Monitor Windows via WMI from Cacti on Linux

areus · Joined: 17 Jun 2009 Posts: 2

I got error while polling stats for filtered process:

claymen · Posted: Wed Jun 17, 2009 9:33 am Post subject:

I'm using it at the moment to monitor the store.exe for exchange as well as the t-server for a genesys phone system integration. Works a treat so we can monitor for any memory leaks.

From the looks of that query and comparing both whats in the poller cache and what you ran manually they are exactly the same. The usual things like permissions seem to be ok as your running it as the cacti user and using the php poller. Tis a bit strange, doesn't look like there are any other processes by that name either which can freak it out.

To be honest I am at a loss on this one, are you able to grab any debug logging from cacti at the time this is polled? It may reveal a bit more information to help identify the issue.

*EDIT*
Just saw your update, yer the log file would most definentally freak it out if the permissions were broken on it. Glad its now working

areus · Joined: 17 Jun 2009 Posts: 2

claymen · Posted: Thu Jun 18, 2009 6:04 am Post subject:

abdullahteke · Joined: 05 Mar 2009 Posts: 12

claymen · Posted: Tue Jun 30, 2009 7:22 pm Post subject:

Does script O matic work on that server locally? It's chucking an error like the WMI query itself is wrong or that the class doesn't exist...

That one you posted is an IIS one which I developed on 2003 with whatever the latest version of IIS was available to install. From memory doesn't 2008 use IIS7?

Do the standard system graphs now work on the 2008 server?

abdullahteke · Joined: 05 Mar 2009 Posts: 12

Hi cleymen;
I tried this query on local machine with wbemtest and returned me an object. But when i tried from an other windows machine on network to win 2008 server with wbemtest, it can connect but when i run the query it returned an error like invalid class. Should i change wmi settings on win2008? If it is what settings should i change? Thank you for your helps.

claymen · Posted: Wed Jul 01, 2009 1:58 am Post subject:

Sounds like permissions. Something not allowing you to remotely query that class. Or could potentially be firewall..

abdullahteke · Joined: 05 Mar 2009 Posts: 12

On servers firewal is disabled.

claymen · Posted: Wed Jul 01, 2009 2:09 am Post subject:

Not sure whats causing the problem then. It's from the looks of things permissions being it works locally but doesn't work remotely. There are a few spots like remote DCOM that can affect it but they shouldn't be an issue if using an admin credential.

abdullahteke · Joined: 05 Mar 2009 Posts: 12

i use domain admin account. This account is also member of local administration group. Do you change any default settings on your win2008 server?

abdullahteke · Joined: 05 Mar 2009 Posts: 12

Sory i realized that i wrote wrong namespace in wbemtest. I changed root\cimv2 and i can connect and run query successfully from other win server. But i still get error from linux when i try to run following command

/usr/local/bin/wmic --namespace='root\CIMV2' --authentication-file=/usr/share/cacti/site/scripts/cacti.pwd //172.18.3.77 "SELECT PercentProcessorTime FROM Win32_PerfFormattedData_PerfOS_Processor" -d1
OK : dcom_create_object.
OK : Create remote WMI object.
lib/com/dcom/main.c:441: dcom_get_pipe: host=172.18.3.77, similar=172.18.3.77[49154]
OK : Login to remote object.
OK : Login to remote object.
ERROR: WMI query execute.
NTSTATUS: NT code 0xc002001b - NT code 0xc002001b

claymen · Posted: Wed Jul 01, 2009 2:23 am Post subject:

We havent changed anything except the RPC port range due to firewall restrictions. Other than that they are pretty bog standard. We do have a couple domain policies but nothing that would affect (or enable) anything like this.

claymen · Posted: Wed Jul 01, 2009 2:25 am Post subject:

What version of the wmi-client are you using?

abdullahteke · Joined: 05 Mar 2009 Posts: 12

#wmic -V
Version 4.0.0tp4-SVN-build-UNKNOWN