Monitoring windows services

arosenau · Post by **arosenau** » Mon Oct 23, 2006 3:18 pm

I just started using Cacti, and am using the cactiEZ cd found here http://cactiusers.org/ and have set it up to monitor a few windows 2003 servers using windows SNMP. The problem I am having is for the windows services I always get a Service State of 0 indicating it is stopped even though the service is running. Stopping the service does not have any affect on this service state.

Any suggestions?
Thanks in advance

cigamit · Post by **cigamit** » Mon Oct 23, 2006 10:38 pm

It may be a long OID issue.

First lets check to see what your boxes are actually returning. What do you get when you do a snmpwalk of both of these OIDs from your Cacti box to one of the servers.

.1.3.6.1.4.1.77.1.2.3.1.1
.1.3.6.1.4.1.77.1.2.3.1.2

arosenau · Post by **arosenau** » Tue Oct 24, 2006 8:27 am

.1.3.6.1.4.1.77.1.2.3.1.1

returns all my services like this

.1.3.6.1.4.1.77.1.2.3.1.1.6.83.101.114.118.101.114 Server

.1.3.6.1.4.1.77.1.2.3.1.2

returns all of them like this

.1.3.6.1.4.1.77.1.2.3.1.2.6.83.101.114.118.101.114 4

I figured you didn't need the whole thing so I just copied the first entry, since they all look similar just different OIDS, please let me know if you need more.

BSOD2600 · Post by **BSOD2600** » Tue Oct 24, 2006 11:06 am

Check out the monitoring running processes script in my signature.

arosenau · Post by **arosenau** » Tue Oct 24, 2006 11:30 am

BSOD2600 wrote:Check out the monitoring running processes script in my signature.

I am going to install that script also, but I want to monitor services not processes, I want to be able to detect the state of a windows service.

BSOD2600 · Post by **BSOD2600** » Tue Oct 24, 2006 2:09 pm

Ah, ok... well I recall there was someone who wrote a simple WMI script for that (search the script forum).

Most often a process is tied to a service, so my script would work...

cigamit · Post by **cigamit** » Tue Oct 24, 2006 10:48 pm

arosenau wrote:
.1.3.6.1.4.1.77.1.2.3.1.1
returns all my services like this

.1.3.6.1.4.1.77.1.2.3.1.1.6.83.101.114.118.101.114 Server
.1.3.6.1.4.1.77.1.2.3.1.2
returns all of them like this

.1.3.6.1.4.1.77.1.2.3.1.2.6.83.101.114.118.101.114 4

I figured you didn't need the whole thing so I just copied the first entry, since they all look similar just different OIDS, please let me know if you need more.

Hum... so it seems that walk in indeed returning the correct information (4 means RUNNING). The first most likely culprit is the fields lengths in the database which were updated in Cacti v0.8.6i to accomidate for this exact issue.

What version of Cacti are you running?

arosenau · Post by **arosenau** » Wed Oct 25, 2006 9:50 am

I am running Cacti v0.8.6i. My complete Host information is below

Cacti Version - 0.8.6i
Plugin Architecture - 1.0
Poller Type - Cactid v0.8.6i
Server Info - Linux 2.6.9-42.0.3.EL
Web Server - Apache/2.0.52 (CentOS)
PHP - 4.3.9
PHP Extensions - yp, xml, wddx, tokenizer, sysvshm, sysvsem, standard, sockets, shmop, session, pspell, posix, pcre, overload, mime_magic, iconv, gmp, gettext, ftp, exif, dio, dbx, dba, curl, ctype, calendar, bz2, bcmath, zlib, openssl, apache2handler, gd, mysql, snmp, eAccelerator
MySQL - 4.1.20
RRDTool - 1.2.15
SNMP - 5.1.2
Plugins
PHP Network Weathermap (weathermap - v0.82)
Thresholds (thold - v0.3.0)
Device Monitoring (monitor - v0.7)
Network Discovery (discovery - v0.6)
Network Tools (tools - v0.2)
Syslog Monitoring (haloe - v0.4)
mactrack
RRD Cleaner (rrdclean - v1.1)
Update Checker (update - v0.3)
FlowView (flowview - v0.3)
Host Info (hostinfo - v0.1)
Error Images (errorimage - v0.1)

cigamit · Post by **cigamit** » Wed Oct 25, 2006 11:50 pm

Hum... have you done a poller recache since you upgraded? (I assume its an upgrade and not a fresh install).

