Monitor Windows via WMI from Cacti on Linux

[areus]

I got error while polling stats for filtered process:

Code: Select all

06/17/2009 07:01:20 AM - CMDPHP: Poller[0] Host[9] DS[274] CMD: /usr/bin/php -q /usr/local/groundwork/apache2/htdocs/cacti/scripts/wmi.php -h '172.48.16.50' -u '/etc/cacti/cactiwmi.pw' -w 'Win32_PerfRawData_PerfProc_Process' -n '' -k 'Name' -v 'XMLNewsLoader' -c 'ThreadCount,HandleCount,PrivateBytes,VirtualBytes,PageFileBytes,PercentPrivilegedTime,PercentProcessorTime,PercentUserTime', output: U

but the same command from cmdline works fine:

Code: Select all

[cacti@mon2 log]$  /usr/bin/php -q /usr/local/groundwork/apache2/htdocs/cacti/scripts/wmi.php -h '172.48.16.50' -u '/etc/cacti/cactiwmi.pw' -w 'Win32_PerfRawData_PerfProc_Process' -n '' -k 'Name' -v 'XMLNewsLoader' -c 'ThreadCount,HandleCount,PrivateBytes,VirtualBytes,PageFileBytes,PercentPrivilegedTime,PercentProcessorTime,PercentUserTime'
HandleCount:176 Name:XMLNewsLoader PageFileBytes:32825344 PercentPrivilegedTime:38906250 PercentProcessorTime:101875000 PercentUserTime:62968750 PrivateBytes:32825344 ThreadCount:6 VirtualBytes:536879104

Any suggestions?
Who have successfully run polling for filtered process?

UPD:
I found reason: due to debug enabled, there is log-file owned by root

[claymen]

I'm using it at the moment to monitor the store.exe for exchange as well as the t-server for a genesys phone system integration. Works a treat so we can monitor for any memory leaks.

From the looks of that query and comparing both whats in the poller cache and what you ran manually they are exactly the same. The usual things like permissions seem to be ok as your running it as the cacti user and using the php poller. Tis a bit strange, doesn't look like there are any other processes by that name either which can freak it out.

To be honest I am at a loss on this one, are you able to grab any debug logging from cacti at the time this is polled? It may reveal a bit more information to help identify the issue.

*EDIT*
Just saw your update, yer the log file would most definentally freak it out if the permissions were broken on it. Glad its now working

[areus]

Code: Select all

[root@mon2 cacti]# /home/groundwork/common/bin/rrdtool graph - \
> --imgformat=PNG \
> --start=1245235330 \
> --end=1245321730 \
> --title="16.55/stage-lvs - Memory Usage" \
> --base=1024 \
> --height=120 \
> --width=500 \
> --alt-autoscale-max \
> --lower-limit=0 \
> COMMENT:"From 2009/06/17 03\:42\:10 To 2009/06/18 03\:42\:10\c" \
> COMMENT:"  \n" \
> --vertical-label="Bytes" \
> --slope-mode \
> --font TITLE:10: \
> --font AXIS:8: \
> --font LEGEND:8: \
> --font UNIT:8: \
> DEF:a="/usr/local/groundwork/apache2/htdocs/cacti/rra/16_54stage-lvs_availablebytes_295.rrd":CommitLimit:AVERAGE \
> DEF:b="/usr/local/groundwork/apache2/htdocs/cacti/rra/16_54stage-lvs_totalphysicalmemory_296.rrd":TotalPhysicalMemory:AVERAGE \
> DEF:c="/usr/local/groundwork/apache2/htdocs/cacti/rra/16_54stage-lvs_availablebytes_295.rrd":AvailableBytes:AVERAGE \
> DEF:d="/usr/local/groundwork/apache2/htdocs/cacti/rra/16_54stage-lvs_availablebytes_295.rrd":CommittedBytes:AVERAGE \
> CDEF:cdefi=e,i,- \
> AREA:a#562B29FF:"Commit Limit\:"  \
> GPRINT:a:LAST:"  Current\:%8.2lf %s"  \
> GPRINT:a:AVERAGE:"Average\:%8.2lf %s"  \
> GPRINT:a:MAX:"Maximum\:%8.2lf %s\n"  \
> AREA:b#FF5700FF:"Total RAM\:"  \
> GPRINT:b:LAST:"     Current\:%8.2lf %s"  \
> GPRINT:b:AVERAGE:"Average\:%8.2lf %s"  \
> GPRINT:b:MAX:"Maximum\:%8.2lf %s\n"  \
> AREA:cdefi#8F005CFF:"Used RAM\:"  \
> GPRINT:cdefi:LAST:"      Current\:%8.2lf %s"  \
> GPRINT:cdefi:AVERAGE:"Average\:%8.2lf %s"  \
> GPRINT:cdefi:MAX:"Maximum\:%8.2lf %s\n"  \
> LINE2:d#FFFF00FF:"Commited Bytes\:"  \
> GPRINT:d:LAST:"Current\:%8.2lf %s"  \
> GPRINT:d:AVERAGE:"Average\:%8.2lf %s"  \
> GPRINT:d:MAX:"Maximum\:%8.2lf %s\n"
ERROR: invalid rpn expression in: e,i,-

Can you help me with my new CDEF?

[claymen]

ERROR: invalid rpn expression in: e,i,-

It should be b,c,- for your cacti install (total - available)

Although this has been covered numerous times before.

