Cacti bug in user management permissions?

[jhermiz1978]

Background:

Windows XP Host
Cacti version 0.8.7i
RRDTool version 1.4
PHP Version 5.3.8

I used the windows installer that member BSOD has in his sig link. I got SNMP enabled on all corresponding devices and can do "walks".
I have went into the following directories and added IIS user as read write access:

c:\rrdtool
c:\inetpub\wwwroot\cacti\rrd
c:\inetpub\wwwroot\cacti

I have tested graphing in a console window using rrdtool graph command and it produces graphs correctly and I can specify a "filename" and get an export of the graph correctly outside of cacti, for instance when I do:

C:/rrdtool/rrdtool.exe graph "myfile.png" --imgformat=PNG --start=1326295084 --end=1326381484 --title="TKKAH-IIS-1 - Logged in Users" --rigid --base=1000 --height=120 --width=500 --alt-autoscale-max --lower-limit=0 COMMENT:"From 2012/01/11 10\:18\:04 To 2012/01/12 10\:18\:04\c" COMMENT:" \n" --vertical-label="users" --slope-mode --font TITLE:10: --font AXIS:7: --font LEGEND:8: --font UNIT:7: DEF:a="C\:/Inetpub/wwwroot/cacti/rra/5/23.rrd":users:AVERAGE AREA:a#4668E4FF:"Users" GPRINTLAST:"Current\:%8.0lf" GPRINTAVERAGE:"Average\:%8.0lf" GPRINTMAX:"Maximum\:%8.0lf\n"

I get back the following:


I have visited the "User Management" page clicked an "Enabled" user whose Default graph policy is "ALLOW". In the realm permissions tab all checkboxes are checked. Graph Permissions tab I have the following:



I have rebooted the machine several times...I have done everything I can think of, including checking the cacti log file:



Nothing looks suspicious...but when I look at any graph in the "Graph Management" section and turning on "Graph Debug Mode" I just see a broken image with the text "Graph Access Denied".

If I then go back to user management and just select "Allow" for all 4 drop downs for graph permissions and I delete all other entries so that I have a default FULL ACCESS to all graphs:



Then I go to a graph management page I see this:



RRDTool doesn't "say" anything. If I take that Graph Debug Mode text and put it in a console window in Dos and run it it produces a graph so nothing is wrong with RRDTool. Something has to be wrong with cacti.

I even went as far as reinstalling cacti using the windows installer on a fresh copy of windows XP. Is there any of the original developers or anyone who can provide some good assistance with this? I've had nothing but "reinstall this" or "check this" with no solid leads.

[BSOD2600]

1) this is a free and open source program. Technical support is free and done when devs/mods have time to assist users.

2) With no graph/realm permissions, do any graphs work?

3) You creating the graphs manually at the commandline and Cacti doing it via the web server use different Windows credentials, which is the likely source of your problem. Sysinternals Process Monitor would reveal this with ACCESS DENIED in the logs when you attempt to view a graph from Cacti.
Whatever your IIS user account is (typically IUSR and/or IIS_IUSRS group), needs read/execute permissions on cmd.exe and rrdtool.exe (plus permissions to traverse to those directories). The installer should've configured these permissions, but if you have a non-standard environment some times this process breaks.

[jhermiz1978]

1) this is a free and open source program. Technical support is free and done when devs/mods have time to assist users.

2) With no graph/realm permissions, do any graphs work?

3) You creating the graphs manually at the commandline and Cacti doing it via the web server use different Windows credentials, which is the likely source of your problem. Sysinternals Process Monitor would reveal this with ACCESS DENIED in the logs when you attempt to view a graph from Cacti.
Whatever your IIS user account is (typically IUSR and/or IIS_IUSRS group), needs read/execute permissions on cmd.exe and rrdtool.exe (plus permissions to traverse to those directories). The installer should've configured these permissions, but if you have a non-standard environment some times this process breaks.

1) I understand that, and this is a forum for asking for help, hence my question

2) no

3)I also used process monitor and there is no "Access Denied" I followed your whole thread on it, filtered it for cacti.
I also do have read write access to the IUSR_LocalMachine account. I also used your installer, there is nothing non-standard about my environment. Its a simple XP fresh copy and the only other thing that was installed was the SNMP services which are required.

[jhermiz1978]

1) this is a free and open source program. Technical support is free and done when devs/mods have time to assist users.

2) With no graph/realm permissions, do any graphs work?

3) You creating the graphs manually at the commandline and Cacti doing it via the web server use different Windows credentials, which is the likely source of your problem. Sysinternals Process Monitor would reveal this with ACCESS DENIED in the logs when you attempt to view a graph from Cacti.
Whatever your IIS user account is (typically IUSR and/or IIS_IUSRS group), needs read/execute permissions on cmd.exe and rrdtool.exe (plus permissions to traverse to those directories). The installer should've configured these permissions, but if you have a non-standard environment some times this process breaks.

I am also willing to host a gotomeeting if it will help you look at my environment to verify ?

[BSOD2600]

3) In PROCMON, do you see cmd.exe getting launched from the IIS service? Is rrdtool.exe launched? If neither is occurring, still some sort of NTFS security issue.

I could possibly take a look this evening once home from work.

[jhermiz1978]

3) In PROCMON, do you see cmd.exe getting launched from the IIS service? Is rrdtool.exe launched? If neither is occurring, still some sort of NTFS security issue.

I could possibly take a look this evening once home from work.

I see everything launching correctly. I guess is it a good idea to remove all devices and readd them? Ive tried that before and didnt have any luck.
I guess to recap all i have done

I installed using the installer (windows version on your sig)
SNMP is working properly as I can do walks and I can see the returned information from cacti.
I have an IUSR and an IWAM user (not sure what the IWAM user is) both have rights to c:\rrdtool, c:\inetpub\wwwroot\cacti, c:\php, c:\windows\system32 (cmd.exe) (read write access)
I have checked user management within cacti and ensured the user has full rights.
I have rebooted several times
As I said prior I can create a graph via the command line (but as you have mentioned its in a different context (user)

Anything else you can think of?

[jhermiz1978]

[quote="BSOD2600"]Where do the actual graphs get generated or stored? Could this be where the permissions are failing??
The data Cacti collects from devices are stored in the *.rrd files, which rrdtool.exe uses (rrdtool update). With logging mode set to debug, you can see all the details of what cacti is doing under the convers -- including rrdtool commands. The rrdtool graph command is what actually generates the image (as youve done from the CLI). The IIS user account receives the request for the graph, hands it to Cacti which says to start cmd.exe along with passing it the rrdtool graph command string.