Excluding data using CHECK_WMI_PLUS

[gilfalko]

Hi,

Running the following command gives me a HUGE amount of performance counters:

./check_wmi_plus.pl --IgnoreMyOutDatedPerlModuleVersions -H '10.12.11.29' -u 'USER' -p 'PASS' -m checkio -s physical

This outputs the following:

Overall Status - OK (Sample Period 11 sec) - Physical Drive Name="0 C:" (OK) - _PercentIdleTime=100%, _PercentBusyTime=0%, _PercentDiskTime=1%, _PercentDiskReadTime=0%, _PercentDiskWriteTime=1%, _DiskReadBytesPersec=0.000B/sec, _DiskReadsPersec=0.000/sec, _DiskWriteBytesPersec=0.178MB/sec, _DiskWritesPersec=10.000/sec, CurrentDiskQueueLength=0, _AvgDiskQueueLength=0.0, _AvgDiskReadQueueLength=0.0, _AvgDiskWriteQueueLength=0.0 Physical Drive Name="_Total" (OK) - _PercentIdleTime=100%, _PercentBusyTime=0%, _PercentDiskTime=1%, _PercentDiskReadTime=0%, _PercentDiskWriteTime=1%, _DiskReadBytesPersec=0.000B/sec, _DiskReadsPersec=0.000/sec, _DiskWriteBytesPersec=0.178MB/sec, _DiskWritesPersec=10.000/sec, CurrentDiskQueueLength=0, _AvgDiskQueueLength=0.0, _AvgDiskReadQueueLength=0.0, _AvgDiskWriteQueueLength=0.0|'_PercentIdleTime0 C:'=100; '_PercentBusyTime0 C:'=0; '_PercentDiskTime0 C:'=1; '_PercentDiskReadTime0 C:'=0; '_PercentDiskWriteTime0 C:'=1; '_DiskReadBytesPersec0 C:'=0; '_DiskReadsPersec0 C:'=0; '_DiskWriteBytesPersec0 C:'=187041; '_DiskWritesPersec0 C:'=10; 'CurrentDiskQueueLength0 C:'=0; '_AvgDiskQueueLength0 C:'=0.0; '_AvgDiskReadQueueLength0 C:'=0.0; '_AvgDiskWriteQueueLength0 C:'=0.0; '_PercentIdleTime_Total'=100; '_PercentBusyTime_Total'=0; '_PercentDiskTime_Total'=1; '_PercentDiskReadTime_Total'=0; '_PercentDiskWriteTime_Total'=1; '_DiskReadBytesPersec_Total'=0; '_DiskReadsPersec_Total'=0; '_DiskWriteBytesPersec_Total'=187041; '_DiskWritesPersec_Total'=10; 'CurrentDiskQueueLength_Total'=0; '_AvgDiskQueueLength_Total'=0.0; '_AvgDiskReadQueueLength_Total'=0.0; '_AvgDiskWriteQueueLength_Total'=0.0;

Let's say I wanted to get _DiskWriteBytesPersec_Total only.
I'm having some hard time with the --exc (--excludedata?) syntax.

I'd appreciate the help,
thanks!

X

[mcapra]

Let's say I wanted to get _DiskWriteBytesPersec_Total only.

I don't know of a way in which the plugin can limit the actual fields returned in such a way that isolates a specific field in the results. The --includedata and --excludedata arguments won't alter the actual fields returned; They just provide criteria for the objects included in the query results. Stuff like "if disk size > 10mb" and the like.

You could alter the WQL query (or create a new one) to accomplish that though. Instead of:

Code: Select all

SELECT * FROM Win32_PerfFormattedData_PerfDisk_PhysicalDisk WHERE Name='_Total'

You might instead do:

Code: Select all

SELECT DiskWriteBytesPerSec FROM Win32_PerfFormattedData_PerfDisk_PhysicalDisk WHERE Name='_Total'

Though there's a bit of a learning curve in writing custom modules like that for check_wmi_plus and it's a bit out of scope for regular support. Here's the definition for checkio physical from the check_wmi_plus.ini on my Nagios XI machine:

Code: Select all

#----------------------------------------------------------
[checkio physical]
requires=1.42
inihelp=<<EOT
Check physical disk IO. 
These disks checks use WMI Raw counters to calculate values over a given timeperiod. 
This is much more accurate than taking Formatted WMI values.
Note that some of the PercentDisk values seem to give incorrect values. Use with caution.
This check can return data for multiple drives in a single check.
ARG1  Name of the logical Windows drive to check eg C: Use % for Wilcard.
   Use _Total to check all drives combined.
EOT

