Monitor Windows via WMI from Cacti on Linux

[garnser]

So 0.0.6 worked fine on one of my hosts, I've tried on a second host now and it seams that there's issues creating the RRD files:

/usr/bin/rrdtool graph - \
--imgformat=PNG \
--start=-86400 \
--end=-300 \
--title="vsrv1 - Disk I/O" \
--base=1000 \
--height=120 \
--width=500 \
--alt-autoscale-max \
--lower-limit=0 \
--vertical-label="Operations Per Sec" \
--slope-mode \
--font TITLE:9: \
--font AXIS:7: \
--font LEGEND:8: \
--font UNIT:7: \
DEF:a="/var/lib/cacti/rra/vsrv1_writespersec_1209.rrd":ReadsPersec:AVERAGE \
DEF:b="/var/lib/cacti/rra/vsrv1_writespersec_1209.rrd":WritesPersec:AVERAGE \
DEF:c="/var/lib/cacti/rra/vsrv1_writespersec_1209.rrd":QueueLength:AVERAGE \
CDEF:cdefa=b,8,* \
AREA:cdefa#BCBEB3FF:"Total\:" \
GPRINT:cdefa:LAST:" Current\:%8.2lf %s" \
GPRINT:cdefa:AVERAGE:"Average\:%8.2lf %s" \
GPRINT:cdefa:MAX:"Maximum\:%8.2lf %s\n" \
LINE1:a#FF0000FF:"Read\:" \
GPRINTLAST:" Current\:%8.2lf %s" \
GPRINTAVERAGE:"Average\:%8.2lf %s" \
GPRINTMAX:"Maximum\:%8.2lf %s\n" \
LINE1:b#002A97FF:"Write\:" \
GPRINTLAST:" Current\:%8.2lf %s" \
GPRINTAVERAGE:"Average\:%8.2lf %s" \
GPRINTMAX:"Maximum\:%8.2lf %s\n" \
LINE1:c#000000FF:"Queue Length\:" \
GPRINT:c:LAST:"Current\:%8.2lf %s" \
GPRINT:c:AVERAGE:"Average\:%8.2lf %s" \
GPRINT:c:MAX:"Maximum\:%8.2lf %s\n"
RRDTool Says:
ERROR: opening '/var/lib/cacti/rra/vsrv1_writespersec_1209.rrd': No such file or directory

As far as I can see all permissions are correct (regular snmp pollers works fine), please advice, the difference on this host is that I'm using spine instead.

If I run the rrdtool create manually as the user no errors appear:
www-data@mon:/var/lib/cacti/rra$ /usr/bin/rrdtool create \
> /var/lib/cacti/rra/vsrv1_writespersec_1210.rrd \
> --step 300 \
> DS:WritesPersec:COUNTER:600:0:500000 \
> DS:ReadsPersec:COUNTER:600:0:500000 \
> DS:QueueLength:GAUGE:600:0:10000 \
> DS:WriteBytesPersec:COUNTER:600:0:500000 \
> DS:ReadBytesPersec:COUNTER:600:0:500000 \
> RRA:AVERAGE:0.5:1:500 \
> RRA:AVERAGE:0.5:1:600 \
> RRA:AVERAGE:0.5:6:700 \
> RRA:AVERAGE:0.5:24:775 \
> RRA:AVERAGE:0.5:288:797 \
> RRA:MAX:0.5:1:500 \
> RRA:MAX:0.5:1:600 \
> RRA:MAX:0.5:6:700 \
> RRA:MAX:0.5:24:775 \
> RRA:MAX:0.5:288:797 \
>

www-data@mon:/var/lib/cacti/rra$ ls -ltra vsrv1_writespersec_1210.rrd
-rw-r--r-- 1 www-data www-data 276344 2010-01-18 14:11 vsrv1_writespersec_1210.rrd
www-data@mon:/var/lib/cacti/rra$

Update:
It seams that wmi does something nasty, for some reason I couldn't create any new graphs (got the same error) once I removed wmi it worked fine again.

[claymen]

What do you mean something nasty? More information needed.

I'm not sure how you are having all these problems, it almost sounds like your cacti install itself isn't quite 100%. The RRD side of things is entirely handled by cacti. Really all my script is, is an interface between cacti (and what it expects as input/output) and the wmic binary. That and the templates.

If you have just swapped to spine make sure that the user spine runs as can actually read/write to the RRD files and also create files where the RRD files are stored. As from memory the RRD files are not generated until the first time they are polled.

But yer I'm not sure how those templates would cause *any* issue creating new graphs as they are purely templates. No actual code in cacti is touched.

[Taltos]

to claymen:
for me now all works well I deploy slowly scripts and it's good !

