Monitor Windows via WMI from Cacti on Linux

[stormonts]

n/m

[Igloo]

I've managed to get a graph working, only problem is, Cacti is shortening the Internal Data Source Name from:

BytesTransmittedPersec

to:
BytesTransmittedPer

which is breaking it.

Plus, For some reason, I'm not seeing the call to the script in my log file.

Weird... :/

[ehall]

Why the (m) after some of the numbers in the CPU graphs?

It means "milli" as in thousandths of a unit. Cacti does that whenever the sample value is less than a whole number.

[Igloo]

Ignore, Fixed itself.

Now just more troubleshooting

[claymen]

Why the (m) after some of the numbers in the CPU graphs?

http://forums.cacti.net/viewtopic.php?t=8168

It means the CPU usage average was very small and thus use of m to denote 10^-3 m - milli

[Igloo]

Right, THIS is where i am with monitoring network cards now.

/usr/bin/php -q /usr/share/cacti/site/scripts/wmi.php -h 'server1.autonationalltd.co.uk' -u '/etc/cacti/cactiwmi.pw' -w 'Win32_PerfRawData_Tcpip_NetworkInterface' -n '' -k '' -v '' -c 'BytesReceivedPersec,BytesSentPersec,BytesTotalPersec'

Which gives us

BytesReceivedPersec0:261768512 BytesSentPersec0:338855895 BytesTotalPersec0:600624407 Name0:Intel[R]_PRO_1000_XT_Network_Connection BytesReceivedPersec1:166935 BytesSentPersec1:166935 BytesTotalPersec1:333870 Name1:VMware_Virtual_Ethernet_Adapter_for_VMnet1 BytesReceivedPersec2:166986 BytesSentPersec2:166986 BytesTotalPersec2:333972 Name2:VMware_Virtual_Ethernet_Adapter_for_VMnet8 BytesReceivedPersec3:559362977 BytesSentPersec3:559362977 BytesTotalPersec3:1118725954 Name3:MS_TCP_Loopback_interface

What i need to do now is extract the details from BytesReceivedPersec0 to get the network card.

But you can't change the imput to be BytesRecievedPersec0 as that's not a valid variable on the wmi class

So, Ideas?

[claymen]

If you get multiple sets of data back it will auto add a number to the end of each column name otherwise you'd get multiple column names returned and cacti wouldnt know what to do there would be duplicate names being returned.

In any case you need to set your filters properly so that it returns the details of only a SINGLE network card not all of them. When only one row is returned it will not add the extra number to the end of each column name.

For a better idea of what to do look at the disk space/disk io templates to see that they use a filter value so that you only get the info of ONE disk back.

The only time doing what you have done is useful is when you can gaurantee the number of returned items will be constant. For example the cpu usage graphs work by returning every cpu at the same time this is because we know that for a 2 cpu machine 2 will come back so it gets Name0: CPU0 Load0: xx Name:1 CPU1 Load1: xx etc. And for an 8cpu 8 will come back.

So, fix your templates and add a filter in!

[Igloo]

Cheers claymen,

I've added a filter, Will see if it works now

With regards to the network being constant, You'll only have to set it on adding a new host / if you add a new network card...

Kinda messy, But the only way i can see?

[claymen]

Cheers claymen,

I've added a filter, Will see if it works now

With regards to the network being constant, You'll only have to set it on adding a new host / if you add a new network card...

Kinda messy, But the only way i can see?

Err I think you missed the point mate.

WMI queries work like a SQL query. You have a table (the wmi class) and your rows and columns. When you query something like network cards or disks you have the possibility of getting multiple rows returned. This isn't always a bad thing but you must be aware of it.

Cacti takes input in the form of Var1:Data1 Var2:Data2 etc. The WMI script takes return data from WMI and makes it suitable for cacti e.g. returning it using the following, ColumnName:RowData etc. As per the normal behaviour of cacti those column names are how you reference the data being passed in from the script. You with me so far?

Now the problem comes when you have multiple rows returned. You end up with multiple sets of Var:Data pairs which have the same Var name. This will break things because you can't have two variables with the same name. Think about it, how can you reference two bits of data by the same variable...

So normally when you setup your templates you use a filter or in SQL/WMI terms a where clause (which is what the filter is) to limit the number of rows returned, ideally to a single row. So in your case you should be using the "Name" column as your filter key and your network card name as the filter value. This way when the WMI query is run it will return only a single row where Name = "your nic name" etc. If you have ever used SQL this will probably make more sense. From here you then create your templates so you specify the filter value when you add it to the host, for disks you specify the disk name C: D: etc for your nic template you'd do the same and specify the nic name.

