Monitor Windows via WMI from Cacti on Linux

claymen · Post by **claymen** » Fri Mar 20, 2009 3:35 am

greg4tw wrote:because when i only update the wmi-logins.php, in the data templates there is still in the column credential the value credential set...

03/19/2009 10:22:34 AM - SPINE: Poller[0] Host[170] ERROR: Empty result [185.30.15.10]: '/usr/bin/php -q /var/www/cacti/scripts/wmi.php 185.30.15.10 credential Win32_ComputerSystem TotalPhysicalMemory '
I am using Cacti 0.8.7d.

How i adjust these CDEF's?

That is correct. The whole point is that credential is a reference to what you have in wmi-logins.php

In this case you simply add/edit the wmi-logins.php so that you have something like the following in there.

Code: Select all

$logins = array();
$logins['credential'] = array('Domain/Username','Password');

And replace the username and password with yours.

You don't need to edit the templates if you simply edit/add that above. However your free to do so but it'd be time consuming and we only use it at work when we have to monitor something on an alternate domain e.g. which requires a different set of credentials.

So to recap the credential so to speak simply references a username/password set in the $logins array. By default it references a credential called credential.

The CDEF's have been explained multiple times in this thread. Try this page and look for my post about them and the differences.

http://forums.cacti.net/viewtopic.php?t ... &start=105

claymen · Post by **claymen** » Fri Mar 20, 2009 3:42 am

Actually one other thing to note in the SVN version I have done away with wmi-logins.php entirely. Instead I now use another auth method of wmic so that basically instead of specifying a reference and all that crap you simply put in the path to a login file of the format below.

username=your username
password=your password
domain=your domain

You then make that file readable only by cacti and thats it. You specify that as the default in your template (which I am in the process of doing to mine) and your done. The reason I went this way was that otherwise your username and password although hidden from cacti logs will still show up on the system if you do a ps aux when it calls wmic. This way you only see the location to the auth file and of course they can't read it if your permissions have been set correctly.

The SVN version has actually had quite a few changes, implemented new methods for argument inputs and added support for the latest version of wmic so you can query alternate namespaces other than just root\CIMV2. Which means you can hit up root\MicrosoftExchangeV2 and pull per mailbox information!

If you are interested browse the svn logs and check it out

Once I am confident its reasonable stable and the outstanding issues on my bug tracker are resolved I will release it as version 0.6

Also for those groaning about having to update templates yes I hear you so I will be looking to implement some backward compatability

greg4tw · Post by **greg4tw** » Fri Mar 20, 2009 4:26 am

My wmi-logins.php is now:

Code: Select all

$logins = array();
$logins['credential'] = array('Domain/Username','Password'); 
$logins['cacti'] = array('Domain/Username','Password');

With replaced domain, username and password.

I have upgraded to the latest svn trunk (Revision 69).
Now nothing works

I only get in the Cacti Log: "Result from SCRIPT not valid."
I dont understand your new auth, where has the login file to be placed?

claymen · Post by **claymen** » Fri Mar 20, 2009 4:35 am

greg4tw wrote:My wmi-logins.php is now:

With replaced domain, username and password.

I have upgraded to the latest svn trunk (Revision 69).

I dont understand your new auth, where has the login file to be placed?

Keep in mind the existing templates are broken with the SVN release... I would suggest sticking with 0.0.5.

The SVN version no longer uses the wmi-logins.php AT ALL. Instead you provide in the credential field of the template the path to a file with the login details as I mentioned above. The new auth file can be wherever you want so long as the cacti poller can access it

Anyway, stick with 0.0.5 till I have updated the templates and/or finished the backwards compatibility.

Code: Select all

$logins = array();
$logins['credential'] = array('Domain/Username','Password'); 
$logins['cacti'] = array('Domain/Username','Password');

What you have there is correct, you should be good to go with that using the defaults in the template so long as everything else is in order like firewalls, wmi privelages (if using non-admin) etc.

What is the actual problem other than the realtime plugin not working (can't test it as I don't have it). You said other templates didn't work in that case which ones?

greg4tw · Post by **greg4tw** » Fri Mar 20, 2009 6:59 am

Now I am @ Revision 70.
In the Data Source from Disk I/O, the value from credential is set to /var/cacti/scripts/wmi-logins.txt and there is no value displayed

claymen · Post by **claymen** » Fri Mar 20, 2009 7:39 am

greg4tw wrote:Now I am @ Revision 70.
In the Data Source from Disk I/O, the value from credential is set to /var/cacti/scripts/wmi-logins.txt and there is no value displayed

Install 0.0.5! Stop using SVN unless you know what you are doing, as I mentioned before it uses a totally different set of arguments which are not compatible with ANY templates at this stage, not even the templates in SVN because I haven't finished them.

