[HOWTO] Fetching WMI data from Linux

If you figure out how to do something interesting/cool in Cacti and want to share it with the community, please post your experience here.

Moderators: Developers, Moderators

ehall
Cacti User
Posts: 246
Joined: Fri Dec 09, 2005 3:42 pm

[HOWTO] Fetching WMI data from Linux

Post by ehall »

WMI is just WBEM, but uses a different transport protocol than stock WBEM, which typically uses HTTP over TCP/5988 or HTTPS over TCP/5989. They also use slightly different namespaces. Apart from that they are mostly identical however, and if you use a WBEM-WMI gateway it is a no brainer.

OpenPegasus has a gateway called wmimapper that runs on Win32 systems, and provides a WBEM-WMI translation layer. You can download the source from there and compile it, or you can use the pre-compiled package from HP (I am pretty sure this is public-use since its the same code and there's no link to buy or anything). Either way you need to install the binary onto a Windwos system that has access to the WMI pools you want to read.

Find a WBEM client utility for Linux. I am using wbemcli which compiled really easy on my SUSE 9.3 system. Other tools are around if you look for them.

Use the WBEM tool to query the WMImapper gateway, but instead of using the /root/cimv2 namespace, use /$host/root/cimv2 to identify the Win32 system you want to query. This is basically like using \\host\cim\namespace in WMI tools, but you are using /host/cim/namespace instead.

Here is an example using wbemcli to query the host RHINO for its OEMStringArray data:

Code: Select all

wbemcli -nl gp 'http://w2k3ee.labs.ntrg.com:5988/rhino/root/cimv2:Win32_ComputerSystem.Name="RHINO"' OEMStringArray
Intel Nocona/LindenHurst/ICH5R ,Supermicro motherboard X6DH8XG2
The WBEM query is sent to the default WBEM-over-HTTP channel to w2k3ee.labs.ntrg.com, with the namespace set to /rhino/root/cimv2 which tells the gateway what to query via WMI. After that, its just regular request for the Win32_ComputerSystem class, and the OEMStringArray property. RHINO returns the answer to the w2k3ee via WMI, which returns the data back to the wbemcli client via WBEM.
geoffmciver
Posts: 3
Joined: Mon Apr 03, 2006 6:00 pm

Post by geoffmciver »

How did you get PerfFormattedData instances. For some reason WBEMCLI does not like you specifying =@ for a key.

I.e Win32_PerfFormattedData_PerfOS_Memory=@

I can get instances that have Keys and these only seem to be providers that have more than one instance.
User avatar
Viggy
Posts: 23
Joined: Fri Sep 16, 2005 5:15 pm
Location: MI, USA

WMIMapper and Wbemcli

Post by Viggy »

Can you shed a little more light on how you did this.

I have WMIMapper installed on a windows server and WBEMCLI on my linux cacti server but it is unable to retrieve anything
User avatar
Viggy
Posts: 23
Joined: Fri Sep 16, 2005 5:15 pm
Location: MI, USA

WBEMCLI

Post by Viggy »

Got it working

Very cool

Now I just have to convert my scripts
geoffmciver
Posts: 3
Joined: Mon Apr 03, 2006 6:00 pm

Post by geoffmciver »

did you have any luck getting instances with the "=@" key?

if you did.... How!!
dermoth
Posts: 7
Joined: Thu Jul 13, 2006 10:39 am

Post by dermoth »

Any reason to use this method instead of NSClient? is it any faster?
langanm
Posts: 1
Joined: Tue Aug 22, 2006 1:55 pm

What can I get through WMIMapper?

Post by langanm »

Understanding that there are namespaces and CIMv2 stuff to query; does anyone know where i can get a tutorial or docs on what data I can get with the Pegasus WMIMapper and how I format a query line from a tool like WBEMCLI?

Thanks,
Mark
ehall
Cacti User
Posts: 246
Joined: Fri Dec 09, 2005 3:42 pm

Post by ehall »

Here are some very brief instructions on getting the WMI Mapper and wbemcli stuff working.

First, download and install the WMI Mapper package linked above from HP. Then go into the directory where you installed it. In that directory is a file called "cimserver_planned.conf" and another file called "cimserver_current.conf". The "planned" file is read whenever the service starts, and is then copied over the "current" file (yeah its weird but there ya have it).

