Monitor Windows via WMI from Cacti on Linux

[claymen]

What class were you trying to query. What I found was that to use a restricted user you needed to also grant it access to the perfmon counters as well as it seems to pass the credential through. E.g. it needed access to remote query WMI (through the com settings) then it needed permission to query the correct root then it also needed access to subsystem which WMI is querying.

Try adding the user to the performance monitor/logging groups which should be builtin to 2003. This is what we are doing to grant it access without it being an admin.

[camaya]

Ahh the CDEF is wrong. I've seen this before when moving between Cacti 0.7.8 and 0.7.8b.

You'll need to update the CDEF to suit as it normally is used to calculate one of the memory values. From off the top of my head it'l need to be updated to take the available bytes from the total memory to work out the currently used memory. Update your CDEF to suit it and you should be sweet.

Please point me how can I do this. Should I downgrade cacti installation?

[claymen]

Please point me how can I do this. Should I downgrade cacti installation?

No you simply need to update the CDEF used by the graph template to reference the correct values.

For example here is what the debug output of my graph looks like for disk space.

Code: Select all

/usr/bin/rrdtool graph - \
--imgformat=PNG \
--start=-86400 \
--end=-300 \
--title="Server - Available Disk Space - H" \
--rigid \
--base=1024 \
--height=120 \
--width=500 \
--alt-autoscale-max \
--lower-limit=0 \
--vertical-label="bytes" \
--slope-mode \
--font TITLE:8: \
--font AXIS:8: \
--font LEGEND:8: \
--font UNIT:8: \
DEF:a="/var/www/cacti/rra/server_freespace_19584.rrd":Size:AVERAGE \
DEF:b="/var/www/cacti/rra/server_freespace_19584.rrd":Size:LAST \
DEF:c="/var/www/cacti/rra/server_freespace_19584.rrd":Size:MIN \
DEF:d="/var/www/cacti/rra/server_freespace_19584.rrd":Size:MAX \
DEF:e="/var/www/cacti/rra/server_freespace_19584.rrd":FreeSpace:AVERAGE \
DEF:f="/var/www/cacti/rra/server_freespace_19584.rrd":FreeSpace:LAST \
DEF:g="/var/www/cacti/rra/server_freespace_19584.rrd":FreeSpace:MIN \
DEF:h="/var/www/cacti/rra/server_freespace_19584.rrd":FreeSpace:MAX \
CDEF:cdefe=a,e,- \
CDEF:cdeff=a,f,- \
CDEF:cdefh=a,h,- \
AREA:a#002A97FF:"Total\:"  \
GPRINT:b:LAST:"Current\:%8.2lf %s"  \
GPRINT:a:AVERAGE:"Average\:%8.2lf %s"  \
GPRINT:d:MAX:"Maximum\:%8.2lf %s\n"  \
AREA:cdefe#F51D30FF:"Used\:"  \
GPRINT:cdeff:LAST:" Current\:%8.2lf %s"  \
GPRINT:cdefe:AVERAGE:"Average\:%8.2lf %s"  \
GPRINT:cdefh:MAX:"Maximum\:%8.2lf %s\n"  \
COMMENT:"   Free\:"  \
GPRINT:f:LAST:"Current\:%8.2lf %s"  \
GPRINT:e:AVERAGE:"Average\:%8.2lf %s"  \
GPRINT:h:MAX:"Maximum\:%8.2lf %s\n" 

See how each data source is defined 4 times on my output whereas on yours it defines them only twice. This has messed up the CDEF as the CDEF is referencing data input e and i which you won't have. You will need to update the CDEF to be c - e which will work with your system.

[camaya]

can you post your graph template form memory usage, please? I mean your CDEF.

and how can I monitor the printer queue and the band width in the network interfaces?

[claymen]

can you post your graph template form memory usage, please? I mean your CDEF.

and how can I monitor the printer queue and the band width in the network interfaces?

Just update the CDEF for the graph as I mentioned. Management -> Graph Management -> CDEFs -> WMI - Memory.

Update the two custom string items to be what I posted which was c - e instead of e - i

Network interfaces you'll have to add in your own data input method, data template and then you could probably reuse existing snmp graphs. Take a look at how the data is pulled in and it should give you a rough idea. From memory the WMI class you will want to query is Win32_PerfRawData_Tcpip_NetworkInterface .

[gab]

Hello claymen. First of all, thank you for the scripts and templates. Everything works fine for me.

I would like to know if it's possible to monitor 2 disks of a single host.

Under Cacti, when I edit host, I can add the template "Windows - Disk I/O (WMI)" just one time.

Thanks in advance

[claymen]

Hello claymen. First of all, thank you for the scripts and templates. Everything works fine for me.

I would like to know if it's possible to monitor 2 disks of a single host.

Under Cacti, when I edit host, I can add the template "Windows - Disk I/O (WMI)" just one time.

Thanks in advance

Just add another graph and enter in the right drive letter.

