Monitor Windows via WMI from Cacti on Linux

[argon0]

It seems that if I try to use C\: in new graphs it doesn't work...

[argon0]

It seems that if I try to use C\: in new graphs it doesn't work...

[argon0]

One thing a colleague mentioned was that wmi data is sent via RPC which is really only a locally useful Protocol, not intended for use over a WAN.

Could this cause the issues I am getting?

One thing I have noticed is that some queries are not causing the problem - e.g. CPU - could this be that the server in question is able to return the result quicker (either because it requires less work, or because it is being asked for less data ) so not tripping the inbuilt RPC timeouts.


Amcool - what do you mean by older servers? All my machines are running win2k3...

[claymen]

It seems that if I try to use C\: in new graphs it doesn't work...

Check your poller cache, and try and run exactly what it has in there for one of the hosts that doesnt work. We used the backwards compatibility with C\: to migrate about 300 data sources over to 0.0.6.

[argon0]

The old graphs work, for most hosts (certainly those local to the server) just if you create a new one it complains...

I'll try to create a new one to get the message.

[st3rling]

Hello,
For some reason 4 CPU template "cacti_graph_template_windows_-_cpu_usage_-_4cpu_wmi.xml" doesn't work for me. 2 CPU template works fine (obviously on 2 CPU servers). If I try to execute script from the terminal, here is what I get (sorry, I'm new to Linux):

[root@localhost ~]# /usr/bin/php -q /var/www/html/scripts/wmi.php -h '10.32.65.10' -u '/etc/cacti/wmi.pw' -w 'Win32_PerfFormattedData_PerfOS_Processor' -n '' -k '' -v '' -c 'PercentProcessorTime'

Return code non-zero, debug mode enabled!

/var/www/html/plugins/wmi/wmic --namespace='root\CIMV2' --authentication-file=/etc/cacti/wmi.pw //10.32.65.10 "SELECT PercentProcessorTime FROM Win32_PerfFormattedData_PerfOS_Processor"
Exec Status: 6

INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)0:Please_read_the_file_BUGS.txt_in_the_distribution
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)1:=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)2:PANIC_internal_error
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)3:BACKTRACE_20_stack_frames
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)4:_#0_/var/www/html/plugins/wmi/wmic(call_backtrace+0x27)_[0x8535c1b]
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)5:_#1_/var/www/html/plugins/wmi/wmic(smb_panic+0x266)_[0x8535f85]
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)6:_#2_/var/www/html/plugins/wmi/wmic_[0x8536115]
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)7:_#3_/var/www/html/plugins/wmi/wmic(fault_setup+0)_[0x853614d]
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)8:_#4_/lib/tls/libc.so.6_[0x5c4918]
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)9:_#5_/lib/tls/libc.so.6(abort+0xe9)_[0x5c6289]
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)10:_#6_/var/www/html/plugins/wmi/wmic_[0x8578e40]
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)11:_#7_/var/www/html/plugins/wmi/wmic_[0x8578f0b]
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)12:_#8_/var/www/html/plugins/wmi/wmic_[0x85790f0]
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)13:_#9_/var/www/html/plugins/wmi/wmic_[0x8579402]
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)14:_#10_/var/www/html/plugins/wmi/wmic(talloc_named_const+0x17)_[0x857a007]
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)15:_#11_/var/www/html/plugins/wmi/wmic(ndr_pull_WbemQualifiers+0x15c)_[0x80b6c9f]
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)16:_#12_/var/www/html/plugins/wmi/wmic(ndr_pull_WbemClass+0x1fc)_[0x80b8f99]
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)17:_#13_/var/www/html/plugins/wmi/wmic(ndr_pull_DataWithStack+0xb5)_[0x80b6fe1]
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)18:_#14_/var/www/html/plugins/wmi/wmic(ndr_pull_WbemClassObject+0x28c)_[0x80b81a3]
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)19:_#15_/var/www/html/plugins/wmi/wmic(WBEMDATA_Parse+0xb4d)_[0x80b5261]
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)20:_#16_/var/www/html/plugins/wmi/wmic(IEnumWbemClassObject_SmartNext+0x420)_[0x80b5872]
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)21:_#17_/var/www/html/plugins/wmi/wmic(main+0x446)_[0x80b2846]
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)22:_#18_/lib/tls/libc.so.6(__libc_start_main+0xd3)_[0x5b1df3]
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)23:_#19_/var/www/html/plugins/wmi/wmic_[0x80b1e05][root@localhost ~]#