Edit the cimserver_planned.conf file, and (1) disable the HTTPS service for now, and (2) enable the regular HTTP service. Later on you can come back and do what's needed to get the "secure" WBEM channel working, which essentially involves creating certificates and private keys for the mini HTTPS daemon, but for now just turn it off. The daemon won't run if there are any HTTPS problems so just turn it off. Is it off?

Restart the Pegasus WMI Mapper service, and then make sure that something is listening on TCP port 5988 (that's the WBEM-over-HTTP port, while 5989 is the WBEM over HTTPS port).

If its running and listening, you can connect to it with a WBEM client like wbemcli by providing the full URL of the WBEM-HTTP service. Essentially wbemcli is just a front-end wrapper for a regular HTTP agent, so you have to provide all of the HTTP details, including authentication stuff, the fully-qualified domain name of the host, the target namespace, the target class, etc. You have to conform completely to the HTTP specs here, and this bites a lot of people in the rear. Like, you really have to specify the fully-qualified domain name, because that's part of the HTTP specs.

Also, make sure that the account you specify in the HTTP auth has sufficient credentials to read WMI data. I use the administrator account for testing. There are some docs around that tell you how to open up the WMI security and the COM protocol (both need to be opened), but that's way outside this posting.

"wbemcli ec" will give you a list of all classes in a specific branch of the namespace. For example, to list all of the classes in the /root/cimv2 part of the namespace, use the following:

Code: Select all

$ wbemcli -nl ec 'http://username:password@fully.qualified.domain.name:5988/root/cimv2'
Better pipe that to a file or something, cause it's usually a lot of data. Microsoft also has a WMI Browser tool in their WMI Admin Tools kit (requires IE) that is pretty handy for this stuff but not much easier to use.

Once you know a class, you can query for it directly with the "gc" option. Using wbemcli to query for information about the Win32_PerfFormattedData class itself would be:

Code: Select all

$ wbemcli -nl gc 'http://username:password@fully.qualified.domain.name:5988/root/cimv2:Win32_PerfFormattedData'
That will return basic information about the class proper (not information about any instances of the class though--we'll get to that in a moment).

Due to the way that this stuff is architected, the perfmon namespace is organized as peers, not hierarchical. So if you wanted to query for (say) PerfDisk/LogicalDisk performance counters you would basically need to query for the Win32_PerfFormattedData_PerfDisk_LogicalDisk class.

Using wbemcli, this would be:

Code: Select all

$ wbemcli -nl gc 'http://username:password@fully.qualified.domain.name:5988/root/cimv2:Win32_PerfFormattedData_PerfDisk_LogicalDisk'
That would return a list of all the properties (attributes, fields, whatever) associated with the class:

Code: Select all

-AvgDiskBytesPerRead
-AvgDiskBytesPerTransfer
-AvgDiskBytesPerWrite
-AvgDiskQueueLength
-AvgDiskReadQueueLength
-AvgDisksecPerRead
[...]
From there you can do the stuff you really want. You can enumerate the instances of the class with "wbemcli ei":

Code: Select all

$ wbemcli -nl ei 'http://username:password@fully.qualified.domain.name:5988/root/cimv2:Win32_PerfFormattedData_PerfDisk_LogicalDisk'

_LogicalDisk.Name="C:"
-FreeMegabytes=181257
-PercentFreeSpace=59
-PercentIdleTime=100
[...]
You can query for a specific class by name, using "wbemcli gc" and then specifying the property/value pair:

Code: Select all

$ wbemcli -nl gi 'http://username:password@fully.qualified.domain.name:5988/root/cimv2:Win32_PerfFormattedData_PerfDisk_LogicalDisk.Name="_Total"'

_LogicalDisk.Name="_Total"
-AvgDiskBytesPerRead=0
-AvgDiskBytesPerTransfer=0
-AvgDiskBytesPerWrite=0
-AvgDiskQueueLength=0
-AvgDiskReadQueueLength=0
-AvgDisksecPerRead=0
[...]
Note that using a property value of "C:" would be illegal HTTP syntax so the ":" would have to be hex-escaped for the command line (eg, Name="C%3A").