Many thx for your work and the time passed to help us



For garnser:
if like me, you have many pb, restart from scratch, delete cacti directory if necessary and be sure that localhost script works well, then import just a template (memory usage for me) use only this one until it's working
PS: when rrd wasn't create it's a permission pb
PS2: Rebuild Poller Cache work's well !
good luck !

T

[lupick]

Dear All,

I've latest version of cacti running wmi template. I've a problem checing the Process Stats template

if I manually run this command to monitor ctfmon.exe:


/usr/bin/php -q /www/cacti/scripts/wmi.php -h 'MYHOST' -u '/etc/cacti/cactiwmi.pw' -w 'Win32_PerfRawData_PerfProc_Process' -n '' -k 'Name' -v 'ctfmon.exe' -c 'ThreadCount,HandleCount,PrivateBytes,VirtualBytes,PageFileBytes,PercentPrivilegedTime,PercentProcessorTime,PercentUserTime'

but I have no answare. I've tried different exe but no luck.
Do you have any idea??

thanks

L.

[Taltos]

try with ctfmon (without .exe)

works for me

Edit
if the process run more than one time for exemple "explorer" who run for each user connected it's doen't work for me

[claymen]

try with ctfmon (without .exe)

works for me

Edit
if the process run more than one time for exemple "explorer" who run for each user connected it's doen't work for me

That is correct, because when you have multiple instances of the same process running it will return multiple rows back. From memory you can't filter down per user on them but I really didn't need to as the process I needed to monitor only allowed a single instance per system.

[Taltos]

Cleymen could you try to help me again ?

I have 2pb wih 2 exchange grah


first:Active Client Logons doesn't work

Code: Select all

RRDTool Command:

/usr/bin/rrdtool graph - \
--imgformat=PNG \
--start=-86400 \
--end=-300 \
--title="srvexch - Active Client Logons" \
--base=1000 \
--height=120 \
--width=500 \
--alt-autoscale-max \
--lower-limit=0 \
--vertical-label="Logons" \
--slope-mode \
--font TITLE:12: \
--font AXIS:8: \
--font LEGEND:10: \
--font UNIT:8: \
LINE1:#000000FF:"Total\:"  \
GPRINT::LAST:"    Current\:%8.0lf"  \
GPRINT::AVERAGE:"Average\:%8.0lf"  \
GPRINT::MAX:"Maximum\:%8.0lf\n"  \
LINE1:#FF0000FF:"Database5\:"  \
GPRINT::LAST:"Current\:%8.0lf"  \
GPRINT::AVERAGE:"Average\:%8.0lf"  \
GPRINT::MAX:"Maximum\:%8.0lf\n"  \
LINE1:#0000FFFF:"Database4\:"  \
GPRINT::LAST:"Current\:%8.0lf"  \
GPRINT::AVERAGE:"Average\:%8.0lf"  \
GPRINT::MAX:"Maximum\:%8.0lf\n"  \
LINE1:#FFAB00FF:"Database3\:"  \
GPRINT::LAST:"Current\:%8.0lf"  \
GPRINT::AVERAGE:"Average\:%8.0lf"  \
GPRINT::MAX:"Maximum\:%8.0lf\n"  \
LINE1:#28CF21FF:"Database2\:"  \
GPRINT::LAST:"Current\:%8.0lf"  \
GPRINT::AVERAGE:"Average\:%8.0lf"  \
GPRINT::MAX:"Maximum\:%8.0lf\n"  \
LINE1:#55009DFF:"Database1\:"  \
GPRINT::LAST:"Current\:%8.0lf"  \
GPRINT::AVERAGE:"Average\:%8.0lf"  \
GPRINT::MAX:"Maximum\:%8.0lf\n" 

RRDTool Says:

[b]ERROR: parameter '#000000FF' does not represent a number in line LINE1:#000000FF:Total\:[/b]

I 'va try many template version without succes

thx for your opinion !

[claymen]

The active client logons is one that you have to create as a templated graph then switch to no template so that you can edit. E.g. this is because there was no way to vary the number of databases shown dynamically in cacti.

As in it can't auto detect you have 6 databases and create a single graph to show them all with correct names. You kinda can with a data query but still.. So yes create the graph, then set it to no template so you can edit and then add in your data sources for each database you want to see active client logons and then name them if you wish.

But its one you have to do some manual work on.