# select only one row specific to the disk we are interested in
# query needs to include "like" since the physical drive names might not be fully as expected eg "01 C:"
# we automatically include % at the front of the arg1
query=SELECT * FROM Win32_PerfRawData_PerfDisk_PhysicalDisk WHERE Name LIKE "%{_arg1}"

# run 2 WMI queries, 5 seconds apart. The delay only applies if using --nokeepstate
samples=2
delay=5

customfield=_PercentIdleTime,PERF_PRECISION_100NS_TIMER,PercentIdleTime,%.0f,100
customfield=_PercentBusyTime,PERF_PRECISION_100NS_TIMER,PercentIdleTime,%.0f,100,100

# these ones seem to give results over 100%?
customfield=_PercentDiskTime,PERF_PRECISION_100NS_TIMER,PercentDiskTime,%.0f,100
customfield=_PercentDiskReadTime,PERF_PRECISION_100NS_TIMER,PercentDiskReadTime,%.0f,100
customfield=_PercentDiskWriteTime,PERF_PRECISION_100NS_TIMER,PercentDiskWriteTime,%.0f,100

customfield=_DiskReadBytesPersec,PERF_COUNTER_BULK_COUNT,DiskReadBytesPersec,%.0f
customfield=_DiskReadsPersec,PERF_COUNTER_COUNTER,DiskReadsPersec,%.0f
customfield=_DiskWriteBytesPersec,PERF_COUNTER_BULK_COUNT,DiskWriteBytesPersec,%.0f
customfield=_DiskWritesPersec,PERF_COUNTER_COUNTER,DiskWritesPersec,%.0f

# might not work in Server 2003
customfield=_AvgDiskQueueLength,PERF_COUNTER_100NS_QUEUELEN_TYPE,AvgDiskQueueLength,%.1f
customfield=_AvgDiskReadQueueLength,PERF_COUNTER_100NS_QUEUELEN_TYPE,AvgDiskReadQueueLength,%.1f
customfield=_AvgDiskWriteQueueLength,PERF_COUNTER_100NS_QUEUELEN_TYPE,AvgDiskWriteQueueLength,%.1f

test=_PercentIdleTime
test=_PercentBusyTime
test=_PercentDiskTime
test=_PercentDiskReadTime
test=_PercentDiskWriteTime
test=_DiskReadBytesPersec
test=_DiskReadsPersec
test=_DiskWriteBytesPersec
test=_DiskWritesPersec
test=CurrentDiskQueueLength
test=_AvgDiskQueueLength
test=_AvgDiskReadQueueLength
test=_AvgDiskWriteQueueLength

# will show the overall status
predisplay=_DisplayMsg||Overall Status - |~| -||

display=Name||  Physical Drive Name|="| ||"
# will show the status of each item returned
display=_DisplayMsg||~|~| - |(|)
display=_PercentIdleTime|%
display=_PercentBusyTime|%
display=_PercentDiskTime|%
display=_PercentDiskReadTime|%
display=_PercentDiskWriteTime|%
display=_DiskReadBytesPersec|#B/sec
display=_DiskReadsPersec|#/sec
display=_DiskWriteBytesPersec|#B/sec
display=_DiskWritesPersec|#/sec
display=CurrentDiskQueueLength
display=_AvgDiskQueueLength
display=_AvgDiskReadQueueLength
display=_AvgDiskWriteQueueLength

# since this check can return multiple rows at a time (it uses LIKE and % in the WMI query)
# need to include the {Name} so that performance data is unique to each instance
perf=_PercentIdleTime||_PercentIdleTime{Name}
perf=_PercentBusyTime||_PercentBusyTime{Name}
perf=_PercentDiskTime||_PercentDiskTime{Name}
perf=_PercentDiskReadTime||_PercentDiskReadTime{Name}
perf=_PercentDiskWriteTime||_PercentDiskWriteTime{Name}
perf=_DiskReadBytesPersec||_DiskReadBytesPersec{Name}
perf=_DiskReadsPersec||_DiskReadsPersec{Name}
perf=_DiskWriteBytesPersec||_DiskWriteBytesPersec{Name}
perf=_DiskWritesPersec||_DiskWritesPersec{Name}
perf=CurrentDiskQueueLength||CurrentDiskQueueLength{Name}
perf=_AvgDiskQueueLength||_AvgDiskQueueLength{Name}
perf=_AvgDiskReadQueueLength||_AvgDiskReadQueueLength{Name}
perf=_AvgDiskWriteQueueLength||_AvgDiskWriteQueueLength{Name}

The display and perf values are where you can isolate specific fields for a given module.

