Active Directory Statistics from Linux with WMI

[anx]

This template is using the a simple way of getting WMI stats from a Linux Cacti server without any gateways or any 3rd party tools such as nsclient.

You can find out more about this technique here:

http://forums.cacti.net/viewtopic.php?p=143046#143046

This template was just a proof of concept, I modified the template from here: http://forums.cacti.net/viewtopic.php?t=14062 and my perl script is based on the one from Diggit in that thread.

Here's what you need to know, first you need to have the wmic executable, follow the first post I linked to to get it. At the top line of ntds.pl you might need to modify the path to it, I keep mine in /var/www/cacti/scripts

Code: Select all

$wmicPath='/var/www/cacti/scripts';

Change this to where your wmic exeutable is.

The ntds.pl script sould be placed in your cacti/scripts directory.

If you want to test the script from the command line, it takes the following arguments:

Code: Select all

./ntds.pl <hostname> <username> <password>

The script is very simple and you should be able to figure it out easily. When you create a graph in Cacti you will be prompted for these details, best to use an account in the domain that has limited access except for WMI read access.

I hope I haven't made this sound complicated, I have tried several ways of managing Windows servers from Linux, Wbem gateways, nsclient etc and this is the easiest plus it doesn't involve having anything installed on the Windows server which can be an issue in some production environments.

I hope this works out as I plan on converting a number of exisitng WMI templates over to this method.

Graph template was exported with dependancies from Cacti version 0.8.7b

[cspenpen]

My cacti can't draw graph. Here is rrdtool debug mode.

Code: Select all

RRDTool Command:
/usr/local/rrdtool-1.3.4/bin/rrdtool graph - \
--imgformat=PNG \
--start=-86400 \
--end=-300 \
--title="TDC - AD Statistics" \
--base=1000 \
--height=120 \
--width=500 \
--alt-autoscale-max \
--lower-limit=0 \
--vertical-label="" \
--slope-mode \
--font TITLE:14: \
--font AXIS:8: \
--font LEGEND:8: \
--font UNIT:6: \
DEF:a="/var/www/html/cacti/rra/tdc_dsdirectoryreads_502.rrd":DSDirectorySearches:LAST \
DEF:b="/var/www/html/cacti/rra/tdc_dsdirectoryreads_502.rrd":DSDirectorySearches:AVERAGE \
DEF:c="/var/www/html/cacti/rra/tdc_dsdirectoryreads_502.rrd":DSDirectoryReads:LAST \
DEF:d="/var/www/html/cacti/rra/tdc_dsdirectoryreads_502.rrd":DSDirectoryReads:AVERAGE \
DEF:e="/var/www/html/cacti/rra/tdc_dsdirectoryreads_502.rrd":DSDirectoryWrites:LAST \
DEF:f="/var/www/html/cacti/rra/tdc_dsdirectoryreads_502.rrd":DSDirectoryWrites:AVERAGE \
DEF:g="/var/www/html/cacti/rra/tdc_dsdirectoryreads_502.rrd":ABBrowsesPersec:LAST \
DEF:h="/var/www/html/cacti/rra/tdc_dsdirectoryreads_502.rrd":ABBrowsesPersec:AVERAGE \
DEF:i="/var/www/html/cacti/rra/tdc_dsdirectoryreads_502.rrd":LDAPSearchesPersec:LAST \
DEF:j="/var/www/html/cacti/rra/tdc_dsdirectoryreads_502.rrd":LDAPSearchesPersec:AVERAGE \
CDEF:cdefh=d,8,* \
LINE1:a#4668E4FF:"AD Searches"  \
GPRINT:a:LAST:"  Current\:%8.2lf %s"  \
GPRINT:b:AVERAGE:"Average\:%8.2lf %s"  \
GPRINT:b:MAX:"Maximum\:%8.2lf %s\n"  \
LINE1:c#F5F800FF:"AD Reads"  \
GPRINT:c:LAST:"     Current\:%8.2lf %s"  \
GPRINT:d:AVERAGE:"Average\:%8.2lf %s"  \
GPRINT:cdefh:MAX:"Maximum\:%8.2lf %s\n"  \
LINE1:e#EE5019FF:"AD Writes"  \
GPRINT:e:LAST:"    Current\:%8.2lf %s"  \
GPRINT:f:AVERAGE:"Average\:%8.2lf %s"  \
GPRINT:f:MAX:"Maximum\:%8.2lf %s\n"  \
LINE1:g#8F9286FF:"AB Browses"  \
GPRINT:g:LAST:"   Current\:%8.2lf %s"  \
GPRINT:h:AVERAGE:"Average\:%8.2lf %s"  \
GPRINT:h:MAX:"Maximum\:%8.2lf %s\n"  \
LINE1:i#00FF00FF:"LDAP Searches"  \
GPRINT:i:LAST:"Current\:%8.2lf %s"  \
GPRINT:j:AVERAGE:"Average\:%8.2lf %s"  \
GPRINT:j:MAX:"Maximum\:%8.2lf %s\n" 
RRDTool Says:

