Monitor Windows via WMI from Cacti on Linux

[claymen]

You just run it and use it to query the WMI classes. It's reasonably straight forward to use once you get it going.

Homebrew is awesome, waiting for first batch to age a bit more. New batch debating whether to simply keg it or bottle again.

[st3rling]

Can someone post compiled version of wmic for CentOS? Thank you very much!

[tsumi]

You just run it and use it to query the WMI classes. It's reasonably straight forward to use once you get it going.

Homebrew is awesome, waiting for first batch to age a bit more. New batch debating whether to simply keg it or bottle again.

Awesome. I will get into that today! Thanks again for all the fast responses.

From what I understand about homebrews bottling is the way to go. Seems they keep better, but if you are anything like me that is irrelevant as it all goes really fast anyway.

[tsumi]

OK -

So upon running scriptomatic on the target machine I can load the root\CMIV2 wmi namespace and have a whole bunch of WMI classes listed. Is there something else I am supposed to be doing here?

I apologize for all the noobtastic questions.

-Jimi

[claymen]

I wanted to make sure you can access the WMI classes at all and get data back. Which is a little odd that you can't query it remotely even with an admin credential. In 99% of cases its either a firewall or privileges.

[stormonts]

I have this running on SLES 10 64 bit, but I've got some issues.

All my graphs are reporting NAN, but the rrd files are being created and they do contain data.

I set debug in wmi.php to level 2 and ran one of the commands from the poller cache at the command line and got this:

PHP Notice: Undefined offset: 0 in /usr/local/cacti-0.8.7b/scripts/wmi.php on line 113
PHP Notice: Undefined offset: 1 in /usr/local/cacti-0.8.7b/scripts/wmi.php on line 113


Line 113 says:

fwrite($fp,"Time: $dbug_time\nWMI Class: $wmiclass\nCredential: $credential\nColumns: $columns\nCondition Key: $condition_key\nCondition Val: $condition_val\nQuery: $wmiquery\nExec: $wmiexec\nOutput:\n".$wmiout[0]."\n".$wmiout[1]."\n");


Any suggestions?

[claymen]

That would say to me it didn't even bother to run the wmic command or was unable to do so hence no data to log out and thus it fails

[stormonts]

That would say to me it didn't even bother to run the wmic command or was unable to do so hence no data to log out and thus it fails

This is one of the items that is failing as per the Poller Cache in Cacti (this came from one of the templates in the initial download, and yes, we have EV 2007 running on the server in question):

/usr/bin/php -q /usr/local/cacti-0.8.7b/scripts/wmi.php -h 'bronze.omni.imsweb.com' -u '/etc/cacti/cactiwmi.pw' -w 'Win32_PerfRawData_EnterpriseVaultVaultStores_EnterpriseVaultVaultStores' -n '' -k 'Name' -v '_Total' -c 'WatchfileTableSize,VaultStoreDBLogSize,VaultStoreDBLogPercentUsed,VaultStoreDBLogBackup,VaultStoreDBBackup'


WMIC appears to be working as I took a command out of the wmi.php file and tried to run it at the command line. I ran:

./wmic --authentication-file='/etc/cacti/cactiwmi.pw' //'bronze.omni.imsweb.com' 'Select * from Win32_Service'

and it ran perfectly fine.

[saback]

I install the script. It´s working from command line, but no graph (not plotting):

Command:

Code: Select all

/usr/bin/php -q /var/www/cacti/scripts/wmi.php -h x.x.x.x -u /etc/cacti/cactiwmi.pw -w Win32_LogicalDisk -n '' -k DeviceID -v c: -c Size,FreeSpace

Result:

Code: Select all

DeviceID:C FreeSpace:15125635072 Size:42947571712

RRDTool Command:

Code: Select all

RRDTool Command:
/usr/bin/rrdtool graph - \
--imgformat=PNG \
--start=-86400 \
--end=-300 \
--title="xxxxx - Available Disk Space" \
--rigid \
--base=1024 \
--height=120 \
--width=500 \
--alt-autoscale-max \
--lower-limit=0 \
--vertical-label="Bytes" \
--slope-mode \
--font TITLE:12: \
--font AXIS:8: \
--font LEGEND:10: \
--font UNIT:8: \
DEF:a="/var/www/cacti/rra/bm-ssa-vm0003_freespace_1526.rrd":Size:AVERAGE \
DEF:b="/var/www/cacti/rra/bm-ssa-vm0003_freespace_1526.rrd":Size:MAX \
DEF:c="/var/www/cacti/rra/bm-ssa-vm0003_freespace_1526.rrd":FreeSpace:AVERAGE \
DEF:d="/var/www/cacti/rra/bm-ssa-vm0003_freespace_1526.rrd":FreeSpace:MAX \
CDEF:cdefe=a,c,- \
CDEF:cdefh=a,d,- \
AREA:a#002A97FF:"Total\:"  \
GPRINT:a:LAST:"Current\:%8.2lf %s"  \
GPRINT:a:AVERAGE:"Average\:%8.2lf %s"  \
GPRINT:b:MAX:"Maximum\:%8.2lf %s\n"  \
AREA:cdefe#F51D30FF:"Used\:"  \
GPRINT:cdefe:LAST:" Current\:%8.2lf %s"  \
GPRINT:cdefe:AVERAGE:"Average\:%8.2lf %s"  \
GPRINT:cdefh:MAX:"Maximum\:%8.2lf %s\n"  \
COMMENT:"   Free\:"  \
GPRINT:c:LAST:"Current\:%8.2lf %s"  \
GPRINT:c:AVERAGE:"Average\:%8.2lf %s"  \
GPRINT:d:MAX:"Maximum\:%8.2lf %s\n" 
RRDTool Says:
OK

Any idea?

