Code: Select all
# Get additional ini file configurations and share your configurations
# at http://www.edcint.co.nz
# This is an ini file for check_wmi_plus.pl - nagios plugin for agentless checking of Windows
# Copyright (C) 2011 Matthew Jurgens
# You can email me using: mjurgens (the at goes here) edcint.co.nz
# Download link can be found at http://www.edcint.co.nz
[ini]
# information about the ini file
author=Matthew Jurgens
# ini file version
version=1.3
#----
[variables]
#===USER DEFINED CHECKS===
#---
[checkio logical]
requires=1.42
inihelp=<<EOT
Check logical disk IO.
These disks checks use WMI Raw counters to calculate values over a given timeperiod.
This is much more accurate than taking Formatted WMI values.
Note that some of the PercentDisk values seem to give incorrect values. Use with caution.
This check can return data for multiple drives in a single check.
ARG1 Name of the logical Windows drive to check eg C:. Use % for Wilcard.
Use _Total to check all drives combined.
EOT
# select only one row specific to the disk we are interested in
query=SELECT * FROM Win32_PerfRawData_PerfDisk_LogicalDisk WHERE Name LIKE "{_arg1}"
# run 2 WMI queries, 5 seconds apart. The delay only applies if using --nokeepstate
samples=2
delay=5
customfield=_PercentIdleTime,PERF_PRECISION_100NS_TIMER,PercentIdleTime,%.0f,100
customfield=_PercentBusyTime,PERF_PRECISION_100NS_TIMER,PercentIdleTime,%.0f,100,100
# these ones seem to give results over 100%?
customfield=_PercentDiskTime,PERF_PRECISION_100NS_TIMER,PercentDiskTime,%.0f,100
customfield=_PercentDiskReadTime,PERF_PRECISION_100NS_TIMER,PercentDiskReadTime,%.0f,100
customfield=_PercentDiskWriteTime,PERF_PRECISION_100NS_TIMER,PercentDiskWriteTime,%.0f,100
customfield=_DiskReadBytesPersec,PERF_COUNTER_BULK_COUNT,DiskReadBytesPersec,%.0f
customfield=_DiskReadsPersec,PERF_COUNTER_COUNTER,DiskReadsPersec,%.0f
customfield=_DiskWriteBytesPersec,PERF_COUNTER_BULK_COUNT,DiskWriteBytesPersec,%.0f
customfield=_DiskWritesPersec,PERF_COUNTER_COUNTER,DiskWritesPersec,%.0f
# might not work in Server 2003
customfield=_AvgDiskQueueLength,PERF_COUNTER_100NS_QUEUELEN_TYPE,AvgDiskQueueLength,%.1f
customfield=_AvgDiskReadQueueLength,PERF_COUNTER_100NS_QUEUELEN_TYPE,AvgDiskReadQueueLength,%.1f
customfield=_AvgDiskWriteQueueLength,PERF_COUNTER_100NS_QUEUELEN_TYPE,AvgDiskWriteQueueLength,%.1f
test=_PercentIdleTime
test=_PercentBusyTime
test=_PercentDiskTime
test=_PercentDiskReadTime
test=_PercentDiskWriteTime
test=_DiskReadBytesPersec
test=_DiskReadsPersec
test=_DiskWriteBytesPersec
test=_DiskWritesPersec
test=CurrentDiskQueueLength
test=_AvgDiskQueueLength
test=_AvgDiskReadQueueLength
test=_AvgDiskWriteQueueLength
# will show the overall status
predisplay=_DisplayMsg||Overall Status - |~| -||
display=Name|| Logical Drive Name|="| ||"
# will show the status of each item returned
display=_DisplayMsg||~|~| - |(|)
display=_PercentIdleTime|%
display=_PercentBusyTime|%
display=_PercentDiskTime|%
display=_PercentDiskReadTime|%
display=_PercentDiskWriteTime|%
display=_DiskReadBytesPersec|#B/sec
display=_DiskReadsPersec|#/sec
display=_DiskWriteBytesPersec|#B/sec
display=_DiskWritesPersec|#/sec
display=CurrentDiskQueueLength
display=_AvgDiskQueueLength
display=_AvgDiskReadQueueLength
display=_AvgDiskWriteQueueLength
# since this check can return multiple rows at a time
perf=_PercentIdleTime||_PercentIdleTime{Name}
perf=_PercentBusyTime||_PercentBusyTime{Name}
perf=_PercentDiskTime||_PercentDiskTime{Name}
perf=_PercentDiskReadTime||_PercentDiskReadTime{Name}
perf=_PercentDiskWriteTime||_PercentDiskWriteTime{Name}
perf=_DiskReadBytesPersec||_DiskReadBytesPersec{Name}
perf=_DiskReadsPersec||_DiskReadsPersec{Name}
perf=_DiskWriteBytesPersec||_DiskWriteBytesPersec{Name}
perf=_DiskWritesPersec||_DiskWritesPersec{Name}
perf=CurrentDiskQueueLength||CurrentDiskQueueLength{Name}
perf=_AvgDiskQueueLength||_AvgDiskQueueLength{Name}
perf=_AvgDiskReadQueueLength||_AvgDiskReadQueueLength{Name}
perf=_AvgDiskWriteQueueLength||_AvgDiskWriteQueueLength{Name}
#---
[checkio physical]
requires=1.42
inihelp=<<EOT
Check physical disk IO.
These disks checks use WMI Raw counters to calculate values over a given timeperiod.
This is much more accurate than taking Formatted WMI values.
Note that some of the PercentDisk values seem to give incorrect values. Use with caution.
This check can return data for multiple drives in a single check.
ARG1 Name of the logical Windows drive to check eg C: Use % for Wilcard.
Use _Total to check all drives combined.
EOT
# select only one row specific to the disk we are interested in
# query needs to include "like" since the physical drive names might not be fully as expected eg "01 C:"
# we automatically include % at the front of the arg1
query=SELECT * FROM Win32_PerfRawData_PerfDisk_PhysicalDisk WHERE Name LIKE "%{_arg1}"
# run 2 WMI queries, 5 seconds apart. The delay only applies if using --nokeepstate
samples=2
delay=5
customfield=_PercentIdleTime,PERF_PRECISION_100NS_TIMER,PercentIdleTime,%.0f,100
customfield=_PercentBusyTime,PERF_PRECISION_100NS_TIMER,PercentIdleTime,%.0f,100,100