Get back to where you started.

Install the 0.0.5 templates and wmi.php.
Edit wmi.php to suit the correct paths for where wmi-logins.php and wmic is.
Now edit wmi-logons.php and make it exactly like below replacing the domain, username and password with your details.

Code: Select all

$logins = array();
$logins['credential'] = array('Domain/Username','Password');

Now add the templates to some stuff.

That's it. Seriously that's all you needed to do.

One you are at the point where you started then we can troubleshoot. The only reason I brought up the whole editing of templates was that if you use the default name and just update wmi-logins.php then you shouldn't have to edit anything in the templates (excusing the CDEF issues).

From what you have posted I would have a guess and say its either a permissions issue, broken wmic issue (what version are you running), or something else in which case you need it to be working partially so we can do some testing from your shell to see what is actually being returned.

outspoken · Post by **outspoken** » Fri Mar 20, 2009 9:35 am

Having difficulty getting a Win2000 server to report CPU. I'm using the 0.0.5 version and latest WMIC. Other hosts are working fine, XP/2003.

It works with WMIC on commandline:

Code: Select all

wmic -U 'DOMAIN/user%pass' //HOSTNAME "Select * from Win32_PerfRawData_PerfOS_Processor where Name='_Total'"

CLASS: Win32_PerfRawData_PerfOS_Processor
APCBypassesPersec|Caption|Description|DPCBypassesPersec|DPCRate|
DPCsQueuedPersec|Frequency_Object|Frequency_PerfTime|
Frequency_Sys100NS|InterruptsPersec|Name|PercentDPCTime|PercentInterruptTime|
PercentPrivilegedTime|PercentProcessorTime|PercentUserTime|Timestamp_Object|
Timestamp_PerfTime|Timestamp_Sys100NS6880540|(null)|(null)|0|5|4702401|0|3579545|10000000|45037683|_Total|1032343750|954296875|
16742968750|3388306484375|6038203125|0|1225377393244|3423276961000

But when I try it this way it doesn't work:

Code: Select all

/usr/local/bin/php -q /usr/local/apache/www/cacti2/scripts/wmi.php hostname credential Win32_PerfFormattedData_PerfOS_Processor PercentProcessorTime

NTSTATUS: NT code 0xc002001b - NT code 0xc002001b

greg4tw · Post by **greg4tw** » Fri Mar 20, 2009 10:27 am

I had deleted all old templates and .php files and used only SVN php's and templates.
But your documentation is very poor, No offense

I wonder, you talk about 0.0.5 and in your first post is already 0.0.3 upped...
Now I found 0.0.5 via board search

And it works quite impressive!
Except the LDAP query's, must the Server a DC?

Wish nice Weekend

claymen · Post by **claymen** » Fri Mar 20, 2009 8:20 pm

greg4tw wrote:I had deleted all old templates and .php files and used only SVN php's and templates.
But your documentation is very poor, No offense

I wonder, you talk about 0.0.5 and in your first post is already 0.0.3 upped...
Now I found 0.0.5 via board search

And it works quite impressive!
Except the LDAP query's, must the Server a DC?

Wish nice Weekend

The documentation IS the thread

And I have posted newer versions as I have gone along developing it. My website does have instructions as well, but then again there really isn't much to it, import the graphs configure the logins and if your using an admin credential thats it

The problems come from Cacti changing things between releases that has caused additional work...

Yes the LDAP graphs are for a DC and a 2003 one for that matter. Haven't got any 2008 DC's to test with.

The SVN trunk is what will eventually be 0.0.6 and there has been some extensive changes which at the moment means the trunk release will not work with any existing templates. This is due to now using -h <host> instead of just the position of the argument, that and I haven't had a chance to add backward compatibility

claymen · Post by **claymen** » Sat Mar 21, 2009 4:11 am

Just a quick update...

The new version is coming along nicely.

A few improvements e.g. alternate name spaces, better input methods (to support this) all in one script no need for wmi-logins.php (still need to create some kind of credential file somewhere.

Now has some help dialog when you run it without any arguments. And is backwards compatible with the previous version templates.

Code: Select all

wmi.php version 0.6-SVN

Usage:
       -h <hostname>         Hostname of the server to query.
       -u <credential path>  Path to the credential file. See format below.
       -n <namespace>        What namespace to use. (optional, defaults to root\CIMV2)
       -w <wmi class>        WMI Class to be used.
       -c <columns>          What columns to select. (optional, defaults to *)
       -k <filter key>       What key to filter on. (optional, default is no filter)
       -v <filter value>     What value for the key. (required, only when using filter key)

                             All special characters and spaces must be escaped or enclosed in single quotes!