You can also use the "gp" query to ask for a specific property value associated with a specific instance. For example, asking for the Free Megabytes would be:

Code: Select all

$ wbemcli -nl gp 'http://username:password@fully.qualified.domain.name:5988/root/cimv2:Win32_PerfFormattedData_PerfDisk_LogicalDisk.Name="_Total" FreeMegabytes'
181257
where "181257" is the value of the FreeMegabytes property associated with the "_Total" instance.

Note that the above does not seem to work with "C%3A" and I'm not sure why not. Trying to specify "C:" causes errors with the HTTP transport part, but "C%3A" doesn't get mapped to WMI correctly it seems. Probably a bug in the WMI Mapper's HTTP listener, dunno. The source is up to v2.52 or something and the HP kit is still at v2.1 or whatever, but I don't know of any other precompiled binaries out there.

I have similar problems with some other classes. Like, asking wbemcli to enumerate all the instances of the /root/cimv2:LogicalDisk class will return a list of all the drives, with naming properties of ".DeviceID" but I can't seem to query for a specific instance by specifying the DeviceID. This is probably be a variation on the .Name="C%A" problem above, dunno.

Another problem -- and who knows where it is cause there's so many components here -- is that non-instanced classes cannot seem to be queried by name. For example, you can pull in memory peformance counters if you enumerate the class (there's only one instance), but you cannot seem to query the single instance by name="@" or the hex escape equivalent. You can just use the enumerate instance (ei) and achieve the same results, so this isn't a big deal really.

One cool thing about the WMI Mapper tool is that it's a WBEM-to-WMI proxy, and once the data is converted to WMI you can query any running host on the WMI side of the network. To do this, put the target NetBIOS name before the /root/ part of the path. For example:

Code: Select all

$ wbemcli -nl gc 'http://username:password@fully.qualified.domain.name:5988/OTHERHOST/root/cimv2:Win32_PerfFormattedData'
and that will cause the WBEM-HTTP query to be converted to WMI-COM and directed to OTHERHOST for processing. As long as your credentials are good you'll be able to query the other target.

One other thing to note, the above trick does not work with the "local" machine that is acting as the gateway. It can only be queried through the /root/ branch directly, not by system name. I don't know if that's part of the WMI spec, part of the WMI Mapper, or what.

This can be accounted for in scripts by looking to see if the WBEM target host (as specified in the URL) is the same as the query host, and simply omitting the latter from the URL.

For an example of how I'm looking to use this, see this post, which shows a query for Everest sensor readings (although don't rely on that--I'm hoping they will move the sensors to performance monitor tree, and create sensor-specific classes).

Enjoy
ehall
Cacti User
Posts: 246
Joined: Fri Dec 09, 2005 3:42 pm

Post by ehall »

Couple more comments here.

1) I got the Everest WMI stuff working with the Pegasus WMI gateway and wbemcli. Since the Everest stuff is still in beta and may (hopefully will) change I'm not going to post any details, but suffice it to say that this all works. A screenshot of some Fan sensor data is attached below.

One of the nice things is that using "get instance" is pretty fast, if you know the exact instance that you want. For "index" function, I just use the "enumerate instance", and cacti stores the index name as it should. Then for all the "get" requests, it just returns the instance name value, which can be used for "get instance" with wbemcli, which is nice and fast.

2) Due to the way that queries require authentication information, this is not seamless with Cacti, since there's no way to pass definable variables to script queries in the current setup. I ran into this same problem with IPMI scripts that needed authentication, and the two workarounds are (A) define the node as SNMPv3 and pass the credentials as that, or (B) expose the IPMI sensor data to anonymous users and have the script take care of building the IPMI query accordingly. I don't know a way to do the latter with HTTP URLs and authentication is required for wbemcli so until something breaks out here, authentication is going to be mandatory.

You might be able to use a common username/password on all your systems, or use an environment variable, or whatever, and then code that info into the script.

3) Another option apart from using Pegasus gateway is the IBM Director client agent, which has the Pegasus gateway embedded in it. This exposes a bunch of CIM data too, which goes well beyond just providing basic WBEM-WMI gateway services. The only real downsides to this are (A) it uses a bunch of memory on the client PC, and (B) it does not provide network-wide gateway services (you can't specify another host in the namespace).