# these ones seem to give results over 100%?
customfield=_PercentDiskTime,PERF_PRECISION_100NS_TIMER,PercentDiskTime,%.0f,100
customfield=_PercentDiskReadTime,PERF_PRECISION_100NS_TIMER,PercentDiskReadTime,%.0f,100
customfield=_PercentDiskWriteTime,PERF_PRECISION_100NS_TIMER,PercentDiskWriteTime,%.0f,100
customfield=_DiskReadBytesPersec,PERF_COUNTER_BULK_COUNT,DiskReadBytesPersec,%.0f
customfield=_DiskReadsPersec,PERF_COUNTER_COUNTER,DiskReadsPersec,%.0f
customfield=_DiskWriteBytesPersec,PERF_COUNTER_BULK_COUNT,DiskWriteBytesPersec,%.0f
customfield=_DiskWritesPersec,PERF_COUNTER_COUNTER,DiskWritesPersec,%.0f
# might not work in Server 2003
customfield=_AvgDiskQueueLength,PERF_COUNTER_100NS_QUEUELEN_TYPE,AvgDiskQueueLength,%.1f
customfield=_AvgDiskReadQueueLength,PERF_COUNTER_100NS_QUEUELEN_TYPE,AvgDiskReadQueueLength,%.1f
customfield=_AvgDiskWriteQueueLength,PERF_COUNTER_100NS_QUEUELEN_TYPE,AvgDiskWriteQueueLength,%.1f
test=_PercentIdleTime
test=_PercentBusyTime
test=_PercentDiskTime
test=_PercentDiskReadTime
test=_PercentDiskWriteTime
test=_DiskReadBytesPersec
test=_DiskReadsPersec
test=_DiskWriteBytesPersec
test=_DiskWritesPersec
test=CurrentDiskQueueLength
test=_AvgDiskQueueLength
test=_AvgDiskReadQueueLength
test=_AvgDiskWriteQueueLength
# will show the overall status
predisplay=_DisplayMsg||Overall Status - |~| -||
display=Name|| Physical Drive Name|="| ||"
# will show the status of each item returned
display=_DisplayMsg||~|~| - |(|)
display=_PercentIdleTime|%
display=_PercentBusyTime|%
display=_PercentDiskTime|%
display=_PercentDiskReadTime|%
display=_PercentDiskWriteTime|%
display=_DiskReadBytesPersec|#B/sec
display=_DiskReadsPersec|#/sec
display=_DiskWriteBytesPersec|#B/sec
display=_DiskWritesPersec|#/sec
display=CurrentDiskQueueLength
display=_AvgDiskQueueLength
display=_AvgDiskReadQueueLength
display=_AvgDiskWriteQueueLength
# since this check can return multiple rows at a time (it uses LIKE and % in the WMI query)
perf=_PercentIdleTime||_PercentIdleTime{Name}
perf=_PercentBusyTime||_PercentBusyTime{Name}
perf=_PercentDiskTime||_PercentDiskTime{Name}
perf=_PercentDiskReadTime||_PercentDiskReadTime{Name}
perf=_PercentDiskWriteTime||_PercentDiskWriteTime{Name}
perf=_DiskReadBytesPersec||_DiskReadBytesPersec{Name}
perf=_DiskReadsPersec||_DiskReadsPersec{Name}
perf=_DiskWriteBytesPersec||_DiskWriteBytesPersec{Name}
perf=_DiskWritesPersec||_DiskWritesPersec{Name}
perf=CurrentDiskQueueLength||CurrentDiskQueueLength{Name}
perf=_AvgDiskQueueLength||_AvgDiskQueueLength{Name}
perf=_AvgDiskReadQueueLength||_AvgDiskReadQueueLength{Name}
perf=_AvgDiskWriteQueueLength||_AvgDiskWriteQueueLength{Name}
#---
[checkio old_logical]
requires=1.41
inihelp=<<EOT
Check logical disk IO. Superseeded by checkio logical.
ARG1 Name of the logical Windows drive to check eg C:. Use _Total to check all drives combined.
EOT
# select only one row specific to the disk we are interested in
query=SELECT * FROM Win32_PerfFormattedData_PerfDisk_LogicalDisk WHERE Name="{_arg1}"
test=PercentDiskTime
test=PercentIdleTime
test=PercentDiskReadTime
test=PercentDiskWriteTime
test=DiskReadBytesPersec
test=DiskReadsPersec
test=DiskWriteBytesPersec
test=DiskWritesPersec
test=CurrentDiskQueueLength
test=AvgDiskQueueLength
test=AvgDiskReadQueueLength
test=AvgDiskWriteQueueLength
display=_DisplayMsg||~|~| - ||
display=Name||Logical Drive Name|="|||"
display=PercentDiskTime
display=PercentIdleTime
display=PercentDiskReadTime
display=PercentDiskWriteTime
display=DiskReadBytesPersec
display=DiskReadsPersec
display=DiskWriteBytesPersec
display=DiskWritesPersec
display=CurrentDiskQueueLength
display=AvgDiskQueueLength
display=AvgDiskReadQueueLength
display=AvgDiskWriteQueueLength
perf=PercentDiskTime
perf=PercentIdleTime
perf=PercentDiskReadTime
perf=PercentDiskWriteTime
perf=DiskReadBytesPersec
perf=DiskReadsPersec
perf=DiskWriteBytesPersec
perf=DiskWritesPersec
perf=CurrentDiskQueueLength
perf=AvgDiskQueueLength
perf=AvgDiskReadQueueLength
perf=AvgDiskWriteQueueLength
#---
[checkio old_physical]
requires=1.41
inihelp=<<EOT
Check physical disk IO. Superseeded by checkio physical.
ARG1 Name of the physical Windows drive to check eg C:. Use _Total to check all drives combined.
EOT
# select only one row specific to the disk we are interested in
query=SELECT * FROM Win32_PerfFormattedData_PerfDisk_PhysicalDisk WHERE Name LIKE "%{_arg1}"
test=PercentDiskTime
test=PercentIdleTime
test=PercentDiskReadTime
test=PercentDiskWriteTime
test=DiskReadBytesPersec
test=DiskReadsPersec
test=DiskWriteBytesPersec
test=DiskWritesPersec
test=CurrentDiskQueueLength
test=AvgDiskQueueLength
test=AvgDiskReadQueueLength
test=AvgDiskWriteQueueLength
display=_DisplayMsg||~|~| - ||
display=Name||Physical Drive Name|="|||"
display=PercentDiskTime
display=PercentIdleTime
display=PercentDiskReadTime
display=PercentDiskWriteTime
display=DiskReadBytesPersec
display=DiskReadsPersec
display=DiskWriteBytesPersec
display=DiskWritesPersec
display=CurrentDiskQueueLength
display=AvgDiskQueueLength
display=AvgDiskReadQueueLength
display=AvgDiskWriteQueueLength
perf=PercentDiskTime
perf=PercentIdleTime
perf=PercentDiskReadTime
perf=PercentDiskWriteTime
perf=DiskReadBytesPersec
perf=DiskReadsPersec
perf=DiskWriteBytesPersec
perf=DiskWritesPersec
perf=CurrentDiskQueueLength
perf=AvgDiskQueueLength
perf=AvgDiskReadQueueLength
perf=AvgDiskWriteQueueLength
#----
#---
[checkserv byname]
requires=1.45
inihelp=<<EOT
An ini implementation similar to checkservice. This uses a WMI query that may perform faster on busy systems.
ARG1 The DisplayName or Name of the service to search for. Use % for wildcards.
Note: Use --nodatamode and/or NODATAEXIT settings to control what happens if no matching process is found.