[gilfalko]

Altering the ini file was my last resort.
I really thought there was an option to filter out the data.
That checkio just outputs way too much stuff. It sounded natural.
Oh well, I guess I dont have much of a choice now.

Thanks for the reply!

[dwhitfield]

Did you want to leave this open for community input or did you want to go ahead and lock it up?

[gilfalko]

I actually still have some more questions...

I just cant seem to figure out how to filter this query down.

Code: Select all

#----------------------------------------------------------
[checkio physical2]
requires=1.42
inihelp=<<EOT
Check physical disk IO.
These disks checks use WMI Raw counters to calculate values over a given timeperiod.
This is much more accurate than taking Formatted WMI values.
Note that some of the PercentDisk values seem to give incorrect values. Use with caution.
This check can return data for multiple drives in a single check.
ARG1  Name of the logical Windows drive to check eg C: Use % for Wilcard.
   Use _Total to check all drives combined.
EOT

# select only one row specific to the disk we are interested in
# query needs to include "like" since the physical drive names might not be fully as expected eg "01 C:"
# we automatically include % at the front of the arg1
query=SELECT DiskReadBytesPersec FROM Win32_PerfRawData_PerfDisk_PhysicalDisk WHERE Name LIKE "%{_arg1}"

# run 2 WMI queries, 5 seconds apart. The delay only applies if using --nokeepstate
samples=2
delay=5

#customfield=_PercentIdleTime,PERF_PRECISION_100NS_TIMER,PercentIdleTime,%.0f,100
#customfield=_PercentBusyTime,PERF_PRECISION_100NS_TIMER,PercentIdleTime,%.0f,100,100

# these ones seem to give results over 100%?
#customfield=_PercentDiskTime,PERF_PRECISION_100NS_TIMER,PercentDiskTime,%.0f,100
#customfield=_PercentDiskReadTime,PERF_PRECISION_100NS_TIMER,PercentDiskReadTime,%.0f,100
#customfield=_PercentDiskWriteTime,PERF_PRECISION_100NS_TIMER,PercentDiskWriteTime,%.0f,100

customfield=_DiskReadBytesPersec,PERF_COUNTER_BULK_COUNT,DiskReadBytesPersec,%.0f
#customfield=_DiskReadsPersec,PERF_COUNTER_COUNTER,DiskReadsPersec,%.0f
#customfield=_DiskWriteBytesPersec,PERF_COUNTER_BULK_COUNT,DiskWriteBytesPersec,%.0f
#customfield=_DiskWritesPersec,PERF_COUNTER_COUNTER,DiskWritesPersec,%.0f

# might not work in Server 2003
#customfield=_AvgDiskQueueLength,PERF_COUNTER_100NS_QUEUELEN_TYPE,AvgDiskQueueLength,%.1f
#customfield=_AvgDiskReadQueueLength,PERF_COUNTER_100NS_QUEUELEN_TYPE,AvgDiskReadQueueLength,%.1f
#customfield=_AvgDiskWriteQueueLength,PERF_COUNTER_100NS_QUEUELEN_TYPE,AvgDiskWriteQueueLength,%.1f

#test=_PercentIdleTime
#test=_PercentBusyTime
#test=_PercentDiskTime
#test=_PercentDiskReadTime
#test=_PercentDiskWriteTime
test=_DiskReadBytesPersec
#test=_DiskReadsPersec
#test=_DiskWriteBytesPersec
#test=_DiskWritesPersec
#test=CurrentDiskQueueLength
#test=_AvgDiskQueueLength
#test=_AvgDiskReadQueueLength
#test=_AvgDiskWriteQueueLength

# will show the overall status
predisplay=_DisplayMsg||Overall Status - |~| -||

display=Name||  Physical Drive Name|="| ||"
# will show the status of each item returned
display=_DisplayMsg||~|~| - |(|)
#display=_PercentIdleTime|%
#display=_PercentBusyTime|%
#display=_PercentDiskTime|%
#display=_PercentDiskReadTime|%
d#isplay=_PercentDiskWriteTime|%
display=_DiskReadBytesPersec|#B/sec
#display=_DiskReadsPersec|#/sec
#display=_DiskWriteBytesPersec|#B/sec
#display=_DiskWritesPersec|#/sec
#display=CurrentDiskQueueLength
#display=_AvgDiskQueueLength
#display=_AvgDiskReadQueueLength
#display=_AvgDiskWriteQueueLength