Also, what do the scripts actually return when run the log in DEBUG mode. Do they actually return 0 or U?

arosenau · Post by **arosenau** » Thu Oct 26, 2006 9:04 am

This is a fresh install. I have tried clearing the cache already. Here is the output I get from the scripts in debug mode.

/usr/bin/rrdtool create \
/var/www/html/rra/exchange_server_service_state_33.rrd \
--step 300 \
DS:service_state:GAUGE:600:0:U \
RRA:AVERAGE:0.5:1:600 \
RRA:AVERAGE:0.5:6:700 \
RRA:AVERAGE:0.5:24:775 \
RRA:AVERAGE:0.5:288:797 \
RRA:MIN:0.5:1:600 \
RRA:MIN:0.5:6:700 \
RRA:MIN:0.5:24:775 \
RRA:MIN:0.5:288:797 \
RRA:MAX:0.5:1:600 \
RRA:MAX:0.5:6:700 \
RRA:MAX:0.5:24:775 \
RRA:MAX:0.5:288:797 \
RRA:LAST:0.5:1:600 \
RRA:LAST:0.5:6:700 \
RRA:LAST:0.5:24:775 \
RRA:LAST:0.5:288:797 \

cigamit · Post by **cigamit** » Thu Oct 26, 2006 7:34 pm

Actually, I was wanting the perl script results for when it polled the service.

arosenau · Post by **arosenau** » Thu Oct 26, 2006 7:48 pm

cigamit wrote:Actually, I was wanting the perl script results for when it polled the service.

I'm sorry, I'm new to Cacti, I have been doing some research and it looks like I have to install something other than SNMP on my boxes, some people are using the Nagios agent from the looks of it and others are using a windows WMI gateway. If I have to install something can you point me in the right direction, if not where do I run these pearl scripts in debug mode.

Thanks for all your help

cigamit · Post by **cigamit** » Thu Oct 26, 2006 8:09 pm

arosenau wrote:
cigamit wrote:Actually, I was wanting the perl script results for when it polled the service.
I'm sorry, I'm new to Cacti, I have been doing some research and it looks like I have to install something other than SNMP on my boxes, some people are using the Nagios agent from the looks of it and others are using a windows WMI gateway. If I have to install something can you point me in the right direction, if not where do I run these pearl scripts in debug mode.

Thanks for all your help

No, you don't have to install anything other than SNMP, Windows LanManager records the info in SNMP. You are getting info from SNMP about the service, its just a matter of figuring out why Cacti is seeing them as Down, then you can walk them to correctly see them as Up.

arosenau · Post by **arosenau** » Thu Oct 26, 2006 8:30 pm

Ok thanks for clearning up that confusion. How do I run these scripts in debug mode? I will look into this issue when I get to work in the morning as I don't have access to this box at home right now.

cigamit · Post by **cigamit** » Thu Oct 26, 2006 8:57 pm

Just run your log in MEDIUM mode (or DEBUG).

Console
Settings >> General >> Poller Logging Level

Then check the Cacti Log after the next polling. Look for a line like this.

10/26/2006 04:25:07 PM - CACTID: Poller[0] Host[2] DS[23] SS[0] SERVER: /var/www/html/scripts/win_services.php win_services 10.1.0.1 UCS001 2 2 get servstate 25.65.86.71.55.32.65.108.101.114.116.32.77.97.110.97.103.101.114.32.83.101.114.118.101.114, output: 1

Also, make sure the host that you are checking is running SNMPv2c mode, not v1 or it won't see it.

Monitoring windows services

Monitoring windows services

Who is online