EOT
# we need to convert back / to \ for this one
slashconversion=1
# might select multiple rows
query=select displayname, Started, StartMode, State, Status FROM Win32_Service WHERE displayname LIKE "{_arg1}" OR name LIKE "{_arg1}"
test=_ItemCount
# test=Status - can't do this yet since plugin can't check warn/crit against strings yet
# fields to display before we list out all the CPU data
predisplay=_DisplayMsg||~|~| - ||
predisplay=_ItemCount| Instance(s)|Found |~|~|| of services matching "{_arg1}" running.
#FIELD|UNITS|DISPLAY|SEP|DELIM|START|END
display=DisplayName||~|~|~||
display=Name||~|~|~|(|)
display=Started||~|~|||
display=State||~|~|||
display=Status||is |~|||,
perf=_ItemCount||Service Count
#---
[checkproc cmdline]
requires=1.41
inihelp=<<EOT
An ini implementation similar to checkprocess.
ARG1 The exact command line to search for. Use / instead of \\.
e.g. C:/WINDOWS/system32/services.exe.
Note: Use --nodatamode and/or NODATAEXIT settings to control what happens if no matching process is found.
EOT
# we need to convert back / to \ for this one
slashconversion=1
# select only one row specific to the disk we are interested in
query=select Name,CommandLine from Win32_Process WHERE CommandLine = "{_arg1}"
test=_ItemCount
display=_DisplayMsg||~|~| - ||
display=_ItemCount| Instance(s)|Found |~|~|| of "{_arg1}" running.
perf=_ItemCount||Process Count
#---
[checkproc memory]
requires=1.48
inihelp=<<EOT
Check memory details for individual processes showing individual process details.
ARG1 The processname to look for. Use % for wildcards.
The process name typically only includes the actual file name minus its suffix eg firefox, svchost
If there are multiple instances eg svchost, then some versions of Windows have them named all the same while others
such as Windows 2008 Server, have them numbered eg svchost#1, svchost#2, svchost#3. To get all svchost processes you
need to set ARG1 to svchost%
To view all processes set ARG1 to "%" and the full process list will be included in the plugin output.
Note: Use --nodatamode and/or NODATAEXIT settings to control what happens if no matching process is found.
EOT
aligndata=Name,IDProcess
query=select Name,IDProcess,PrivateBytes,VirtualBytes,WorkingSet from Win32_PerfFormattedData_PerfProc_Process WHERE Name like "{_arg1}"
# calculate sums for these fields
calc=PrivateBytes,VirtualBytes,WorkingSet
test=_ItemCount
test=PrivateBytes
test=WorkingSet
test=VirtualBytes
predisplay=_ItemCount| Instance(s)|Found |~|. || of "{_arg1}" running
display=_DisplayMsg||~|~| - ||
display=PrivateBytes|#B|{Name}: Private Memory||||
display=WorkingSet|#B|Working Set||||
display=VirtualBytes|#B|Virtual Memory||~||
# need to include the {Name} so that performance data is unique to each instance
perf=_ItemCount||Process Count
perf=PrivateBytes|Bytes|PrivateMemory_{Name}
perf=WorkingSet|Bytes|TotalWorkingSet_{Name}
perf=VirtualBytes|Bytes|VirtualMemory_{Name}
#---
[checkproc memoryabove]
requires=1.48
inihelp=<<EOT
Check for processes using more that a specified amount of memory. To make this work as intended you need to specify some
warning/critical criteria eg -w WorkingSet=50M for warning when a process uses more than 50M of WorkingSet memory. You probably also want to remove
all processes with memory lower than the warning level. Do this using something like -exc WorkingSet=@0:40M (which will exclude processes that have a WorkingSet between 0 and 40M). We could have made that -exc WorkingSet=@0:50M but then the check will only show processes when there are some to warn against. That might be what you want. Instead of WorkingSet, you can also use PrivateBytes or VirtualBytes. You can in fact use more than one of them at the same time if you wish eg -exc WorkingSet=@0:50M -exc VirtualBytes=@0:50M.
ARG1 The processname to look for. Use % for wildcards.
The process name typically only includes the actual file name minus its suffix eg firefox, svchost
If there are multiple instances eg svchost, then some versions of Windows have them named all the same while others
such as Windows 2008 Server, have them numbered eg svchost#1, svchost#2, svchost#3. To get all svchost processes you
need to set ARG1 to svchost%
To view all processes set ARG1 to "%" and the full process list will be included in the plugin output.
Note: Use --nodatamode and/or NODATAEXIT settings to control what happens if no matching process is found.
EOT
aligndata=Name,IDProcess
query=select Name,IDProcess,PrivateBytes,VirtualBytes,WorkingSet from Win32_PerfFormattedData_PerfProc_Process WHERE Name like "{_arg1}"
# calculate sums for these fields
calc=PrivateBytes,VirtualBytes,WorkingSet
test=_ItemCount
test=PrivateBytes
test=WorkingSet
test=VirtualBytes
predisplay=_DisplayMsg||~|~| - ||
predisplay=_ItemCount||Total Process Count|||| (Process details on next line)\n
display=_DisplayMsg||~|~| - ||
display=PrivateBytes|#B|{Name}: Private Memory||||
display=WorkingSet|#B|Working Set||||
display=VirtualBytes|#B|Virtual Memory||~||\n
# need to include the {Name} so that performance data is unique to each instance
perf=_ItemCount||Process Count
perf=PrivateBytes|Bytes|PrivateMemory_{Name}
perf=WorkingSet|Bytes|TotalWorkingSet_{Name}
perf=VirtualBytes|Bytes|VirtualMemory_{Name}
#---
[checkproc memorytotals]
requires=1.48
inihelp=<<EOT
Check memory details for individual processes and show memory totals.
ARG1 The processname to look for. Use % for wildcards.
The process name typically only includes the actual file name minus its suffix eg firefox, svchost
If there are multiple instances eg svchost, then some versions of Windows have them named all the same while others
such as Windows 2008 Server, have them numbered eg svchost#1, svchost#2, svchost#3. To get all svchost processes you
need to set ARG1 to svchost%
To view all processes set ARG1 to "%" and the full process list will be included in the plugin output.
Note: Use --nodatamode and/or NODATAEXIT settings to control what happens if no matching process is found.
EOT
aligndata=Name,IDProcess
query=select Name,IDProcess,PrivateBytes,VirtualBytes,WorkingSet from Win32_PerfFormattedData_PerfProc_Process WHERE Name like "{_arg1}"
# calculate sums for these fields
calc=PrivateBytes,VirtualBytes,WorkingSet
#createlist=NEWFIELDNAME|LINEDELIM|FIELDDELIM|UNIQUE|FIELD1,FIELD2,etc
# create a list of the process names found
createlist=_ProcessList|), | (PID=|1|Name,IDProcess
test=_ItemCount
test=_ColSum_PrivateBytes
test=_ColSum_WorkingSet
test=_ColSum_VirtualBytes
display=_DisplayMsg||~|~| - ||
display=_ItemCount| Instance(s)|Found |~|. || of "{_arg1}" running
display=_ColSum_PrivateBytes|#B|Total Private Memory||||
display=_ColSum_WorkingSet|#B|Total Working Set||||
display=_ColSum_VirtualBytes|#B|Total Virtual Memory||~||
display=_ProcessList||\nProcesses Found are |~|~||
# need to include the {Name} so that performance data is unique to each instance
perf=_ItemCount||Process Count
perf=_ColSum_PrivateBytes|Bytes|Total Private Memory
perf=_ColSum_WorkingSet|Bytes|Total Working Set
perf=_ColSum_VirtualBytes|Bytes|Total Virtual Memory
# do not process all individual WMI data rows for warn/critical/display/perfdata
# this is because we are using a createlist to show the processes
processallrows=0
#---
[checkproc cpu]
requires=1.48
inihelp=<<EOT
Check cpu details for individual processes
ARG1 The processname to look for. Use % for wildcards.