Example: wmi.php -h 10.0.0.1 -u /etc/wmi.pw -w Win32_ComputerSystem -c PrimaryOwnerName,NumberOfProcessors -n 'root\CIMV2'

Password file format: Plain text file with the following 3 lines replaced with your details.

                      username=<your username>
                      password=<your password>
                      domain=<your domain> (can be WORKGROUP if not using a domain)

If anyone wants to grab it and have a play your more than welcome, just be aware that the SVN trunk may change as I do more development.

I'll hopefully be releasing this shortly with some new templates for even more exchange monitoring! Any feature requests or bug reports can be logged at http://mantis.parkingdenied.com

And for a teaser, I am currently using revision 76 (latest SVN at this time) now to monitor per mailbox item counts on exchange for reporting purposes so there is quite a bit more that we can do

No templates are up but they will be soon.

One last note, would anyone be interested in updated wmic binaries being posted with it? Older versions such as the one in the debian repository are broken on a number of WMI classes so if anyone is interested I can upload those also.

Anyway time for BEER!

argon0 · Post by **argon0** » Mon Mar 23, 2009 5:28 am

Claymen, looks like nice work so far.

I think I'll wait for your next "release" before fiddling, but the updated binary would be very useful.

Do you know of a way of monitoring which Databases are mounted? I thought I could monitor Active Logons to each DB, but when I set a threshold on that it simply reverts to _Total logons each time.

I'm guessing - and will check - there is an entry in wmi which says whether dbs are mounted or not...

[Edit] Ah, actually just worked out why it has problems with setting Active Logons to anything but Total - we had to set up different data sources for each DB....

Argon0

claymen · Post by **claymen** » Mon Mar 23, 2009 11:12 pm

Yer so far so good.

I migrated all my hosts to the latest svn wmi.php using the backwards compatibility. Worked well for the most part, there was a little bit of pain as I had to change the credential to be a location of the credential file rather than a reference but yer all cut over now. So I am pretty confident that you should be able to cut over to the new script without any major hassles.

Next step is to migrate to the new input style and once that's done export the templates and probably release 0.0.6.

About the Database's being mounted, not off the top of my head. I had a quick skim through root\CIMV2 and root\MicrosoftExchangeV2 but couldn't spot anything that really stood out nor returned the values you want.

That's right, you should be using one datasource of type "Exchange 2003 - Database Performance (WMI)" per actual database. This one data source then provides the following information..
* ActiveClientLogons
* MessagesDelivered
* MessagesSent
* MessagesSubmitted
* ReceiveQueueSize
* SendQueueSize
* TotalCountofRecoverableItems
* TotalSizeofRecoverableItems

The main reason all of that is done in one sweep is you can grab it all in one WMI query so reducing the overhead of calling wmic for each of those individual data sources.

The total active client logons I used simply uses the same template but its filter value was _Total so that I can track the overall queue levels and database activity.

argon0 · Post by **argon0** » Tue Mar 24, 2009 4:24 am

That's what I figured. I've set it up to do all 12 of my DBs on one graph for Active Client logons, which works well. Then I associated a Threshold Template with each of the Databas performance graphs which used the Active Client Logons, and set a low threshold of 1.

Problem is that this dropped to 0 several times last night, and set my Blackberry to buzzing permanently.

Can't think of any other counter which would always be above 0 when DB is mounted...

Argon0

claymen · Post by **claymen** » Tue Mar 24, 2009 4:45 am

What about a cron job and another script? I could write you up a quick php script that you just put in a cron job. It would do a "select * from Win32.." and you would simply count the number of items returned. As the * would return all mounted databases. Or at least I would assume it does.

Can check that tomorrow on my test exchange server. Then yer just use a cron job and get it to call whatever you need it to if it returns a number of db's lower than the previous...

Actually if that works I could modify wmi.php to look for a command line switch and return the total number of items returned... Then you could track it with cacti easily enough.

claymen · Post by **claymen** » Tue Mar 24, 2009 5:05 am

An example would be like this for number of disks.

It would return 3 on this instance as there is A, C and D on this system. You could graph that or simply just add some more code to run if it drops below your set point or something funky like grabbing the previous number from a saved file or something.

<?php
exec('wmic -U username%password //x.x.x.x "select * from Win32_LogicalDisk"',$out);
$count = (count($out)-2);
echo $count;
?>

This hinges on whether an unmounted database still shows up in the list...

Monitor Windows via WMI from Cacti on Linux

Who is online