Monitor Windows via WMI from Cacti on Linux

[nuzzy]

I'm running the IIS - Request against a 2008 R2 server. I'm getting errors in my Cacti log file and when I copy the command from that I get the following (I've replaced my server with SERVERNAME):

Code: Select all

/usr/bin/php -q /var/www/html/cacti/scripts/wmi.php -h 'SERVERNAME' -u '/etc/cacti/cactiwmi.pw' -w 'Win32_PerfRawData_W3SVC_WebService' -n '' -k 'Name' -v '_Total' -c 'CopyRequestsPersec,DeleteRequestsPersec,GetRequestsPersec,HeadRequestsPersec,LockRequestsPersec,MkcolRequestsPersec,MoveRequestsPersec,OptionsRequestsPersec,OtherRequestMethodsPersec,PostRequestsPersec,PropfindRequestsPersec,ProppatchRequestsPersec,PutRequestsPersec,SearchRequestsPersec,TraceRequestsPersec,UnlockRequestsPerse'
NTSTATUS: NT code 0x80041017 - NT code 0x80041017


Return code non-zero, debug mode enabled!



/usr/local/bin/wmic --namespace='root\CIMV2' --authentication-file=/etc/cacti/cactiwmi.pw //SERVERNAME "SELECT CopyRequestsPersec,DeleteRequestsPersec,GetRequestsPersec,HeadRequestsPersec,LockRequestsPersec,MkcolRequestsPersec,MoveRequestsPersec,OptionsRequestsPersec,OtherRequestMethodsPersec,PostRequestsPersec,PropfindRequestsPersec,ProppatchRequestsPersec,PutRequestsPersec,SearchRequestsPersec,TraceRequestsPersec,UnlockRequestsPerse FROM Win32_PerfRawData_W3SVC_WebService WHERE Name='_Total'"
Exec Status: 1

PHP Notice:  Undefined offset:  1 in /var/www/html/cacti/scripts/wmi.php on line 120

If I run the command from the poller cache it works fine:

Code: Select all

/usr/bin/php -q /var/www/html/cacti/scripts/wmi.php -h 'SERVERNAME' -u '/etc/cacti/cactiwmi.pw' -w 'Win32_PerfRawData_W3SVC_WebService' -n '' -k 'Name' -v '_Total' -c 'CopyRequestsPersec,DeleteRequestsPersec,GetRequestsPersec,HeadRequestsPersec,LockRequestsPersec,MkcolRequestsPersec,MoveRequestsPersec,OptionsRequestsPersec,OtherRequestMethodsPersec,PostRequestsPersec,PropfindRequestsPersec,ProppatchRequestsPersec,PutRequestsPersec,SearchRequestsPersec,TraceRequestsPersec,UnlockRequestsPersec'
CopyRequestsPersec:0 DeleteRequestsPersec:0 GetRequestsPersec:4282 HeadRequestsPersec:192 LockRequestsPersec:0 MkcolRequestsPersec:0 MoveRequestsPersec:0 Name:_Total OptionsRequestsPersec:0 OtherRequestMethodsPersec:0 PostRequestsPersec:1213 PropfindRequestsPersec:0 ProppatchRequestsPersec:0 PutRequestsPersec:0 SearchRequestsPersec:0 TraceRequestsPersec:0 UnlockRequestsPersec:0

Any ideas as to why this is happening?

[claymen]

Can you try running the command from the poller cache *as* the user the poller runs as? Make sure that user can access the password file.

[nuzzy]

I know what it is. If you look at the last value 'UnlockRequestsPersec', Cacti is stripping of the last character, so it's reading 'UnlockRequestsPerse'. It looks like either a cacti bug or a character limitation issue. I'll try to just use the hostname and see if it works.

[claymen]

Hah, that's a new one. Ah well good find.

[phalek]

As i was unable to find a link to a wmic binary for Centos 5.5. 32bit which is cabable of communicating with Windows 7 64bit and Windows Server 2008 R2 64 bit, i just compiled it.

You can download it here: http://www.network-outsourcing.de/uploa ... _32bit.tgz

[praetor]

As i was unable to find a link to a wmic binary for Centos 5.5. 32bit which is cabable of communicating with Windows 7 64bit and Windows Server 2008 R2 64 bit, i just compiled it.