E.g. goto your device, click create graphs, select to add another windows disk usage graph (WMI) and then create it and it'l ask for the details like name of the data source to create graph name etc just set that and set the right drive letter on the custom data.

[gab]

Thanks you. It works. Sorry for the silly question.

[llow]

What class were you trying to query. What I found was that to use a restricted user you needed to also grant it access to the perfmon counters as well as it seems to pass the credential through. E.g. it needed access to remote query WMI (through the com settings) then it needed permission to query the correct root then it also needed access to subsystem which WMI is querying.

Try adding the user to the performance monitor/logging groups which should be builtin to 2003. This is what we are doing to grant it access without it being an admin.

I tried that and started getting WBEM_E_FAILED instead. What do you mean by access to the subsystem? I'm just doing a lookup of Win32_Service.

[daborg69]

I have followed this email thread and have everything installed. Like ZAG above I have copied the command being run from the poller cache to the command line and it works fine returning realistic results. However no graph data.

Here's a relevant line from the cacti.log file:

Code: Select all

01/08/2009 12:40:04 PM - CACTID: Poller[0] Host[13] DS[335] SCRIPT: /usr/bin/php -q /usr/share/cacti/site/scripts/wmi.php dcvgasv30007 cacti Win32_ComputerSystem TotalPhysicalMemory  , output: U

If I run that command from command prompt I get:

Code: Select all

Name:DCVGASV30007 TotalPhysicalMemory:4096409600 

I've tried everything I could think of with no luck. Anyone have any ideas?

Thanks,

[claymen]

What class were you trying to query. What I found was that to use a restricted user you needed to also grant it access to the perfmon counters as well as it seems to pass the credential through. E.g. it needed access to remote query WMI (through the com settings) then it needed permission to query the correct root then it also needed access to subsystem which WMI is querying.

Try adding the user to the performance monitor/logging groups which should be builtin to 2003. This is what we are doing to grant it access without it being an admin.

I tried that and started getting WBEM_E_FAILED instead. What do you mean by access to the subsystem? I'm just doing a lookup of Win32_Service.

Can you access Win32_Service using an admin credential. If so then process of elimination says that its a permission error if admin can get it but non admin can't.

[claymen]

I have followed this email thread and have everything installed. Like ZAG above I have copied the command being run from the poller cache to the command line and it works fine returning realistic results. However no graph data.

Here's a relevant line from the cacti.log file:

Code: Select all

01/08/2009 12:40:04 PM - CACTID: Poller[0] Host[13] DS[335] SCRIPT: /usr/bin/php -q /usr/share/cacti/site/scripts/wmi.php dcvgasv30007 cacti Win32_ComputerSystem TotalPhysicalMemory  , output: U

If I run that command from command prompt I get:

Code: Select all

Name:DCVGASV30007 TotalPhysicalMemory:4096409600 

I've tried everything I could think of with no luck. Anyone have any ideas?

Thanks,

That's a bit of an odd one. I had similar problems with different versions of spine where it would just fail to get data but cmd.php would work fine. Can you possibly give that a quick test or enable debug logging and see whats going on at the time its being polled? I've got a debug version of the script I have been working on which I'll put up soon, it simply dumps all the variables on each run to a text file to try and work out whats happening when it is called by cacti's poller.

[llow]

What class were you trying to query. What I found was that to use a restricted user you needed to also grant it access to the perfmon counters as well as it seems to pass the credential through. E.g. it needed access to remote query WMI (through the com settings) then it needed permission to query the correct root then it also needed access to subsystem which WMI is querying.

Try adding the user to the performance monitor/logging groups which should be builtin to 2003. This is what we are doing to grant it access without it being an admin.

I tried that and started getting WBEM_E_FAILED instead. What do you mean by access to the subsystem? I'm just doing a lookup of Win32_Service.

Can you access Win32_Service using an admin credential. If so then process of elimination says that its a permission error if admin can get it but non admin can't.

Right that is my entiire problem. I don't want to have to have users in the Administrators group just to perform WMI calls.

[daborg69]

That's a bit of an odd one. I had similar problems with different versions of spine where it would just fail to get data but cmd.php would work fine. Can you possibly give that a quick test or enable debug logging and see whats going on at the time its being polled? I've got a debug version of the script I have been working on which I'll put up soon, it simply dumps all the variables on each run to a text file to try and work out whats happening when it is called by cacti's poller.

Ok. So I figured the problem out. I apparently had an extra blank line at the end of the wmi-logins.php file which caused the first line of output from wmi.php to be blank. Removing that fixed everything right up.

Thanks for the great script and templates. I will be sure and post new ones back here.

[daborg69]

Right that is my entiire problem. I don't want to have to have users in the Administrators group just to perform WMI calls.

Try This:

User belongs to following domain wide groups:
- Domain Users
- Performance Log Users
- Performance Monitor Users
On the local machine add the user to the Distributed COM Users group
On the local machine make sure the user has rights to the WMI Control and all sub namespaces.

Working for me once I did this.