ERROR: opening '/var/www/html/cacti/rra/tdc_dsdirectoryreads_502.rrd': No such file or directory

when I use command test, I got this result like attachment. Do I miss something?

thx~

[gumochlon]

Hi guys!

I'm a beginner in Cacti+AD stuff and therefore I need to ask few questions ;)

I have installed the WMI Mapper on my AD server as well as compiled wmic client on my cacti server (RHEL4 64bit).

When I run the ntds.pl script in this way:

ntds.pl server username password

I get this kind of reply:

NTSTATUS: NT code 0xc0001010 - NT code 0xc0001010
NTSTATUS: NT code 0xc0001010 - NT code 0xc0001010
NTSTATUS: NT code 0xc0001010 - NT code 0xc0001010
NTSTATUS: NT code 0xc0001010 - NT code 0xc0001010
NTSTATUS: NT code 0xc0001010 - NT code 0xc0001010
ABBrowsesPersec: LDAPSearchesPersec: DSDirectoryWritesPersec: DSDirectorySearchesPersec: DSDirectoryReadsPersec:

After some research I think I found why I'm getting no results.

Seems like there is no such thing as "Win32_PerfRawData_NTDS_NTDS" in my WMI Mapper .
I can run "select * from Win32_PerfRawData " and I will get results, while if I run "select * from Win32_PerfRawData_NTDS_NTDS" I will get similar NTSTATUS error line like above.

What am I missing therein my AD server ? :)

I have also managed to get the wmi_stats.pl script from the other thread to work correctly, so I get the stats regarding disk IO etc..
But I really want to get the statistics regarding number of LDAP queries and such. That's why I wanted to use ntds.pl
Is there another way I could get such statistics ?

hope to hear back from you soon - as this doesn't let me sleep, keeping my mind thinking about it constantly ;>

kind regards,
Gumochlon

[gumochlon]

Hi there!

I have found solution to my problem ! So I will share it with you guys :)

the problem was caused by a missing WMI classes:

Win32_PerfRawData_NTDS_NTDS
and

Win32_PerfFormattedData_NTDS_NTDS

after a lot of research and "hair pulling" (I'm almost bald now ;> ) - I have found some sort of a comment somewhere on Microsoft Technet forums and tried part of it.

What I did was running this command on my AD server:

wmiadap /F

that resulted in those two missing classes being created and populated :)

now the perl script ntds.pl works great !

regards,
Gumochlon

Hi guys!

I'm a beginner in Cacti+AD stuff and therefore I need to ask few questions ;)

I have installed the WMI Mapper on my AD server as well as compiled wmic client on my cacti server (RHEL4 64bit).