The process name typically only includes the actual file name minus its suffix eg firefox, svchost
If there are multiple instances eg svchost, then some versions of Windows have them named all the same while others
such as Windows 2008 Server, have them numbered eg svchost#1, svchost#2, svchost#3. To get all svchost processes you
need to set ARG1 to svchost%
To view all processes set ARG1 to "%" and the full process list will be included in the plugin output.
Note: Use --nodatamode and/or NODATAEXIT settings to control what happens if no matching process is found.
EOT
aligndata=Name,IDProcess
query=select Name,IDProcess,PercentProcessorTime,Timestamp_Sys100NS from Win32_PerfRawData_PerfProc_Process WHERE Name like "{_arg1}"
# run 2 WMI queries, 5 seconds apart. The delay only applies if using --nokeepstate
samples=2
delay=5
customfield=_AvgCPU,PERF_100NSEC_TIMER,PercentProcessorTime,%.1f,100
test=_AvgCPU
test=_ItemCount
# fields to display before we list out all the CPU data
predisplay=_DisplayMsg||~|~| - ||
predisplay=_ItemCount| Instance(s)|Found |~|. || of "{_arg1}" running
display=_AvgCPU|%|CPU_{Name}(PID={IDProcess})||||
# need to include the {Name} so that performance data is unique to each instance
perf=_ItemCount||Process Count
perf=_AvgCPU|%|Avg Utilisation CPU_{Name}
#----
[checkproc cpuabove]
requires=1.48
inihelp=<<EOT
Check for processes using more than a specified CPU utilisation. To make this work as intended you need to specify some
warning/critical criteria eg -w 50 for warning when a process uses more than 50% CPU. You probably also want to remove
all processes with low CPU from the results. Do this using something like -exc _AvgCPU=@0:5 (which will exclude processes that have CPU utilisation between 0 and 5%)
ARG1 The processname to look for. Use % for wildcards.
The process name typically only includes the actual file name minus its suffix eg firefox, svchost
If there are multiple instances eg svchost, then some versions of Windows have them named all the same while others
such as Windows 2008 Server, have them numbered eg svchost#1, svchost#2, svchost#3. To get all svchost processes you
need to set ARG1 to svchost%
To view all processes set ARG1 to "%" and the full process list will be included in the plugin output.
Note: Use --nodatamode and/or NODATAEXIT settings to control what happens if no matching process is found.
EOT
aligndata=Name,IDProcess
query=select Name,IDProcess,PercentProcessorTime,Timestamp_Sys100NS from Win32_PerfRawData_PerfProc_Process WHERE Name like "{_arg1}" and Name != "Idle" and Name != "_Total"
# run 2 WMI queries, 5 seconds apart. The delay only applies if using --nokeepstate
samples=2
delay=5
customfield=_AvgCPU,PERF_100NSEC_TIMER,PercentProcessorTime,%.1f,100
test=_AvgCPU
test=_ItemCount
# fields to display before we list out all the CPU data
predisplay=_DisplayMsg||~|~| - ||
predisplay=_ItemCount||Total Process Count|||| (Process details on next line)\n
display=_DisplayMsg||~|~| - ||
display=_AvgCPU|%|CPU for {Name} (PID={IDProcess})||||\n
# need to include the {Name} so that performance data is unique to each instance
perf=_ItemCount||Process Count
# perf=_AvgCPU|%|Avg Utilisation CPU_{Name} - don't really need perfdata for each process for this check - use checkproc cpu if you want that
#---
[checkproc count]
requires=1.43
inihelp=<<EOT
Check number of processes.
ARG1 The processname to look for. Use % for wildcards.
The process name typically only includes the actual file name minus its suffix eg firefox, svchost
If there are multiple instances eg svchost, then some versions of Windows have them named all the same while others
such as Windows 2008 Server, have them numbered eg svchost#1, svchost#2, svchost#3. To get all svchost processes you
need to set ARG1 to svchost%
To view all processes set ARG1 to "%" and the full process list will be included in the plugin output.
Note: Use --nodatamode and/or NODATAEXIT settings to control what happens if no matching process is found.
EOT
query=select Name,IDProcess from Win32_PerfFormattedData_PerfProc_Process WHERE Name like "{_arg1}" and Name != "Idle" and Name != "_Total"
#createlist=NEWFIELDNAME|LINEDELIM|FIELDDELIM|UNIQUE|FIELD1,FIELD2,etc
# create a list of the process names found
createlist=_ProcessList|), | (PID=|1|Name,IDProcess
test=_ItemCount
display=_DisplayMsg||~|~| - ||
display=_ItemCount| Instance(s)|Found |~|. || of "{_arg1}" running
display=_ProcessList||\nProcesses Found are |~|~||
# need to include the {Name} so that performance data is unique to each instance
perf=_ItemCount||Process Count
# do not process all individual WMI data rows for warn/critical/display/perfdata
# this is because we are using a createlist to show the processes
processallrows=0
#---
[checkproc info]
requires=1.48
inihelp=<<EOT
Check process attributes eg file handles, page faults etc
You might like to read the documentation for the WMI Class that this query uses to understand the attributes that can be checked.
Refer to http://msdn.microsoft.com/en-us/library/aa394372%28v=vs.85%29.
This check contains a lot of data so you probably want to restrict to to a minimal list of processes.
ARG1 The processname to look for. Use % for wildcards.
The process name typically only includes the actual file name minus its suffix eg firefox, svchost
If there are multiple instances eg svchost, then some versions of Windows have them named all the same while others
such as Windows 2008 Server, have them numbered eg svchost#1, svchost#2, svchost#3. To get all svchost processes you
need to set ARG1 to svchost%
To view all processes set ARG1 to "%" and the full process list will be included in the plugin output.
Note: Use --nodatamode and/or NODATAEXIT settings to control what happens if no matching process is found.