[Taltos]

Wonderfull !

so, my last pb (really) is for Total Mailbox Items.

graph say

Code: Select all

"Nan"

RRDtools say:

Code: Select all

  	 RRDTool Command:

/usr/bin/rrdtool graph - \
--imgformat=PNG \
--start=-86400 \
--end=-300 \
--title="srvexch - Total Mailbox Items" \
--base=1000 \
--height=120 \
--width=750 \
--alt-autoscale \
--units-exponent=2 \
--vertical-label="Items" \
--slope-mode \
--font TITLE:12: \
--font AXIS:8: \
--font LEGEND:10: \
--font UNIT:8: \
DEF:a="/var/www/cacti/rra/srvexch_totalitems_179.rrd":TotalItems:AVERAGE \
AREA:a#FF000033:""  \
LINE1:a#FF0000FF:"Items\:"  \
GPRINT:a:MIN:"Minimum\:%8.0lf"  \
GPRINT:a:AVERAGE:"Average\:%8.0lf"  \
GPRINT:a:MAX:"Maximum\:%8.0lf" 

RRDTool Says:

OK

I think problem came from "Filter Value" in data source.

if I run

Code: Select all

intranet:/tmp# wmic -d0 --authentication-file=/etc/cacti/cactiwmi.pw //172.16.1.4 "SELECT Name FROM Win32_PerfRawData_MSExchangeIS_MSExchangeISMailbox"

say

Code: Select all

CLASS: Win32_PerfRawData_MSExchangeIS_MSExchangeISMailbox
Name
pgs1-Bal1
_Total

So I have put in filter Value pgs1-Bal1 oo 'pgs1-Bal1'
but it 'doesn't work

any ideas ?


thx (again)

[claymen]

What comes back if you do

wmic -d0 --authentication-file=/etc/cacti/cactiwmi.pw //172.16.1.4 "SELECT * FROM Win32_PerfRawData_MSExchangeIS_MSExchangeISMailbox"

[Taltos]

no errors:

Code: Select all

intranet:/tmp# wmic -d0 --authentication-file=/etc/cacti/cactiwmi.pw //172.16.1.4 "SELECT * FROM Win32_PerfRawData_MSExchangeIS_MSExchangeISMailbox"
CLASS: Win32_PerfRawData_MSExchangeIS_MSExchangeISMailbox
ActiveClientLogons|AverageDeliveryTime
|Caption|CategorizationCount|ClientLogons|Description|FolderopensPersec|Frequency_Object|Frequency_PerfTime|Frequency_Sys100NS|
HTTPDAVCurrentPendingNotifications|HTTPDAVCurrentSubscriptions|HTTPDAVCurrentTransactionLocks
|HTTPDAVNotifyRequestsPersec|HTTPDAVTotalLocksCreated|HTTPDAVTotalNotifyRequests
|HTTPDAVTotalSubscriptionsCreated|HTTPDAVTotalSubscriptionsExpired|Localdeliveries
|Localdeliveryrate|LogonOperationsPersec|
MessageOpensPersec|MessageRecipientsDelivered|MessageRecipientsDeliveredPermin
|MessagesDelivered|MessagesDeliveredPermin|MessagesSent|MessagesSentPermin|MessagesSubmitted|MessagesSubmittedPermin|Name|PeakClientLogons|ReceiveQueueSize
|RestrictedViewCacheHitRate|RestrictedViewCacheMissRate
|SearchTaskRate|SendQueueSize|SingleInstanceRatio|SingleInstanceRatio_Base|SlowFindRowRate
|Timestamp_Object|Timestamp_PerfTime|Timestamp_Sys100NS
|TotalCountofRecoverableItems|TotalSizeofRecoverableItems
70|15655|(null)|4|105|(null)|19811|0|1595970000|10000000|0|0|0|0|0|0|6|6|569|569|1875|3870|572|1|569|1|237|0
|220|0|pgs1-Bal1|250|0|745|13|18
|0|154236|6427200|496|0|187444300778880|1174485114000|7068|1061180
70|15655|(null)|4|105|(null)|19811|0|1595970000|10000000|0|0|0|0|0|0|6|6|569|569|1875|3870|572|1|569|1|237|0|220|0|_Total|250|0|745|13|18|0|154236|6427200|496|0|187444300778880|1174485114000|7068|1061180
intranet:/tmp#

But If un run

Code: Select all

/usr/bin/php -q /var/www/cacti/scripts/wmi.php -h '172.16.1.4' -u '/etc/cacti/cactiwmi.pw' -w 'Exchange_Mailbox' -n 'rootMicrosoftExchangeV2' -k 'MailboxDisplayName' -v 'pgs1-Bal1' -c 'Size,TotalItems,DeletedMessageSizeExtended'

(I'have found this commande in poller cache

Return code non-zero, debug mode enabled!
/usr/local/bin/wmic --namespace='rootMicrosoftExchangeV2' --authentication-file=/etc/cacti/cactiwmi.pw //172.16.1.4 "SELECT Size,TotalItems,DeletedMessageSizeExtended FROM Exchange_Mailbox WHERE MailboxDisplayName='pgs1-Bal1'" 2>/dev/null
Exec Status: 1

[claymen]

It looks like these columns Size,TotalItems,DeletedMessageSizeExtended don't exist on your exchange server's WMI output. Is this exchange 2007 or 2003? I haven't tested that per mailbox query on a 2007 mailbox.