I don't know the commercial status of the IBM Director agent. I know that the whole Director package is licensed for $$$$ but don't know about the agent. I've got a ping into IBM about this, and will post more once I know more.
Attachments
beta_fans.png
beta_fans.png (28.23 KiB) Viewed 117624 times
geoffmciver
Posts: 3
Joined: Mon Apr 03, 2006 6:00 pm

Post by geoffmciver »

OK. I have a working implementation using Cacti and I have the ability to discover "services" on a windows host. I'm concentrating on Performance data at present and still cannot get access to Singleton CIM instances. I just get an error from WBEMCLI that states

Code: Select all

$wbemcli -nl ei 'http://****:****@****:5988/root/cimv2:Win32_PerfRawData_PerfOS_Memory'
*
* wbemcli: Cim: (1) CIM_ERR_FAILED: A general error occurred that is not covered by a more specific error code: "invalid CIM name: Win32_PerfRawData_PerfOS_Memory=@"
*
I noticed in an article here
http://www.dmtf.org/events/past/2003/gm ... Mapper.pdf that singleton instances are not supported.

now I know that the code that the HP binary was compiled with is old and I wonder if this "support" has been fixed or added to the WMI Mapper in later releases?

I think I need to get the source and do some compiling and perhaps look at a bug fix to obtain what I want. Perhaps a PEP may get the job done as well.

My end game is to have this mapper incorparated into a standard server build and be able to discover services and then implement them in cacti. this will give me true heterogenous capacity monitoring and further branch into managing windows hosts from linux
User avatar
AdamKadmon
Posts: 6
Joined: Tue Oct 03, 2006 6:18 pm
Location: Broomfield, CO. USA

Post by AdamKadmon »

Hi there,

Is there no way, with wbemcli, to query a native CIM repository on a Windows machine from linux? The reason I ask is that when I run this:

Code: Select all

wbemcli -nl gc 'http://user:pass@PC:5988/root/cimv2:Win32_PerfFormattedData_PerfDisk_LogicalDisk'
I get this error

Code: Select all

*
* wbemcli: Http Exception: couldn't connect to server
*
Is there any configuration actually needed on the Windows side? Does the Pegasus thing really need to be installed?

Thanks!

AK
ehall
Cacti User
Posts: 246
Joined: Fri Dec 09, 2005 3:42 pm

Post by ehall »

1) You have an unqualified hostname in the URL--it must be a fully-qualified hostname as per the HTTP specs.

2) WMI does not use CIM-over-HTTP, but instead uses CIM-over-DCOM.
juvann
Posts: 20
Joined: Mon Dec 18, 2006 4:04 am

Post by juvann »

Hi,

where can I download the script php for read information returned for wbemcli.

Thanks for help.
ehall
Cacti User
Posts: 246
Joined: Fri Dec 09, 2005 3:42 pm

Post by ehall »

I don't know of any packaged scripts. This whole area should be considered as experimental at this ponint.
juvann
Posts: 20
Joined: Mon Dec 18, 2006 4:04 am

Post by juvann »

On Feb 06 the HP has released the version 2.2 of WMIMapper.
With this version is possible access to singleton WMI class? For example Win32_PerfFormattedData_Tcpip_TCP.

Code: Select all

wbemcli ein -nl -noverify 'https://admin:passwd@192.168.254.20/root/cimv2:Win32_PerfFormattedData_Tcpip_TCP'                            
192.168.254.20:5989/root/cimv2:Win32_PerfFormattedData_Tcpip_TCP.*KEYBINDING="MISSING*"
but when try with

Code: Select all

wbemcli gp -nl -noverify 'https://admin:passwd@192.168.254.20/root/cimv2:Win32_PerfFormattedData_Tcpip_TCP.Name=""' ConnectionsActive
*
* wbemcli: Cim: (5) CIM_ERR_INVALID_CLASS: The specified class does not exist
*
Suggestions?
Thanks for help
Post Reply

Who is online

Users browsing this forum: No registered users and 1 guest