Cacti & NetSaint/Nagios NSClient Scripts to monitor Wind

[Jazzee]

NSClient is the NetSaint Windows Client - a plugin used by NetSaint/Nagios to monitor all kinds of information on Windows 2000, NT and XP. I have created Cacti scripts to poll the NSClient and import the values into the Cacti Graphs.

---
check_nt_cpu.pl <ip address>
---
#!/usr/bin/perl

$response = `/bin/check_nt -H $ARGV[0] -p 1248 -v CPULOAD -l 10,80,95`;
chomp $response;
($load) = ($response =~ /min. (\d+)\%\)/);

print "$load\n";


---
check_nt_disk.pl <ip address> <drive letter>
---
#!/usr/bin/perl

$response = `/bin/check_nt -H $ARGV[0] -p 1248 -v USEDDISKSPACE -l $ARGV[1]`;
chomp $response;
($used,$percent) = ($response =~ /used: (\d+\.\d+) Gb \((\d+)\%\)/);

print "$used\n";

---
check_nt_disk_percent.pl <ip address> <drive letter>
---
#!/usr/bin/perl

$response = `/bin/check_nt -H $ARGV[0] -p 1248 -v USEDDISKSPACE -l $ARGV[1]`;
chomp $response;
($used) = ($response =~ /used: \d+\.\d+ Gb \((\d+)\%\)/);

print "$used\n";


---
check_nt_memuse.pl <ip address>
---
#!/usr/bin/perl

$response = `/bin/check_nt -H $ARGV[0] -p 1248 -v MEMUSE`;
chomp $response;
($used) = ($response =~ /used: (\d+\.\d+) Mb/);

print "$used\n";


---
check_nt_memuse_percent.pl <ip address>
---
#!/usr/bin/perl

$response = `/bin/check_nt -H $ARGV[0] -p 1248 -v MEMUSE`;
chomp $response;
($used) = ($response =~ /used: \d+.\d+ Mb \((\d+)\%\) /);

print "$used\n";



Hope this of use to others. I find this to be very fast and more effective then to using snmp.

Jaz

[khemir]

this works cool in RedHat...

but, not in FreeBSD 4.4... in a fact whan i run
manualy the result is difrent for ej:

in freebsd is:
CPU Load (10 min. 3)

in RedHat is:
CPU Load (10 min. 3%)

i believe is the same version of plugins...
but, how correct script ???
i think this is error (\d+)\%\)/); only in freebsd, becouse in redhat work fine...

thanks..

[cpdans]

This looks great...where do I get the scripts from?

[Jazzee]

This looks great...where do I get the scripts from?

You will need to have Nagios installed and have NSClient installed on the Windows environments. The scripts for Cacti are included above in the original message. The code is small because all that is required is to grab the results from NSClient.

Jazzee

[Jazzee]

To correct the error for FreeBSD you need to modify (\d+)\%\)/); to be (\d+)\)/);

That should make it work if FreeBSD is not producing the % sign. You may be running the same version of the plugins but the NSClient Server plugin for Nagios may not have the %. This would be the case if you downloaded the compiled code instead of compiling it yourself.

Jazzee

this works cool in RedHat...

but, not in FreeBSD 4.4... in a fact whan i run
manualy the result is difrent for ej:

in freebsd is:
CPU Load (10 min. 3)

in RedHat is:
CPU Load (10 min. 3%)

i believe is the same version of plugins...
but, how correct script ???
i think this is error (\d+)\%\)/); only in freebsd, becouse in redhat work fine...

thanks..

[yid]

Something cool about this is that you can collect data from any of the windows performance counters. Just check out the nsclient docs for command details.

here's the nsclient page: http://nsclient.ready2run.nl/

[klavs]

Only problem I have with this approach, is that every data is collected twice(!). once by Nagios, and once by Cacti.

What I would prefer to do, is to setup Nagios to store the values it monitors in rrd-files, so that Cacti can monitor those rrd-files.

This also ensures that Cacti and Nagios is actually looking at the same data.

[Jazzee]

[quote="klavs"]Only problem I have with this approach, is that every data is collected twice(!). once by Nagios, and once by Cacti.

What I would prefer to do, is to setup Nagios to store the values it monitors in rrd-files, so that Cacti can monitor those rrd-files.