[Taltos]

It looks like these columns Size,TotalItems,DeletedMessageSizeExtended don't exist on your exchange server's WMI output. Is this exchange 2007 or 2003? I haven't tested that per mailbox query on a 2007 mailbox.

*

it's exchange 2003

[claymen]

Hang on im confused.

On one spot your passing --namespace='rootMicrosoftExchangeV2' is it just the forum removing the \?

And earlier your querying a completely different class
wmic -d0 --authentication-file=/etc/cacti/cactiwmi.pw //172.16.1.4 "SELECT * FROM Win32_PerfRawData_MSExchangeIS_MSExchangeISMailbox"
CLASS: Win32_PerfRawData_MSExchangeIS_MSExchangeISMailbox

Which is it?

What happens when you query this?

/usr/local/bin/wmic --namespace='root\MicrosoftExchangeV2' --authentication-file=/etc/cacti/cactiwmi.pw //172.16.1.4 "SELECT Size,TotalItems,DeletedMessageSizeExtended FROM Exchange_Mailbox WHERE MailboxDisplayName='pgs1-Bal1'"

If you run scriptomatic2 can you even pull data from that class from the MicrosoftExchangeV2 root?

[Taltos]

Hang on im confused.

On one spot your passing --namespace='rootMicrosoftExchangeV2' is it just the forum removing the \?

And earlier your querying a completely different class
wmic -d0 --authentication-file=/etc/cacti/cactiwmi.pw //172.16.1.4 "SELECT * FROM Win32_PerfRawData_MSExchangeIS_MSExchangeISMailbox"
CLASS: Win32_PerfRawData_MSExchangeIS_MSExchangeISMailbox

Which is it?

Code: Select all

intranet:/tmp# wmic -d0 --authentication-file=/etc/cacti/cactiwmi.pw //172.16.1.4 "SELECT * FROM Win32_PerfRawData_MSExchangeIS_MSExchangeISMailbox"
CLASS: Win32_PerfRawData_MSExchangeIS_MSExchangeISMailbox
ActiveClientLogons|AverageDeliveryTime|Caption|CategorizationCount|ClientLogons|Description
|FolderopensPersec|Frequency_Object|Frequency_PerfTime|Frequency_Sys100NS|HTTPDAVCurrentPendingNotifications|HTTPDAVCurrentSubscriptions|HTTPDAVCurrentTransactionLocks
|HTTPDAVNotifyRequestsPersec|HTTPDAVTotalLocksCreated|HTTPDAVTotalNotifyRequests|HTTPDAVTotalSubscriptionsCreated|HTTPDAVTotalSubscriptionsExpired|Localdeliveries
|Localdeliveryrate|LogonOperationsPersec|MessageOpensPersec|MessageRecipientsDelivered
|MessageRecipientsDeliveredPermin
|MessagesDelivered|MessagesDeliveredPermin|MessagesSent|MessagesSentPermin|MessagesSubmitted|MessagesSubmittedPermin|Name|PeakClientLogons|ReceiveQueueSize|RestrictedViewCacheHitRate
|RestrictedViewCacheMissRate|SearchTaskRate|SendQueueSize|SingleInstanceRatio|SingleInstanceRatio_Base|SlowFindRowRate|Timestamp_Object|Timestamp_PerfTime|Timestamp_Sys100NS
|TotalCountofRecoverableItems|TotalSizeofRecoverableItems
46|22123|(null)|4|177|(null)|42731|0|1595950000|10000000|0|0|0|0|0|0|6|6|890|890|2447|3294|892|3|890|3|274|3|267
|3|pgs1-Bal1|223|0|1205|16|31|0|155298|6508100|372|0|131378009194085|823196273000|7029|920720
46|22123|(null)|4|177|(null)|42731|0|1595950000|10000000|0|0|0|0|0|0|6|6|890|890|2447|3294|892|3|890|3|274|3|267|3
|_Total|223|0|1205|16|31|0|155298|6508100|372|0|131378009194085|823196273000|7029|920720

What happens when you query this?

/usr/local/bin/wmic --namespace='root\MicrosoftExchangeV2' --authentication-file=/etc/cacti/cactiwmi.pw //172.16.1.4 "SELECT Size,TotalItems,DeletedMessageSizeExtended FROM Exchange_Mailbox WHERE MailboxDisplayName='pgs1-Bal1'"

Code: Select all

intranet:/tmp# /usr/local/bin/wmic --namespace='root\MicrosoftExchangeV2' --authentication-file=/etc/cacti/cactiwmi.pw //172.16.1.4 "SELECT Size,TotalItems,DeletedMessageSizeExtended FROM Exchange_Mailbox WHERE MailboxDisplayName='pgs1-Bal1'"
(works 2sec then:)
intranet:/tmp#

If you run scriptomatic2 can you even pull data from that class from the MicrosoftExchangeV2 root?