When I run the ntds.pl script in this way:

ntds.pl server username password

I get this kind of reply:

NTSTATUS: NT code 0xc0001010 - NT code 0xc0001010
NTSTATUS: NT code 0xc0001010 - NT code 0xc0001010
NTSTATUS: NT code 0xc0001010 - NT code 0xc0001010
NTSTATUS: NT code 0xc0001010 - NT code 0xc0001010
NTSTATUS: NT code 0xc0001010 - NT code 0xc0001010
ABBrowsesPersec: LDAPSearchesPersec: DSDirectoryWritesPersec: DSDirectorySearchesPersec: DSDirectoryReadsPersec:

After some research I think I found why I'm getting no results.

Seems like there is no such thing as "Win32_PerfRawData_NTDS_NTDS" in my WMI Mapper .
I can run "select * from Win32_PerfRawData " and I will get results, while if I run "select * from Win32_PerfRawData_NTDS_NTDS" I will get similar NTSTATUS error line like above.

What am I missing therein my AD server ? :)

I have also managed to get the wmi_stats.pl script from the other thread to work correctly, so I get the stats regarding disk IO etc..
But I really want to get the statistics regarding number of LDAP queries and such. That's why I wanted to use ntds.pl
Is there another way I could get such statistics ?

hope to hear back from you soon - as this doesn't let me sleep, keeping my mind thinking about it constantly ;>

kind regards,
Gumochlon

[sandycollie]

Hello everyone- I am new to this forum and am excited with what I am reading. I love to help people and love to learn

[dustink]

I am having a problem with the graphing. When I turn on graph debug mode the RRD response is "ERROR: the RRD does not contain an RRA matching the chosen CF"

the script runs ok and outputs correct values (which is great).

I do not know what the error means.

Maybe someone has seen this before?

Thanks
Dustin

Cacti Version - 0.8.7b
Plugin Architecture - 2.1
Poller Type - Cactid v
Server Info - Linux 2.6.26-2-686
Web Server - Apache/2.2.9 (Debian) PHP/5.2.6-1+lenny3 with Suhosin-Patch
PHP - 5.2.6-1+lenny3
PHP Extensions - zip, xmlwriter, libxml, xml, wddx, tokenizer, sysvshm, sysvsem, sysvmsg, session, SimpleXML, sockets, soap, SPL, shmop, standard, Reflection, posix, mime_magic, mbstring, json, iconv, hash, gettext, ftp, filter, exif, dom, dba, date, ctype, calendar, bz2, bcmath, zlib, pcre, openssl, xmlreader, apache2handler, ldap, mysql, mysqli, PDO, pdo_mysql, snmp
MySQL - 5.0.51a-24+lenny1
RRDTool - 1.3.1
SNMP - 5.4.1
Plugins

• Global Plugin Settings (settings - v0.5)
  Thresholds (thold - v0.4.1)
  Create Aggregate Graphs (aggregate - v0.70 B2)
  RRD File Cleaner (RRD Cleaner - v0.38)
  Login Page Mod (loginmod - v1.0)
  Host Info (hostinfo - v0.2)