EOT
# we specifiy the exact fields we want to avoid returning the field OSName which contains a | which stuff us up
query=select Name,ProcessID,HandleCount,KernelModeTime,MaximumWorkingSetSize,MinimumWorkingSetSize,PageFaults,PageFileUsage,PeakPageFileUsage,PeakVirtualSize,PeakWorkingSetSize,Priority,PrivatePageCount,ReadOperationCount,ReadTransferCount,ThreadCount,UserModeTime,VirtualSize,WorkingSetSize,WriteOperationCount,WriteTransferCount from Win32_Process WHERE Name like "{_arg1}"
# create custom fields so that we can display the correct units in the output
#customfield=_MaximumWorkingSetSize,basicmaths,MaximumWorkingSetSize,*,{_bytefactor}
#customfield=_MinimumWorkingSetSize,basicmaths,MinimumWorkingSetSize,*,{_bytefactor}
#customfield=_PageFileUsage,basicmaths,PageFileUsage,*,{_bytefactor}
#customfield=_PeakPageFileUsage,basicmaths,PeakPageFileUsage,*,{_bytefactor}
#customfield=_PeakWorkingSetSize,basicmaths,PeakWorkingSetSize,*,{_bytefactor}
# these custom calcs converts the raw value in 100 nanosecond units to seconds
customfield=_KernelModeTime,basicmaths,KernelModeTime,/,10000000
customfield=_UserModeTime,basicmaths,UserModeTime,/,10000000
test=_ItemCount
test=HandleCount
test=_KernelModeTime
test=MaximumWorkingSetSize
test=MinimumWorkingSetSize
test=PageFaults
test=PageFileUsage
test=PeakPageFileUsage
test=PeakVirtualSize
test=PeakWorkingSetSize
test=Priority
test=PrivatePageCount
test=ReadOperationCount
test=ReadTransferCount
test=ThreadCount
test=_UserModeTime
test=VirtualSize
test=WorkingSetSize
test=WriteOperationCount
test=WriteTransferCount
# fields to display before we list out all the per process data
predisplay=_DisplayMsg||~|~| - ||
predisplay=_ItemCount| Instance(s)|Found |~|. || of "{_arg1}" running. Details on next line\n
display=HandleCount||Process Details for for {Name} (PID={ProcessId}), HandleCount||||
display=_KernelModeTime|#sec
display=MaximumWorkingSetSize|#bytes
display=MinimumWorkingSetSize|#bytes
display=PageFaults|#
display=PageFileUsage|#bytes
display=PeakPageFileUsage|#bytes
display=PeakVirtualSize|#bytes
display=PeakWorkingSetSize|#bytes
display=Priority
display=PrivatePageCount|#
display=ReadOperationCount|#
display=ReadTransferCount|#
display=ThreadCount|#
display=_UserModeTime|#sec
display=VirtualSize|#bytes
display=WorkingSetSize|#bytes
display=WriteOperationCount|#
display=WriteTransferCount|#|WriteTransferCount||||\n
perf=_ItemCount||Process Count
# need to include the {Name} so that performance data is unique to each instance
perf=_AvgCPU|%|Avg Utilisation CPU_{Name}
perf=HandleCount||HandleCount_{Name}
perf=_KernelModeTime|sec|_KernelModeTime_{Name}
perf=MaximumWorkingSetSize|bytes|MaximumWorkingSetSize_{Name}
perf=MinimumWorkingSetSize|bytes|MinimumWorkingSetSize_{Name}
perf=PageFaults||PageFaults_{Name}
perf=PageFileUsage|bytes|PageFileUsage_{Name}
perf=PeakPageFileUsage|bytes|PeakPageFileUsage_{Name}
perf=PeakVirtualSize|bytes|PeakVirtualSize_{Name}
perf=PeakWorkingSetSize|bytes|PeakWorkingSetSize_{Name}
perf=Priority||Priority_{Name}
perf=PrivatePageCount||PrivatePageCount_{Name}
perf=ReadOperationCount||ReadOperationCount_{Name}
perf=ReadTransferCount||ReadTransferCount_{Name}
perf=ThreadCount||ThreadCount_{Name}
perf=_UserModeTime|sec|_UserModeTime_{Name}
perf=VirtualSize|bytes|VirtualSize_{Name}
perf=WorkingSetSize|bytes|WorkingSetSize_{Name}
perf=WriteOperationCount||WriteOperationCount_{Name}
perf=WriteTransferCount||WriteTransferCount_{Name}
#---
[checkts show]
requires=1.41
inihelp=<<EOT
Show current Terminal Services Session names. Use this check, normally from the command line, to list the
curent session names. Session names are then used in other checkts checks.
EOT
query=SELECT Name FROM Win32_PerfRawData_TermService_TerminalServicesSession
predisplay=_host||Session Name List for |~||| -
display=Name||~|~|||,
#---
[checkts sessions]
requires=1.41
inihelp=<<EOT
Check Terminal Services Sessions.
Tested for Windows Server 2008.
EOT
query=SELECT * FROM Win32_PerfRawData_LocalSessionManager_TerminalServices
test=ActiveSessions
test=InactiveSessions
test=TotalSessions
display=_DisplayMsg||~|~| - ||
display=ActiveSessions
display=InactiveSessions
display=TotalSessions
perf=ActiveSessions
perf=InactiveSessions
perf=TotalSessions
#---
[checkts sessions2003]
requires=1.41
inihelp=<<EOT
Check Terminal Services Sessions.
Tested for Windows 2003, Windows XP.
EOT
query=SELECT * FROM Win32_PerfRawData_TermService_TerminalServices
test=ActiveSessions
test=InactiveSessions
test=TotalSessions
display=_DisplayMsg||~|~| - ||
display=ActiveSessions
display=InactiveSessions
display=TotalSessions
perf=ActiveSessions
perf=InactiveSessions
perf=TotalSessions
#---
[checkts sessioninfo]
requires=1.42
inihelp=<<EOT
Check Terminal Services Session Info for specific sessions.
ARG1 Name of the TS Session eg console
Note: Not tested on a real terminal services server - you might need to play with this to get what you need.
You can find the session names using the check MODE=checkts SUBMODE=show
EOT
query=SELECT * FROM Win32_PerfRawData_TermService_TerminalServicesSession where Name = "{_arg1}"
# run 2 WMI queries, 5 seconds apart. The delay only applies if using --nokeepstate
samples=2
delay=5
# I suspect some of these fields might be per time figures but the documentation does not say .....
customfield=_InputBytes,PERF_COUNTER_COUNTER,InputBytes,%.0f
customfield=_InputCompressedBytes,PERF_COUNTER_COUNTER,InputCompressedBytes,%.0f
customfield=_OutputBytes,PERF_COUNTER_COUNTER,OutputBytes,%.0f
customfield=_OutputCompressedBytes,PERF_COUNTER_COUNTER,OutputCompressedBytes,%.0f
customfield=_PercentProcessorTime,PERF_100NSEC_TIMER,PercentProcessorTime,%.0f,100
customfield=_TotalBytes,PERF_COUNTER_COUNTER,TotalBytes,%.0f
test=_InputBytes
test=_InputCompressedBytes
test=InputErrors
test=InputTimeouts
test=_OutputBytes
test=_OutputCompressedBytes
test=OutputErrors
test=OutputTimeouts
test=_PercentProcessorTime
test=PrivateBytes
test=ThreadCount
test=_TotalBytes
test=TotalErrors
test=TotalTimeouts
display=_DisplayMsg||~|~| - ||
display=Name||Session Name|="|||"
display=_InputBytes|#B
display=_InputCompressedBytes|#B
display=InputErrors|#
display=InputTimeouts|#
display=_OutputBytes|#B
display=_OutputCompressedBytes|#B
display=OutputErrors|#
display=OutputTimeouts|#
display=_PercentProcessorTime|%
display=PrivateBytes|#B
display=ThreadCount|#
display=_TotalBytes|#B
display=TotalErrors|#
display=TotalTimeouts|#
perf=_InputBytes
perf=_InputCompressedBytes
perf=InputErrors
perf=InputTimeouts
perf=_OutputBytes
perf=_OutputCompressedBytes
perf=OutputErrors
perf=OutputTimeouts
perf=_PercentProcessorTime
perf=PrivateBytes
perf=ThreadCount
perf=_TotalBytes
perf=TotalErrors
perf=TotalTimeouts
#---
[checkfolderfileage]
requires=1.48
inihelp=<<EOT
Check a Folder for files of a certain age.