OS: CentOS
WMIC: Version 4.0.0alpha3-GIT-UNKNOWN
Cacti: Version 0.8.7b

[claymen]

That would say to me it didn't even bother to run the wmic command or was unable to do so hence no data to log out and thus it fails

This is one of the items that is failing as per the Poller Cache in Cacti (this came from one of the templates in the initial download, and yes, we have EV 2007 running on the server in question):

/usr/bin/php -q /usr/local/cacti-0.8.7b/scripts/wmi.php -h 'bronze.omni.imsweb.com' -u '/etc/cacti/cactiwmi.pw' -w 'Win32_PerfRawData_EnterpriseVaultVaultStores_EnterpriseVaultVaultStores' -n '' -k 'Name' -v '_Total' -c 'WatchfileTableSize,VaultStoreDBLogSize,VaultStoreDBLogPercentUsed,VaultStoreDBLogBackup,VaultStoreDBBackup'


WMIC appears to be working as I took a command out of the wmi.php file and tried to run it at the command line. I ran:

./wmic --authentication-file='/etc/cacti/cactiwmi.pw' //'bronze.omni.imsweb.com' 'Select * from Win32_Service'

and it ran perfectly fine.

So if you run the following from the cmd line (I added the debug option)

Code: Select all

/usr/bin/php -q /usr/local/cacti-0.8.7b/scripts/wmi.php -h 'bronze.omni.imsweb.com' -u '/etc/cacti/cactiwmi.pw' -w 'Win32_PerfRawData_EnterpriseVaultVaultStores_EnterpriseVaultVaultStores' -n '' -k 'Name' -v '_Total' -c 'WatchfileTableSize,VaultStoreDBLogSize,VaultStoreDBLogPercentUsed,VaultStoreDBLogBackup,VaultStoreDBBackup' -d1

And then it will tell you the exact wmic command it ran, if you run that does it actually run and return results.

[claymen]

I install the script. It´s working from command line, but no graph (not plotting):

Command:

Code: Select all

/usr/bin/php -q /var/www/cacti/scripts/wmi.php -h x.x.x.x -u /etc/cacti/cactiwmi.pw -w Win32_LogicalDisk -n '' -k DeviceID -v c: -c Size,FreeSpace

Result:

Code: Select all

DeviceID:C FreeSpace:15125635072 Size:42947571712

RRDTool Command:

Code: Select all

RRDTool Command:
/usr/bin/rrdtool graph - \
--imgformat=PNG \
--start=-86400 \
--end=-300 \
--title="xxxxx - Available Disk Space" \
--rigid \
--base=1024 \
--height=120 \
--width=500 \
--alt-autoscale-max \
--lower-limit=0 \
--vertical-label="Bytes" \
--slope-mode \
--font TITLE:12: \
--font AXIS:8: \
--font LEGEND:10: \
--font UNIT:8: \
DEF:a="/var/www/cacti/rra/bm-ssa-vm0003_freespace_1526.rrd":Size:AVERAGE \
DEF:b="/var/www/cacti/rra/bm-ssa-vm0003_freespace_1526.rrd":Size:MAX \
DEF:c="/var/www/cacti/rra/bm-ssa-vm0003_freespace_1526.rrd":FreeSpace:AVERAGE \
DEF:d="/var/www/cacti/rra/bm-ssa-vm0003_freespace_1526.rrd":FreeSpace:MAX \
CDEF:cdefe=a,c,- \
CDEF:cdefh=a,d,- \
AREA:a#002A97FF:"Total\:"  \
GPRINT:a:LAST:"Current\:%8.2lf %s"  \
GPRINT:a:AVERAGE:"Average\:%8.2lf %s"  \
GPRINT:b:MAX:"Maximum\:%8.2lf %s\n"  \
AREA:cdefe#F51D30FF:"Used\:"  \
GPRINT:cdefe:LAST:" Current\:%8.2lf %s"  \
GPRINT:cdefe:AVERAGE:"Average\:%8.2lf %s"  \
GPRINT:cdefh:MAX:"Maximum\:%8.2lf %s\n"  \
COMMENT:"   Free\:"  \
GPRINT:c:LAST:"Current\:%8.2lf %s"  \
GPRINT:c:AVERAGE:"Average\:%8.2lf %s"  \
GPRINT:d:MAX:"Maximum\:%8.2lf %s\n" 
RRDTool Says:
OK

Any idea?