This also ensures that Cacti and Nagios is actually looking at the same data.[/quote]

I do not recommend this because you can not guarentee that nagios will perform the checks within the appropriate intervals. From my point of view, the traffic is very low with the NSClient (it is a lot less intensive then SNMP).

It is possible to use Nagios to gather the data but it is a lot more complex because you are parsing data through multiple scripts.

I found this to be the easiest.

Shannon

[yid]

I agree that data should be gathered only once. How about using a netsaint/nagios plugin to check the RRDs that cacti creates.

If you're interested, I'll finish it up while I'm on vacation

If your netsaint/nagios installation is on a different server from cacti, you'll have to either use netsaint_statd or nrpe.

Aaron

[klavs]

that's fine too. Either way is fine - as long as one is sure the data can be collected as needed.

As I see it (without being the expert on Nagios) - it allows for individual schedueling for each service - in how big a time interval it should have between checks. This is not allowed for in Cacti, which is rather simple in it's check schedueling. This is why I preferred letting Nagios do the checking - as one can also see when the next check will be performed etc.

Am I wrong here? Jazzee seems to think so.

Best regards,

Klavs Klavsen
Denmark

[Jazzee]

I have no problems with how others collect the data. The issue that I see depends on how big your installation of Nagios is. Nagios schedules checks and it may not be able to complete the checks within the 5 minute timeframe for the RRD.

If Nagios takes approximately 10 minutes before it is able to gather the data then RRD is based on 10 minute intervals, as Nagios would consistently perform the scans every 10 minutes. To reduce this Nagios would need to be set up over distributed servers and this increases the complexity.

It all depends on the size of the Nagios installation.

With Cacti performing the scans then Cacti can be running on another server and not affect the performance of Nagios Notification Monitoring.

Jazzee

[RussB]

These scripts are great - much slicker than SNMP however I have a slight problem with the CPU check whereby it does not return any data (just a blank line). There is nothing wrong with the script as a I have installed in on my home setup and it works fine but I cannot get it to work on my work setup. The other scripts work fine. Also running check_nt manually also works. I was wondering if there are maybe any dependencies that I might be missing from my work installation, may be some perl components.

I run Mandrake 9.1 (both home and work), latest Nagios plugins. I have run the scripts outside of the Cacti framework so I have rules that out as well.

Sorry this is a bit vague but I'm out of ideas. Any help would be great.

Regards Russ

[Jazzee]

There is really nothing to these scripts as they only call the check_nt plugin from Nagios to retrieve the result.

To test to see if this is working correctly try the follow on the cmd line:

/bin/check_nt -H [IP Address] -p 1248 -v CPULOAD -l 10,80,95

Replace [IP Address] with your Windows IP address

[kwabbernoot]

Hi,

At our environment we also use Nagios to monitor the performance of our Servers and after playing around with Cacti on Linux and Windows systems I can only agree that this is one of the best ways to monitor Windows.

SNMP on windows can not be trusted on our systems because after installation of Hotfixes/SP's some monitored SNMP counters just stopped responding and I did not find a way to reactive them.

Using Cacti on Windows did not help either, the cacti cmd.php script runs too long to have good results and my WMI interrogation results gave problems with authentication when run via "Scheduled Tasks". For windows it may be good to include extra authentication fields into the Cacti polling section, "SNMP username" does not handle the 'Domain\UserID' of Windows Authentication very well

Another big advantage of (L)Unix is that Cacti has the "cactid" C poller that runs much faster than cmd.php. OK, it still has some issues but I was able to work around them.

One problem that I ran into with the "check_nt" soft is that it is impossible to interrogate PerfMon counters that use a ',' in their counter name. Check_nt sees the ',' as a special char and uses the syntax after the',' as counter description. I know that there are probably not many counters that have a ',' char, but if you are looking for them check out the perfmon counters of AntiGen v7 for Exchange 2000 and 5.5

The good thing is that "check_nt" is open source and so you are able to change the way it handles the ',' in its query

Cacti on people,

[Jazzee]

One problem that I ran into with the "check_nt" soft is that it is impossible to interrogate PerfMon counters that use a ',' in their counter name. Check_nt sees the ',' as a special char and uses the syntax after the',' as counter description. I know that there are probably not many counters that have a ',' char, but if you are looking for them check out the perfmon counters of AntiGen v7 for Exchange 2000 and 5.5

What PerfMon counters do you have set up and monitoring? I would like to get more counters installed for Exchange but finding this a difficult task to find the proper counters.

Jaz