You most likely want to use --includedata and or --excludedata to list only the files that match the age you are interested in and then use -w and -c to warn against the number of files you end up finding.
For example, find files in c:/temp with an age of between 0 and 10000 seconds.
Warn if you find more than 3 of these.
Use the parameters -a c: -o /temp/ -inc _FileAge=@0:10000 -w 3.
Alternatively, you could just warn against the _FileAge directly eg -a c: -o /temp/ -w _FileAge=1000
ARG1 The drive letter of the folder eg C:
ARG2 The path of the folder on the specified drive eg /temp/. Folders must end in /
EOT
# query is broken up to use drive and path fields since this would be much faster than a linear search for all matching "Names" using a "LIKE"
query=Select name,lastmodified from CIM_DataFile where drive="{_arg1}" AND path="{_arg2}"
# must convert slashes
slashconversion=1
# add the fileage field
customfield=_FileAge,WMITimestampToAgeSec,LastModified
test=_ItemCount
test=_FileAge
# fields to display before we list out all the CPU data
predisplay=_DisplayMsg||~|~| - ||
predisplay=_ItemCount||Number of Files||~||. Files -
# fields shown per cpu
display=_FileAge|s|{Name}||||
# You probably don't want performance data based on each file returned
# since this check can return multiple rows at a time
# need to include the {Name} so that performance data is unique to each instance
# perf=_FileAge|%|FileAge for {Name}
# but you probably do want it based on the number of files found
perf=_ItemCount
#---
[checkeachcpu]
requires=1.43
inihelp=<<EOT
Get CPU performance (like checkcpu) but provide information for each CPU. Cores are seen as CPUs.
EOT
query=select PercentProcessorTime,Timestamp_Sys100NS from Win32_PerfRawData_PerfOS_Processor
# run 2 WMI queries, 5 seconds apart. The delay only applies if using --nokeepstate
samples=2
delay=5
customfield=_AvgCPU,PERF_100NSEC_TIMER_INV,PercentProcessorTime,%.1f,100
test=_AvgCPU
# fields to display before we list out all the CPU data
predisplay=_DisplayMsg||~|~| - ||
#predisplay=_delay| sec|~|~|~|Average Utilisation (Over approx | period):
# fields shown per cpu
display=_AvgCPU|%|CPU{Name}||||
# since this check can return multiple rows at a time (it uses LIKE and % in the WMI query)
# need to include the {Name} so that performance data is unique to each instance
perf=_AvgCPU|%|Avg Utilisation CPU{Name}
#---
[checkdns stats]
requires=1.42
inihelp=<<EOT
Checks various stats for Microsoft Windows Server running as a DNS Server.
Tested for Windows Server 2003/2008 R2. Only tested on a low volume server.
EOT
# refer http://include.wutils.com/wmi/ROOT%5Ccimv2/CIM_StatisticalInformation/Win32_Perf/Win32_PerfRawData/Win32_PerfRawData_DNS_DNS.html
query=SELECT * FROM Win32_PerfRawData_DNS_DNS
# run 2 WMI queries, 5 seconds apart. The delay only applies if using --nokeepstate
samples=2
delay=5
customfield=_DynamicUpdateReceivedPersec,PERF_COUNTER_COUNTER,DynamicUpdateReceivedPersec,%.0f
customfield=_RecursiveQueriesPersec,PERF_COUNTER_COUNTER,RecursiveQueriesPersec,%.0f
customfield=_RecursiveTimeOutPersec,PERF_COUNTER_COUNTER,RecursiveTimeOutPersec,%.0f
customfield=_TotalQueryReceivedPersec,PERF_COUNTER_COUNTER,TotalQueryReceivedPersec,%.0f
customfield=_TCPQueryReceivedPersec,PERF_COUNTER_COUNTER,TCPQueryReceivedPersec,%.0f
customfield=_UDPQueryReceivedPersec,PERF_COUNTER_COUNTER,UDPQueryReceivedPersec,%.0f
customfield=_WINSLookupReceivedPersec,PERF_COUNTER_COUNTER,WINSLookupReceivedPersec,%.0f
test=CachingMemory
test=DatabaseNodeMemory
test=DynamicUpdateReceived
test=_DynamicUpdateReceivedPersec
test=RecursiveQueries
test=_RecursiveQueriesPersec
test=RecursiveQueryFailure
test=_RecursiveTimeOutPersec
test=TotalQueryReceived
test=_TotalQueryReceivedPersec
test=TCPQueryReceived
test=_TCPQueryReceivedPersec
test=UDPQueryReceived
test=_UDPQueryReceivedPersec
test=WINSLookupReceived
test=_WINSLookupReceivedPersec
display=_DisplayMsg||~|~| - ||
display=CachingMemory
display=DatabaseNodeMemory
display=DynamicUpdateReceived
display=_DynamicUpdateReceivedPersec
display=RecursiveQueries
display=_RecursiveQueriesPersec
display=RecursiveQueryFailure
display=_RecursiveTimeOutPersec
display=TotalQueryReceived
display=_TotalQueryReceivedPersec
display=TCPQueryReceived
display=_TCPQueryReceivedPersec
display=UDPQueryReceived
display=_UDPQueryReceivedPersec
display=WINSLookupReceived
display=_WINSLookupReceivedPersec
perf=CachingMemory
perf=DatabaseNodeMemory
perf=DynamicUpdateReceived
perf=_DynamicUpdateReceivedPersec
perf=RecursiveQueries
perf=_RecursiveQueriesPersec
perf=RecursiveQueryFailure
perf=_RecursiveTimeOutPersec
perf=TotalQueryReceived
perf=_TotalQueryReceivedPersec
perf=TCPQueryReceived
perf=_TCPQueryReceivedPersec
perf=UDPQueryReceived
perf=_UDPQueryReceivedPersec
perf=WINSLookupReceived
perf=_WINSLookupReceivedPersec
#---
[checkdns arecords]
requires=1.461
inihelp=<<EOT
Shows the number of DNS A records defined.
Tested for Windows Server 2003/2008 R2. Only tested on a low volume server.
ARG1 (optional) Specify a ContainerName (normally seen as a domain name) to restrict the search to
Note: You may want to use --nodatamode so that you can control how the plugin responds when no data is returned by the WMI query.