/usr/bin/rrdtool graph - \
--imgformat=PNG \
--start=-86400 \
--end=-30 \
--title="Server - ADServer02 - AD Statistics" \
--base=1000 \
--height=120 \
--width=500 \
--alt-autoscale-max \
--lower-limit=0 \
--vertical-label="Per Second" \
--slope-mode \
--font TITLE:10: \
--font AXIS:6: \
--font LEGEND:8: \
--font UNIT:6: \
DEF:a="/var/lib/cacti/rra/server_-_adserver02_dsdirectorysearches_378.rrd":DSDirectorySearches:LAST \
DEF:b="/var/lib/cacti/rra/server_-_adserver02_dsdirectorysearches_378.rrd":DSDirectorySearches:MAX \
DEF:c="/var/lib/cacti/rra/server_-_adserver02_dsdirectorysearches_378.rrd":DSDirectoryReads:LAST \
DEF:d="/var/lib/cacti/rra/server_-_adserver02_dsdirectorysearches_378.rrd":DSDirectoryReads:MAX \
DEF:e="/var/lib/cacti/rra/server_-_adserver02_dsdirectorysearches_378.rrd":DSDirectoryWrites:LAST \
DEF:f="/var/lib/cacti/rra/server_-_adserver02_dsdirectorysearches_378.rrd":DSDirectoryWrites:MAX \
DEF:g="/var/lib/cacti/rra/server_-_adserver02_dsdirectorysearches_378.rrd":ABBrowsesPersec:LAST \
DEF:h="/var/lib/cacti/rra/server_-_adserver02_dsdirectorysearches_378.rrd":ABBrowsesPersec:MAX \
DEF:i="/var/lib/cacti/rra/server_-_adserver02_dsdirectorysearches_378.rrd":LDAPSearchesPersec:LAST \
DEF:j="/var/lib/cacti/rra/server_-_adserver02_dsdirectorysearches_378.rrd":LDAPSearchesPersec:MAX \
CDEF:cdefh=d,8,* \
LINE1:a#4668E4FF:"AD Searches" \
GPRINT:a:LAST:" Current\:%8.2lf %s" \
GPRINT:b:AVERAGE:"Average\:%8.2lf %s" \
GPRINT:b:MAX:"Maximum\:%8.2lf %s\n" \
LINE1:c#F5F800FF:"AD Reads" \
GPRINT:c:LAST:" Current\:%8.2lf %s" \
GPRINT:d:AVERAGE:"Average\:%8.2lf %s" \
GPRINT:cdefh:MAX:"Maximum\:%8.2lf %s\n" \
LINE1:e#EE5019FF:"AD Writes" \
GPRINT:e:LAST:" Current\:%8.2lf %s" \
GPRINT:f:AVERAGE:"Average\:%8.2lf %s" \
GPRINT:f:MAX:"Maximum\:%8.2lf %s\n" \
LINE1:g#8F9286FF:"AB Browses" \
GPRINT:g:LAST:" Current\:%8.2lf %s" \
GPRINT:h:AVERAGE:"Average\:%8.2lf %s" \
GPRINT:h:MAX:"Maximum\:%8.2lf %s\n" \
LINE1:i#00FF00FF:"LDAP Searches" \
GPRINT:i:LAST:"Current\:%8.2lf %s" \
GPRINT:j:AVERAGE:"Average\:%8.2lf %s" \
GPRINT:j:MAX:"Maximum\:%8.2lf %s\n"
RRDTool Says:

ERROR: the RRD does not contain an RRA matching the chosen CF

[inglpa]

Hi guy's, first of all, thanks i found this forum very useful for my work.

Now the problem: I have some servers in windows server 2003 and 2008, and i'm trying to get information for management purpose through Pegasus WMI Mapper from a linux machine with Wbemcli, but that servers are in a domain, the administrator only give me an user without any permissions so when i try to get information I get this:

wbemcli -nl ei 'http://domain/user:pass@ip:5988/root/ci ... tingSystem'
*
* wbemcli: Cim: (2) CIM_ERR_ACCESS_DENIED: LogonUser()
*
when I change the user to administrator's group it function perfectly, but the administrator of the servers can't give that permissions.

I try to put the user in to local user but the server i'm trying to manage is a domain controller so that options are disable.

Thanks and wait for some ideas.

[Alphadog]

Hey Guys,

I have the same error but i cant solve it with wmiadap /F
anyone who can help me ?

[izydorczyk]

Table:

Code: Select all

Win32_PerfRawData_DirectoryServices_DirectoryServices

But I do not use "ntds.pl" Perl script. Only PHP script Wmi.php. (WMIC with authentication file).
ntds.pl with "Win32_PerfRawData_DirectoryServices_DirectoryServices" had in output extra "number|NTDS" ("nameofvalue|name").

Furthermore, WMIC with --authentication-file parameter is safer. The logging is not written username and password as part command.