OS: CentOS
WMIC: Version 4.0.0alpha3-GIT-UNKNOWN
Cacti: Version 0.8.7b

Although your running 0.8.7b your version isn't creating all the DEF entries that it normally should. In other words your CDEF is broken see the earlier posts regarding this. Should be one in the last page or so as it comes up often due to changes between cacti versions.

As a quick example this is what it should look like, you'll notice the different number of DEF entries, this breaks the CDEF because it relies on the number of DEF entries being static.

Code: Select all

/usr/bin/rrdtool graph - \
--imgformat=PNG \
--start=-86400 \
--end=-300 \
--title="Site - Server - Available Disk Space - H" \
--rigid \
--base=1024 \
--height=120 \
--width=500 \
--alt-autoscale-max \
--lower-limit=0 \
--vertical-label="Bytes" \
--slope-mode \
--font TITLE:8: \
--font AXIS:8: \
--font LEGEND:8: \
--font UNIT:8: \
DEF:a="/var/www/cacti/rra/Site_-_Server_freespace_19584.rrd":Size:AVERAGE \
DEF:b="/var/www/cacti/rra/Site_-_Server_freespace_19584.rrd":Size:LAST \
DEF:c="/var/www/cacti/rra/Site_-_Server_freespace_19584.rrd":Size:MIN \
DEF:d="/var/www/cacti/rra/Site_-_Server_freespace_19584.rrd":Size:MAX \
DEF:e="/var/www/cacti/rra/Site_-_Server_freespace_19584.rrd":FreeSpace:AVERAGE \
DEF:f="/var/www/cacti/rra/Site_-_Server_freespace_19584.rrd":FreeSpace:LAST \
DEF:g="/var/www/cacti/rra/Site_-_Server_freespace_19584.rrd":FreeSpace:MIN \
DEF:h="/var/www/cacti/rra/Site_-_Server_freespace_19584.rrd":FreeSpace:MAX \
CDEF:cdefe=a,e,- \
CDEF:cdeff=a,f,- \
CDEF:cdefh=a,h,- \
AREA:a#002A97FF:"Total\:"  \
GPRINT:b:LAST:"Current\:%8.2lf %s"  \
GPRINT:a:AVERAGE:"Average\:%8.2lf %s"  \
GPRINT:d:MAX:"Maximum\:%8.2lf %s\n"  \
AREA:cdefe#F51D30FF:"Used\:"  \
GPRINT:cdeff:LAST:" Current\:%8.2lf %s"  \
GPRINT:cdefe:AVERAGE:"Average\:%8.2lf %s"  \
GPRINT:cdefh:MAX:"Maximum\:%8.2lf %s\n"  \
COMMENT:"   Free\:"  \
GPRINT:f:LAST:"Current\:%8.2lf %s"  \
GPRINT:e:AVERAGE:"Average\:%8.2lf %s"  \
GPRINT:h:MAX:"Maximum\:%8.2lf %s\n" 

[stormonts]

So if you run the following from the cmd line (I added the debug option)

Code: Select all

/usr/bin/php -q /usr/local/cacti-0.8.7b/scripts/wmi.php -h 'bronze.omni.imsweb.com' -u '/etc/cacti/cactiwmi.pw' -w 'Win32_PerfRawData_EnterpriseVaultVaultStores_EnterpriseVaultVaultStores' -n '' -k 'Name' -v '_Total' -c 'WatchfileTableSize,VaultStoreDBLogSize,VaultStoreDBLogPercentUsed,VaultStoreDBLogBackup,VaultStoreDBBackup' -d1

And then it will tell you the exact wmic command it ran, if you run that does it actually run and return results.

When I ran that command, I got:

Code: Select all

/usr/local/bin/wmic --namespace='root\CIMV2' --authentication-file=/etc/cacti/cactiwmi.pw //bronze.omni.imsweb.com "SELECT WatchfileTableSize,VaultStoreDBLogSize,VaultStoreDBLogPercentUsed,VaultStoreDBLogBackup,VaultStoreDBBackup FROM Win32_PerfRawData_EnterpriseVaultVaultStores_EnterpriseVaultVaultStores WHERE Name='_Total'"
Exec Status: 0

[Thomas.Pacce]

HI

I am using the WMI scripts latest version. I am interested in the Process Stats one. I am not sure how to use it, can you help. I have a service called pipeline.exe that i would like to monitor, if i enter Pipeline.exe as a filter value it doesnt return any values, what am i missing?

Thank you

[Thomas.Pacce]

found it...service name without .exe

[claymen]

When I ran that command, I got:

Code: Select all

/usr/local/bin/wmic --namespace='root\CIMV2' --authentication-file=/etc/cacti/cactiwmi.pw //bronze.omni.imsweb.com "SELECT WatchfileTableSize,VaultStoreDBLogSize,VaultStoreDBLogPercentUsed,VaultStoreDBLogBackup,VaultStoreDBBackup FROM Win32_PerfRawData_EnterpriseVaultVaultStores_EnterpriseVaultVaultStores WHERE Name='_Total'"
Exec Status: 0

Means there was no result, so your enterprise vault classes are broken or not registered correctly try using wmiadap /f and a restart.