You can download it here: http://www.network-outsourcing.de/uploa ... _32bit.tgz

Thanks for that. Fixes an intermittant bug which others have reported all through this thread as well. All my queries run every time now

[claymen]

What actual version was that compiled from? It would be good to know for reference as the source for wmic changes reasonably often. Knowing which builds might help prevent problems

[md88dg]

Hello,

i have attached three templates for Windows to get stats from a Terminalserver, 16 Core CPU and Print Spooler.

wmi_windows_ts_sessions.zip

Graph and data template for TS Sessions

(5.07 KiB) Downloaded 527 times

wmi_windows_16_cpu.zip

Graph and data template for 16 Core CPU

(11.34 KiB) Downloaded 465 times

wmi_spooler_stats.zip

Graph and data template for Spooler

(9.7 KiB) Downloaded 458 times

the templates are creates with cacti version 0.8.7g

[md88dg]

Hello,

here is the ts session template for 2008 servers, because the wmi class has changed.

wmi_windows_ts_sessions.zip

(4.96 KiB) Downloaded 557 times

[netlin]

Hi there. I have a problem that I need some help with...

Until recently I only "monitored" a Windows 7 box and a XP box. No (real) problems here.

Then I got my hands on a 2003 server and a 2007 exchange server. Both virtual and both out of my domain.

If I query them through a WMI tester from another Windows machine things work fine - I get values.

If I try to query through Linux I get:

Code: Select all

[20:03][root@somewhere wmi ]# /usr/local/bin/wmic -U "username%password" //ip_address "SELECT * FROM SELECT * FROM Win32_OperatingSystem"
[librpc/rpc/dcerpc_connect.c:329:dcerpc_pipe_connect_ncacn_ip_tcp_recv()] failed NT status (c0000236) in dcerpc_pipe_connect_ncacn_ip_tcp_recv
[librpc/rpc/dcerpc_connect.c:790:dcerpc_pipe_connect_b_recv()] failed NT status (c0000236) in dcerpc_pipe_connect_b_recv
[wmi/wmic.c:196:main()] ERROR: Login to remote object.
NTSTATUS: NT_STATUS_CONNECTION_REFUSED - NT_STATUS_CONNECTION_REFUSED

I use CentOS 5.4 and my WMIC built is 1.3.14. At first I used a "pre-build" WMIC for 5.5 that I snached from this thread, so at first I thought that might be the problem. Today I compiled WMIC myself and things have not changed - still works for first two hosts and does not work for the second two.

Any help would greatly be appreciated.

[claymen]

Something funny with auth? I'm not entirely sure. Can you manually specify the domain so it's not attempting a local logon or something.

[acleech]

Hello all,

I'm trying to get the NTDS scripts working against a 2008 R2 domain controller.

The script was returning an error when I run it from the command line, so I pulled the counters one at a time. All of them returned values, but for some reason it's not able to pull the KerberosAuthentications and NTLMAuthentications. I can't figure out what the deal is, I've searched for everything I can think of. I can see the counters in perfmon on the server, and went through wbemtest and saw they were in there.

It works fine against our 2003 server. I'm new to running this on Linux, and open to any ideas on how to fix this. Thanks for the awesome scripting, up to this point it's worked great!

Code: Select all

[root@svr-cacti bin]#  /usr/bin/php -q /var/www/html/scripts/wmi.php -h '172.16.10.80' -u '/etc/cacti/cactiwmi.pw' -w 'Win32_PerfRawData_NTDS_NTDS' -n '' -k '' -v '' -c 'NTLMAuthentication'
NTSTATUS: NT code 0x80041017 - NT code 0x80041017


Return code non-zero, debug mode enabled!



/bin/wmic --namespace='root\CIMV2' --authentication-file=/etc/cacti/cactiwmi.pw //172.16.10.80 "SELECT NTLMAuthentication FROM Win32_PerfRawData_NTDS_NTDS"
Exec Status: 1

PHP Notice:  Undefined offset:  1 in /var/www/html/scripts/wmi.php on line 120

Notice: Undefined offset:  1 in /var/www/html/scripts/wmi.php on line 120

Edit: I don't know if it matters or not, but in perfmon these two counters show up under "Security System-Wide Statistics" instead "NTDS" like the other ones.

[acleech]

Nevermind - I finally got it. I had to write new templates for 2008 servers - those two values are in Win32_PerfRawData_Lsa_SecuritySystemWideStatistics. So now for the NTDS stats I have two Graph Templates and two new Data Templates.

If anybody is interested I could attempt to export them and up load them here. I guess this is how you learn to do this stuff! lol

[c3226026]

Nevermind - I finally got it. I had to write new templates for 2008 servers - those two values are in Win32_PerfRawData_Lsa_SecuritySystemWideStatistics. So now for the NTDS stats I have two Graph Templates and two new Data Templates.

If anybody is interested I could attempt to export them and up load them here. I guess this is how you learn to do this stuff! lol

Yes I'm interested, thanks in advanced.

[Echinocactus]

Nevermind - I finally got it. I had to write new templates for 2008 servers - those two values are in Win32_PerfRawData_Lsa_SecuritySystemWideStatistics. So now for the NTDS stats I have two Graph Templates and two new Data Templates.

If anybody is interested I could attempt to export them and up load them here. I guess this is how you learn to do this stuff! lol

Yes, i'm interested too.