[abdullahteke]

Hi;

I use the claymen's template and script, everything is working with win 2003 server. But when i try to use with win 2008 x_64 server i cant get any information from win 2008 server. I follow steps in the "http://www.solarwinds.com/support/apm/d ... Server.pdf" document to set up the wmi server. But when execute query

/usr/bin/php -q /usr/share/cacti/site/scripts/wmi.php -h '172.18.3.85' -u '/usr/share/cacti/site/scripts/cacti.pwd' -w 'Win32_ComputerSystem' -n '' -k '' -v '' -c 'TotalPhysicalMemory', for host running win 2008 server it returned error message like "NTSTATUS: NT code 0xc002001b - NT code 0xc002001b". But same query run successfully for win 2003 server. Please help.

Run that command again from cmd line with -d1 it will give you the exact wmic query, try running that itself see what it does. It will likely give you a bit better error message. Are permissions ok for the user you are using to remotely WMI? We use this at work against 2008 x64 and have had no issues.

I did your suggestion. And when i try to execute following command, i get error.

root@cacti# /usr/local/bin/wmic --namespace='root\CIMV2' --authentication-file=/usr/share/cacti/site/scripts/cacti.pwd //172.18.3.77 "SELECT CopyRequestsPersec,DeleteRequestsPersec,GetRequestsPersec,HeadRequestsPersec,LockRequestsPersec,MkcolRequestsPersec,MoveRequestsPersec,OptionsRequestsPersec,OtherRequestMethodsPersec,PostRequestsPersec,PropfindRequestsPersec,ProppatchRequestsPersec,PutRequestsPersec,SearchRequestsPersec,TraceRequestsPersec,UnlockRequestsPersec FROM Win32_PerfRawData_W3SVC_WebService WHERE Name='_Total'" -d2
lp_load: refreshing parameters from /dev/null
gensec subsystem fake_gssapi_krb5 is disabled
gensec subsystem gssapi_spnego is disabled
Mapped to DCERPC endpoint 135
Cannot do GSSAPI to an IP address
Failed to start GENSEC client mech gssapi_krb5: NT_STATUS_INVALID_PARAMETER
OK : dcom_create_object.
OK : Create remote WMI object.
lib/com/dcom/main.c:441: dcom_get_pipe: host=172.18.3.77, similar=172.18.3.77[49154]
Successfully connected to OXID 0
OK : Login to remote object.
OK : Login to remote object.
ERROR: WMI query execute.
NTSTATUS: NT code 0xc002001b - NT code 0xc002001b

Please help me.

[claymen]

Does script O matic work on that server locally? It's chucking an error like the WMI query itself is wrong or that the class doesn't exist...

That one you posted is an IIS one which I developed on 2003 with whatever the latest version of IIS was available to install. From memory doesn't 2008 use IIS7?

Do the standard system graphs now work on the 2008 server?

[abdullahteke]

Hi cleymen;
I tried this query on local machine with wbemtest and returned me an object. But when i tried from an other windows machine on network to win 2008 server with wbemtest, it can connect but when i run the query it returned an error like invalid class. Should i change wmi settings on win2008? If it is what settings should i change? Thank you for your helps.

Does script O matic work on that server locally? It's chucking an error like the WMI query itself is wrong or that the class doesn't exist...

That one you posted is an IIS one which I developed on 2003 with whatever the latest version of IIS was available to install. From memory doesn't 2008 use IIS7?

Do the standard system graphs now work on the 2008 server?

[claymen]

Sounds like permissions. Something not allowing you to remotely query that class. Or could potentially be firewall..

[abdullahteke]

On servers firewal is disabled.

Sounds like permissions. Something not allowing you to remotely query that class. Or could potentially be firewall..

[claymen]

Not sure whats causing the problem then. It's from the looks of things permissions being it works locally but doesn't work remotely. There are a few spots like remote DCOM that can affect it but they shouldn't be an issue if using an admin credential.

[abdullahteke]

i use domain admin account. This account is also member of local administration group. Do you change any default settings on your win2008 server?

Not sure whats causing the problem then. It's from the looks of things permissions being it works locally but doesn't work remotely. There are a few spots like remote DCOM that can affect it but they shouldn't be an issue if using an admin credential.

[abdullahteke]

Sory i realized that i wrote wrong namespace in wbemtest. I changed root\cimv2 and i can connect and run query successfully from other win server. But i still get error from linux when i try to run following command

/usr/local/bin/wmic --namespace='root\CIMV2' --authentication-file=/usr/share/cacti/site/scripts/cacti.pwd //172.18.3.77 "SELECT PercentProcessorTime FROM Win32_PerfFormattedData_PerfOS_Processor" -d1
OK : dcom_create_object.
OK : Create remote WMI object.
lib/com/dcom/main.c:441: dcom_get_pipe: host=172.18.3.77, similar=172.18.3.77[49154]
OK : Login to remote object.
OK : Login to remote object.
ERROR: WMI query execute.
NTSTATUS: NT code 0xc002001b - NT code 0xc002001b

Not sure whats causing the problem then. It's from the looks of things permissions being it works locally but doesn't work remotely. There are a few spots like remote DCOM that can affect it but they shouldn't be an issue if using an admin credential.

[claymen]

We havent changed anything except the RPC port range due to firewall restrictions. Other than that they are pretty bog standard. We do have a couple domain policies but nothing that would affect (or enable) anything like this.

[claymen]

What version of the wmi-client are you using?

[abdullahteke]

#wmic -V
Version 4.0.0tp4-SVN-build-UNKNOWN

What version of the wmi-client are you using?