Current\:%8.2lf %s"  \
GPRINT:cdefi:AVERAGE:"Average\:%8.2lf %s"  \
GPRINT:cdefbb:MAX:"Maximum\:%8.2lf %s\n"  \
LINE2:g#FFFF00FF:"Commited Bytes\:"  \
GPRINT:g:LAST:"Current\:%8.2lf %s"  \
GPRINT:g:AVERAGE:"Average\:%8.2lf %s"  \
GPRINT:h:MAX:"Maximum\:%8.2lf %s\n"

RRDTool Says:

Code: Select all

ERROR: invalid rpn expression in: e,i,-

[claymen]

Ahh the CDEF is wrong. I've seen this before when moving between Cacti 0.7.8 and 0.7.8b.

You'll need to update the CDEF to suit as it normally is used to calculate one of the memory values. From off the top of my head it'l need to be updated to take the available bytes from the total memory to work out the currently used memory. Update your CDEF to suit it and you should be sweet.

[llow]

I've been using Pegasus and wbemcli but would like to switch to wmic. I am running into a few problems though trying to configure the windows servers.

I'm tacking Windows 2003 first and if I add the user to the group Administrators it works fine.

If I try and set it up more restrictive but after a 3-4 second delay I get
NTLMLogin: struct NTLMLogin
out: struct NTLMLogin
ORPCthat : *
ORPCthat: struct ORPCTHAT
flags : 0x00000000 (0)
extensions : NULL
ppNamespace : *
ppNamespace : NULL
result : DOS code 0x80041003
ERROR: Login to remote object.
NTSTATUS: NT code 0xc0001003 - NT code 0xc0001003

which equates to WBEM_E_ACCESS_DENIED.

I have added the user to COM Security with full permissions which fixed getting an RPC deny error before. I have also gave the user full permissions to the root of WMI.

Any ideas how to configure this properly? I can only guess it maybe the WMI components are requiring encryption which is causing the deny.