However, there are a couple cases where returning multiple rows is useful. The example I was giving above was CPU usage. You *could* create your cpu template in such a way as to return only one cpu, e.g. using a filter. And then create a template for each CPU so that if you have a 2 cpu machine you either add two of the same template and manually specify the filter value CPU0 CPU1 etc. Or you could create multiple templates with hard coded filters and call them say "WMI - CPU0" "WMI - CPU1". In both cases you end up with multiple data sources added to the host and in the case of our example 2 cpu machine you would have two.

This isn't a bad thing, it cuts down on the complexity of the template and means you can reuse it more. BUT this means that for your 2cpu machine wmi.php and therfore wmic have to be invoked twice to read each cpu. This means extra overhead the more CPU's there are. Now this is where I got creative with some of my templates. To reduce the number of calls to wmic I figured why not return all the cpu's for said machine in one go. No worries... oh wait except they will all have a column named "Name" which will freak out cacti and I won't be able to reference the other cpu's. So the solution was that when multiple rows are returned by wmic add a incremental number to each of the column names. So in this example the output given to cacti would be Name0:CPU0 Load0:40 Name1:CPU1 Load1:23 and I can then reference Load0 and Load1 in my template to get the cpu usage of both cpu's and being its all done in one wmic/wmi.php query I have cut down the number of calls! You with me still?

This can then be expanded to suit 4,8,16 cpu's etc without too much trouble and you still only have the cost of invoking wmic/wmi.php once per host. The next problem is that doing this is only useful where the number of rows that will be returned is a known constant and the count and the index will not change. For CPU's its easy you create a template for 1cpu, 2cpu, 3cpu, 4cpu, 8cpu, 16cpu and so on because you know that adding the 16cpu template to a host will only return 16 cpu's e.g. you know the number of CPU's before hand, and you also know that your cpu count and order of being returned isn't going to change. For network cards, disks and other items where again you can get multiple rows returned, you don't have the same luxury as you do with cpu's. And even if you do know the number of disks/nics you have no way of knowing which disk is what as your reference in cacti would simply be be say for you NIC0Bytes:12312 NIC1Bytes:1334 you don't know what NIC0 and what NIC1 are and it makes further graph templates a little more difficult. Not to mention that if you remove a nic or you reinstall it you could mess the order up and break your graphs.

Hopefully that helps you understand why you should be using filters and setup your templates so that your template is as generic as possible and that you simply specify the nic name when adding that template to a host. Basically you'd do it the exact same way as you do hard disks except you would specify the NIC name not the driver letter

[Igloo]

That makes complete sense

I am slightly familiar with SQL and kind of understood how it worked.

This is how i'm querying now

/usr/bin/php -q /usr/share/cacti/site/scripts/wmi.php -h 'server1.autonationalltd.co.uk' -u '/etc/cacti/cactiwmi.pw' -w 'Win32_PerfRawData_Tcpip_NetworkInterface' -n '' -k 'Name' -v 'ntel[R]_PRO_1000_XT_Network_Connection' -c 'BytesReceivedPersec,BytesSentPersec,BytesTotalPersec'


Which doesn't seem to be working?

The network controller "name" is ntel[R]_PRO_1000_XT_Network_Connection

(Please forgive me if i've completely misunderstood).

[claymen]

Shouldn't that be "Intel[R]_PRO_1000_XT_Network_Connection"?

[ehall]

-k 'Name' -v 'ntel[R]_PRO_1000_XT_Network_Connection'

You're missing the "I" at the beginning of "Intel"

[Igloo]

Heh,

Even with the I it still doesn't work :/



miggo@proxy:/home/miggo# /usr/bin/php -q /usr/share/cacti/site/scripts/wmi.php -h 'server1.autonationalltd.co.uk' -u '/etc/cacti/cactiwmi.pw' -w 'Win32_PerfRawData_Tcpip_NetworkInterface' -n '' -k 'Name' -v 'Intel[R]_PRO_1000_XT_Network_Connection' -c 'BytesReceivedPersec,BytesSentPersec,BytesTotalPersec' -d 2
miggo@proxy:/home/miggo#

[Igloo]

Fixed that, Different result on different classes.

Works via cli, now to create the data source

[Igloo]

Here's the xml file for the data source.

I would appreciate some help with the graphing one Will post what i have though.