# since this check can return multiple rows at a time (it uses LIKE and % in the WMI query)
# need to include the {Name} so that performance data is unique to each instance
#perf=_PercentIdleTime||_PercentIdleTime{Name}
#perf=_PercentBusyTime||_PercentBusyTime{Name}
#perf=_PercentDiskTime||_PercentDiskTime{Name}
#perf=_PercentDiskReadTime||_PercentDiskReadTime{Name}
#perf=_PercentDiskWriteTime||_PercentDiskWriteTime{Name}
perf=_DiskReadBytesPersec||_DiskReadBytesPersec{Name}
#perf=_DiskReadsPersec||_DiskReadsPersec{Name}
#perf=_DiskWriteBytesPersec||_DiskWriteBytesPersec{Name}
#perf=_DiskWritesPersec||_DiskWritesPersec{Name}
#perf=CurrentDiskQueueLength||CurrentDiskQueueLength{Name}
#perf=_AvgDiskQueueLength||_AvgDiskQueueLength{Name}
#perf=_AvgDiskReadQueueLength||_AvgDiskReadQueueLength{Name}
#perf=_AvgDiskWriteQueueLength||_AvgDiskWriteQueueLength{Name}

#----------------------------------------------------------

The following gives me the following error after running a second time:

Divide by Zero error. Sometimes this happens if you are using a Win32_PerfFormattedData class when you should be using a Win32_PerfRAWData class (this check will continually get this error). It can also happen if the 2nd WMI query, for a check that requires 2 WMI queries, fails (this might be a transient problem). Also, you might have forgotten to include a time-based field (eg Timestamp_Sys100NS, Frequency_Sys100NS), which is required for the calculation, in your WMI query.The actual error text is: Illegal division by zero at ./check_wmi_plus.pl line 2364.

[mcapra]

This has been working for me:

Code: Select all

#----------------------------------------------------------
[checkio physical2]
requires=1.42
inihelp=<<EOT
Check physical disk IO. 
These disks checks use WMI Raw counters to calculate values over a given timeperiod. 
This is much more accurate than taking Formatted WMI values.
Note that some of the PercentDisk values seem to give incorrect values. Use with caution.
This check can return data for multiple drives in a single check.
ARG1  Name of the logical Windows drive to check eg C: Use % for Wilcard.
   Use _Total to check all drives combined.
EOT

# select only one row specific to the disk we are interested in
# query needs to include "like" since the physical drive names might not be fully as expected eg "01 C:"
# we automatically include % at the front of the arg1
query=SELECT * FROM Win32_PerfRawData_PerfDisk_PhysicalDisk WHERE Name LIKE "%{_arg1}"

# run 2 WMI queries, 5 seconds apart. The delay only applies if using --nokeepstate
samples=2
delay=5
customfield=_DiskWriteBytesPersec,PERF_COUNTER_BULK_COUNT,DiskWriteBytesPersec,%.0f

test=_DiskWriteBytesPersec
predisplay=_DisplayMsg||Overall Status - |~| -||

display=Name||  Physical Drive Name|="| ||"
display=_DiskWriteBytesPersec|#B/sec
perf=_DiskWriteBytesPersec||_DiskWriteBytesPersec{Name}

Results:

Code: Select all

[root@xi-stable ~]#  /usr/local/nagios/libexec/check_wmi_plus.pl --IgnoreMyOutDatedPerlModuleVersions -H '192.168.67.99' -u 'admin' -p 'welcome123' -m checkio -s physical2
Overall Status - OK (Sample Period 26 sec) -  Physical Drive Name="0 C:" _DiskWriteBytesPersec=172.317KB/sec  Physical Drive Name="1 E:" _DiskWriteBytesPersec=0B/sec  Physical Drive Name="_Total" _DiskWriteBytesPersec=172.317KB/sec|'_DiskWriteBytesPersec0 C:'=176453; '_DiskWriteBytesPersec1 E:'=0; '_DiskWriteBytesPersec_Total'=176453;

Give that a shot. If it still doesn't work, run the plugin with -d to get more debug information and share the full output.

[dwhitfield]

Did @mcapra's post help you? Please let us know if you have any additional questions.