Does it look like it's a wmic problem? Thank you very much for any help.
My system info:

Cacti Version - 0.8.7c
Plugin Architecture - 2.2
Poller Type - Cactid v
Server Info - Linux 2.6.9-78.0.13.plus.c4smp
Web Server - Apache/2.0.63 (CentOS)
PHP - 5.1.6
PHP Extensions - libxml, xml, wddx, tokenizer, sysvshm, sysvsem, sysvmsg, standard, SimpleXML, sockets, SPL, shmop, session, Reflection, pspell, posix, mime_magic, iconv, hash, gmp, gettext, ftp, exif, date, curl, ctype, calendar, bz2, zlib, pcre, openssl, apache2handler, gd, ldap, mysql, mysqli, PDO, pdo_mysql, pdo_sqlite, snmp, eAccelerator
MySQL - 5.0.68
RRDTool - 1.2.23
SNMP - 5.1.2
Plugins

• Global Plugin Settings (settings - v0.5)
  Large Site Performane Booster for Cacti (boost - v2.2)
  Device Monitoring (monitor - v0.8.2)
  Network Discovery (discovery - v0.8.5)
  Network Tools (tools - v0.3)
  Syslog Monitoring (syslog - v0.5.2)
  Device Tracking (mactrack - v1.1)
  Login Page Mod (loginmod - v1.0)
  Update Checker (update - v0.4)
  FlowView (flowview - v0.6)
  Host Info (hostinfo - v0.2)
  Error Images (errorimage - v0.1)
  PHP Network Weathermap (weathermap - v0.95b)
  docs
  Cacti-ReportIt (reportit - v0.6.1)
  Router Configs (routerconfigs - v0.1)
  WMI Query (wmi - v0.1)
  Realtime for Cacti (realtime - v0.35)

[claymen]

What version of wmic are you using? Cause yer that's pretty much a case of your wmic is broken.

Hello,
For some reason 4 CPU template "cacti_graph_template_windows_-_cpu_usage_-_4cpu_wmi.xml" doesn't work for me. 2 CPU template works fine (obviously on 2 CPU servers). If I try to execute script from the terminal, here is what I get (sorry, I'm new to Linux):

[root@localhost ~]# /usr/bin/php -q /var/www/html/scripts/wmi.php -h '10.32.65.10' -u '/etc/cacti/wmi.pw' -w 'Win32_PerfFormattedData_PerfOS_Processor' -n '' -k '' -v '' -c 'PercentProcessorTime'

Return code non-zero, debug mode enabled!

/var/www/html/plugins/wmi/wmic --namespace='root\CIMV2' --authentication-file=/etc/cacti/wmi.pw //10.32.65.10 "SELECT PercentProcessorTime FROM Win32_PerfFormattedData_PerfOS_Processor"
Exec Status: 6

INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)0:Please_read_the_file_BUGS.txt_in_the_distribution
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)1:=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)2:PANIC_internal_error
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)3:BACKTRACE_20_stack_frames
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)4:_#0_/var/www/html/plugins/wmi/wmic(call_backtrace+0x27)_[0x8535c1b]
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)5:_#1_/var/www/html/plugins/wmi/wmic(smb_panic+0x266)_[0x8535f85]
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)6:_#2_/var/www/html/plugins/wmi/wmic_[0x8536115]
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)7:_#3_/var/www/html/plugins/wmi/wmic(fault_setup+0)_[0x853614d]
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)8:_#4_/lib/tls/libc.so.6_[0x5c4918]
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)9:_#5_/lib/tls/libc.so.6(abort+0xe9)_[0x5c6289]
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)10:_#6_/var/www/html/plugins/wmi/wmic_[0x8578e40]
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)11:_#7_/var/www/html/plugins/wmi/wmic_[0x8578f0b]
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)12:_#8_/var/www/html/plugins/wmi/wmic_[0x85790f0]
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)13:_#9_/var/www/html/plugins/wmi/wmic_[0x8579402]
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)14:_#10_/var/www/html/plugins/wmi/wmic(talloc_named_const+0x17)_[0x857a007]
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)15:_#11_/var/www/html/plugins/wmi/wmic(ndr_pull_WbemQualifiers+0x15c)_[0x80b6c9f]
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)16:_#12_/var/www/html/plugins/wmi/wmic(ndr_pull_WbemClass+0x1fc)_[0x80b8f99]
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)17:_#13_/var/www/html/plugins/wmi/wmic(ndr_pull_DataWithStack+0xb5)_[0x80b6fe1]
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)18:_#14_/var/www/html/plugins/wmi/wmic(ndr_pull_WbemClassObject+0x28c)_[0x80b81a3]
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)19:_#15_/var/www/html/plugins/wmi/wmic(WBEMDATA_Parse+0xb4d)_[0x80b5261]
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)20:_#16_/var/www/html/plugins/wmi/wmic(IEnumWbemClassObject_SmartNext+0x420)_[0x80b5872]
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)21:_#17_/var/www/html/plugins/wmi/wmic(main+0x446)_[0x80b2846]
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)22:_#18_/lib/tls/libc.so.6(__libc_start_main+0xd3)_[0x5b1df3]
INTERNAL ERROR: Signal 6 in pid 26148 (4.0.0alpha3-GIT-UNKNOWN)23:_#19_/var/www/html/plugins/wmi/wmic_[0x80b1e05][root@localhost ~]#