EOT
# set the namespace
namespace=root/MicrosoftDNS
query=SELECT * FROM MicrosoftDNS_AType WHEREBIT
# If ARG1 is used on the command line add a ContainerName where clause to the query to restrict the search
queryextension=WHEREBIT|WHERE ContainerName = "{_arg1}"|_arg1|^((?!default).)*$|NOTUSED
test=_ItemCount
display=_DisplayMsg||~|~| - ||
display=_ItemCount||Number of DNS A Records||||
perf=_ItemCount||DNS A Record Count
# we are only using the itemcount so no need to process all the rows
processallrows=0
#---
[checkdns cnamerecords]
requires=1.461
inihelp=<<EOT
Shows the number of DNS CNAME records defined.
Tested for Windows Server 2003/2008 R2. Only tested on a low volume server.
ARG1 (optional) Specify a ContainerName (normally seen as a domain name) to restrict the search to
Note: You may want to use --nodatamode so that you can control how the plugin responds when no data is returned by the WMI query.
EOT
# set the namespace
namespace=root/MicrosoftDNS
query=SELECT * FROM MicrosoftDNS_CNAMEType WHEREBIT
# If ARG1 is used on the command line add a ContainerName where clause to the query to restrict the search
# now we have used the tricky regex so that you can specify -a default on the command line which simplifies the generic nagios config as you only need one command definition
queryextension=WHEREBIT|WHERE ContainerName = "{_arg1}"|_arg1|^((?!default).)*$|NOTUSED
test=_ItemCount
display=_DisplayMsg||~|~| - ||
display=_ItemCount||Number of DNS CNAME Records||||
perf=_ItemCount||DNS CNAME Record Count
# we are only using the itemcount so no need to process all the rows
processallrows=0
#---
[checkdns ptrrecords]
requires=1.461
inihelp=<<EOT
Shows the number of DNS PTR records defined.
Tested for Windows Server 2003/2008 R2. Only tested on a low volume server.
ARG1 (optional) Specify a ContainerName (normally seen as a domain name) to restrict the search to
Note: You may want to use --nodatamode so that you can control how the plugin responds when no data is returned by the WMI query.
EOT
# set the namespace
namespace=root/MicrosoftDNS
query=SELECT * FROM MicrosoftDNS_PTRType WHEREBIT
# If ARG1 is used on the command line add a ContainerName where clause to the query to restrict the search
# now we have used the tricky regex so that you can specify -a default on the command line which simplifies the generic nagios config as you only need one command definition
queryextension=WHEREBIT|WHERE ContainerName = "{_arg1}"|_arg1|^((?!default).)*$|NOTUSED
test=_ItemCount
display=_DisplayMsg||~|~| - ||
display=_ItemCount||Number of DNS PTR Records||||
perf=_ItemCount||DNS PTR Record Count
# we are only using the itemcount so no need to process all the rows
processallrows=0
#---
[checkdhcp stats]
requires=1.42
inihelp=<<EOT
Checks various stats for Microsoft Windows Server running as an IPv4 DHCP Server
Tested for Windows Server 2003/2008 R2. Only tested on a low volume server.
Note: You may want to use --nodatamode so that you can control how the plugin responds when no data is returned by the WMI query.
EOT
# refer http://include.wutils.com/wmi/ROOT%5Ccimv2/CIM_StatisticalInformation/Win32_Perf/Win32_PerfRawData/Win32_PerfRawData_DNS_DNS.html
query=SELECT * FROM Win32_PerfRawData_DHCPServer_DHCPServer
# run 2 WMI queries, 5 seconds apart. The delay only applies if using --nokeepstate
samples=2
delay=5
customfield=_AcksPersec,PERF_COUNTER_COUNTER,AcksPersec,%.1f
customfield=_DeclinesPersec,PERF_COUNTER_COUNTER,DeclinesPersec,%.1f
customfield=_DiscoversPersec,PERF_COUNTER_COUNTER,DiscoversPersec,%.1f
customfield=_OffersPersec,PERF_COUNTER_COUNTER,OffersPersec,%.1f
customfield=_PacketsReceivedPersec,PERF_COUNTER_COUNTER,PacketsReceivedPersec,%.1f
customfield=_ReleasesPersec,PERF_COUNTER_COUNTER,ReleasesPersec,%.1f
customfield=_RequestsPersec,PERF_COUNTER_COUNTER,RequestsPersec,%.1f
test=_AcksPersec
test=ActiveQueueLength
test=ConflictCheckQueueLength
test=Deniedduetomatch
test=Deniedduetononmatch
test=_DeclinesPersec
test=_DiscoversPersec
test=_OffersPersec
test=_PacketsReceivedPersec
test=_ReleasesPersec
test=_RequestsPersec
display=_DisplayMsg||~|~| - ||
display=_AcksPersec
display=ActiveQueueLength
display=ConflictCheckQueueLength
display=Deniedduetomatch
display=Deniedduetononmatch
display=_DeclinesPersec
display=_DiscoversPersec
display=_OffersPersec
display=_PacketsReceivedPersec
display=_ReleasesPersec
display=_RequestsPersec
perf=_AcksPersec
perf=ActiveQueueLength
perf=ConflictCheckQueueLength
perf=Deniedduetomatch
perf=Deniedduetononmatch
perf=_DeclinesPersec
perf=_DiscoversPersec
perf=_OffersPersec
perf=_PacketsReceivedPersec
perf=_ReleasesPersec
perf=_RequestsPersec
#---
[checkdhcpv6 stats]
requires=1.42
inihelp=<<EOT
Checks various stats for Microsoft Windows Server running as an IPv6 DHCP Server
Tested for Windows Server 2008 R2. Only tested on a zero volume server!!
EOT
# refer http://include.wutils.com/wmi/ROOT%5Ccimv2/CIM_StatisticalInformation/Win32_Perf/Win32_PerfRawData/Win32_PerfRawData_DNS_DNS.html
query=SELECT * FROM Win32_PerfRawData_DHCPServer_DHCPServerv6
# run 2 WMI queries, 5 seconds apart. The delay only applies if using --nokeepstate
samples=2
delay=5
customfield=_AcksPersec,PERF_COUNTER_COUNTER,AcksPersec,%.1f
customfield=_ConfirmsPersec,PERF_COUNTER_COUNTER,ConfirmsPersec,%.1f
customfield=_DeclinesPersec,PERF_COUNTER_COUNTER,DeclinesPersec,%.1f
customfield=_PacketsReceivedPersec,PERF_COUNTER_COUNTER,PacketsReceivedPersec,%.1f
customfield=_ReleasesPersec,PERF_COUNTER_COUNTER,ReleasesPersec,%.1f
customfield=_RequestsPersec,PERF_COUNTER_COUNTER,RequestsPersec,%.1f
test=_AcksPersec
test=ActiveQueueLength
test=_ConfirmsPersec
test=_DeclinesPersec
test=_PacketsReceivedPersec
test=_ReleasesPersec
test=_RequestsPersec
display=_DisplayMsg||~|~| - ||
display=_AcksPersec
display=ActiveQueueLength
display=_ConfirmsPersec
display=_DeclinesPersec
display=_PacketsReceivedPersec
display=_ReleasesPersec
display=_RequestsPersec
perf=_AcksPersec
perf=ActiveQueueLength
perf=_ConfirmsPersec
perf=_DeclinesPersec
perf=_PacketsReceivedPersec
perf=_ReleasesPersec
perf=_RequestsPersec
#---
[checkprint spooler]
requires=1.42
inihelp=<<EOT
Checks various print spooler stats
Tested for Windows Server 2003/2008 R2. Only tested on a low volume server.