[argon0]

Am coming to the conclusion that either

1) I am going to need to set up Cacti server per site on my WAN
2) I am going to have to abandon current implementation of WMI for remote sites
or
3) there is a bug in the WMI checking....

My concern is that things seemed fine with the old WMI checker, not sure what is happening particularly differently for this version.

**thinks** can both be run at the same time... Should be able to - my "count rows" variant is still working.... How to import the old templates without overwriting the new ones....

Claymen - any advice???

[st3rling]

What version of wmic are you using? Cause yer that's pretty much a case of your wmic is broken.

Hi claymen,
Here is the version, I got it from the link in your earlier post, I can look up the exact post if you want me to. Thank you for your help.

[root@localhost ~]# /var/www/html/plugins/wmi/wmic -V
Version 4.0.0alpha3-GIT-UNKNOWN

[argon0]

Pretty sure that's the old version. I've upgraded mine - but it took compiling to get it to work.

Argon0

[claymen]

Here is a tar/bz2/zip (due to the forum not liking bz2...) of the latest wmi-client source code.

Those errors are similar to what I used to see when I was using the old 1.1.3 wmi client and CPU usage.

Am coming to the conclusion that either

1) I am going to need to set up Cacti server per site on my WAN
2) I am going to have to abandon current implementation of WMI for remote sites
or
3) there is a bug in the WMI checking....

My concern is that things seemed fine with the old WMI checker, not sure what is happening particularly differently for this version.

**thinks** can both be run at the same time... Should be able to - my "count rows" variant is still working.... How to import the old templates without overwriting the new ones....

Claymen - any advice???

To be honest I'm not sure why it would suddenly take longer after updating the WMI client. I know the auth methods as I had mentioned can drag it out but your using IP's which shouldn't be an issue..

If you wanted to run a side by side you'd need to basically duplicate the templates and change the data input method to use an older version of the script or even a duplicate of the latest but with a modified path to the wmic which is the older version. So in theory you can do it, but it'd be a little messy

[claymen]

We use cacti over the WAN at work but being we also use fibre to link sites our latency is next to nothing.

[argon0]

Ah, that may explain it, our latency is pretty small, but we have only got a 10mb connection, which occasionally gets a little saturated (although not as often as the failures would suggest). The servers are also a little busy, at least one of them failed regularly before, but I had stopped monitoring that by anything but snmp because of the issues...

Got half way through creating a new data source to mirror the old ones to test this out before home time yesterday....

TBH I'll be quite glad when the Cacti team bring out the "clustered" variant they have been planning for a little while...

[claymen]

Isn't that partially doable with the boost plugin? I vaguely remember it supporting the possibility of multiple pollers on different machines...

[argon0]

BTW Auth methods?

Which ones drag it out? (I think I missed that bit earlier)

At a guess you're referring to NT v Kerberos authentication. Is there another way I could test?

As you say I'm using IP addresses not hostnames

Hmm may try to run both from command line and see which, if any, is quicker... Although the "new" version does work some of the time (I hesitate to say most of) and seems quick when it does work.... Just when it doesn't it stuffs polling up for all clients....

**thinks** wonder if it would make any difference to increase the number of processes to be the same as the no. of clients that way if one client gets stuck it shouldn't impinge on the others? But Not sure if this makes any difference at all with Spine...