This check can return information about multiple printers in a single check.
ARG1 The printer queue name to view stats for. Use _Total for the total stats for all print queues.
Use % for wildcards. The printer queue name can be seen in the Device and Printer screen
eg "Microsoft XPS Document Writer", "%laser%".
EOT
# refer http://msdn.microsoft.com/en-us/library/aa394335%28v=VS.85%29.aspx
query=SELECT * FROM Win32_PerfRawData_Spooler_PrintQueue where Name like "{_arg1}"
# run 2 WMI queries, 5 seconds apart. The delay only applies if using --nokeepstate
samples=2
delay=5
customfield=_BytesPrintedPersec,PERF_COUNTER_COUNTER,BytesPrintedPersec,%.0f
test=_BytesPrintedPersec
test=JobErrors
test=Jobs
test=JobsSpooling
test=NotReadyErrors
test=OutofPaperErrors
test=TotalJobsPrinted
test=TotalPagesPrinted
# will show the overall status
predisplay=_DisplayMsg||Overall Status - |~| -||
display=Name|| Printer Name="|~| ||"
# will show the status of each item returned
display=_DisplayMsg||~|~| - |(|)
display=_BytesPrintedPersec
display=JobErrors
display=Jobs
display=JobsSpooling
display=NotReadyErrors
display=OutofPaperErrors
display=TotalJobsPrinted
display=TotalPagesPrinted
# since this check can return multiple rows at a time (it uses LIKE and % in the WMI query)
# need to include the {Name} so that performance data is unique to each instance
perf=_BytesPrintedPersec||{Name} _BytesPrintedPersec
perf=JobErrors||{Name} JobErrors
perf=Jobs||{Name} Jobs
perf=JobsSpooling||{Name} JobsSpooling
perf=NotReadyErrors||{Name} NotReadyErrors
perf=OutofPaperErrors||{Name} OutofPaperErrors
perf=TotalJobsPrinted||{Name} TotalJobsPrinted
perf=TotalPagesPrinted||{Name} TotalPagesPrinted
#---
[checkprint test]
requires=1.51
inihelp=<<EOT
Demo check for join= and joinquery= settings.
Grabs the same information as checkprinter spooler but adds a couple of extra fields from another WMI Class.
ARG1 The printer queue name to view stats for. Use _Total for the total stats for all print queues.
Use % for wildcards. The printer queue name can be seen in the Device and Printer screen
eg "Microsoft XPS Document Writer", "%laser%".
EOT
# refer http://msdn.microsoft.com/en-us/library/aa394335%28v=VS.85%29.aspx
query=SELECT * FROM Win32_PerfRawData_Spooler_PrintQueue where Name like "{_arg1}"
# run 2 WMI queries, 5 seconds apart. The delay only applies if using --nokeepstate
samples=2
delay=5
#join=ID,INDEX,BASEFIELD,BASEREGEX,BASEREPLACEMENT,EXTRAFIELD,EXTRAREGEX,EXTRAREPLACEMENT,NUMQUERIES,WMINAMESPACE
join=PrintConfig,,Name,,,Name,,,1,
joinquery=Select Name,HorizontalResolution,VerticalResolution,PrintProcessor from Win32_Printer
customfield=_BytesPrintedPersec,PERF_COUNTER_COUNTER,BytesPrintedPersec,%.0f
test=_BytesPrintedPersec
test=JobErrors
test=Jobs
test=JobsSpooling
test=NotReadyErrors
test=OutofPaperErrors
test=TotalJobsPrinted
test=TotalPagesPrinted
# will show the overall status
predisplay=_DisplayMsg||Overall Status - |~| -||
display=Name|| Printer Name="|~| ||"
# will show the status of each item returned
display=_DisplayMsg||~|~| - |(|)
display=HorizontalResolution
display=VerticalResolution
display=PrintProcessor
display=_BytesPrintedPersec
display=JobErrors
display=Jobs
display=JobsSpooling
display=NotReadyErrors
display=OutofPaperErrors
display=TotalJobsPrinted
display=TotalPagesPrinted
# since this check can return multiple rows at a time (it uses LIKE and % in the WMI query)
#perf=_BytesPrintedPersec||{Name} _BytesPrintedPersec
#perf=JobErrors||{Name} JobErrors
#perf=Jobs||{Name} Jobs
#perf=JobsSpooling||{Name} JobsSpooling
#perf=NotReadyErrors||{Name} NotReadyErrors
#perf=OutofPaperErrors||{Name} OutofPaperErrors
#perf=TotalJobsPrinted||{Name} TotalJobsPrinted
#perf=TotalPagesPrinted||{Name} TotalPagesPrinted
#---
[info listsoftware2008]
requires=1.45
inihelp=<<EOT
Lists all the instances of software installed which used an Installer. Used during testing/debuging/helping others.
Gives a lot of output!
Works for XP, Server 2008.
This is probably the best software lister (as it list software at a Product level) if it works for your OS version.
EOT
query=SELECT Caption,Version FROM Win32_Product
# create a list of the software features found
#createlist=_softwarelist|LINEDELIM|FIELDDELIM|UNIQUE|FIELD1,FIELD2,etc
createlist=_softwarelist| |,|0|Caption,Version
display=_ItemCount||Number of Items||~||. Items -
display=_softwarelist||~|~|~||
processallrows=0
# this does the same thing
#predisplay=_ItemCount||Number of Instances||~||. Features -
#display=Caption|||~|||
#display=Version|||~|\n||
#---
[info listsoftwarefeatures2008]
requires=1.45
inihelp=<<EOT
Lists all the instances of software installed. Used during testing/debuging/helping others.
Gives a lot of output!
Works for XP, Server 2008.
This will add a lot of bits that listsoftware2008 will miss.
EOT
query=SELECT ProductName,Version FROM Win32_softwarefeature
# create a list of the software features found
#createlist=_softwarelist|LINEDELIM|FIELDDELIM|UNIQUE|FIELD1,FIELD2,etc
createlist=_softwarelist|\n|,|0|ProductName,Version
display=_ItemCount||Number of Instances||~||. Features -
display=_softwarelist||~|~|~||
processallrows=0
#---
[info listsoftware2003]
requires=1.45
inihelp=<<EOT
Lists all the instances of software installed. Used during testing/debuging/helping others.
Gives a lot of output!
Works for XP, Server 2003 and Server 2008.
You are better off using listsoftware2008 if you can.
EOT
# for 2003 this is the closest we can get at the moment
query=SELECT Name,InstallDate FROM Win32_LogicalProgramGroupItem
# create a list of the software features found
#createlist=_softwarelist|LINEDELIM|FIELDDELIM|UNIQUE|FIELD1,FIELD2,etc
createlist=_softwarelist| |,|0|Name,InstallDate
display=_ItemCount||Number of Items||~||. Items -
display=_softwarelist||~|~|~||
processallrows=0
#predisplay=_ItemCount||Number of Instances||~||. Items -
#display=Name|||~|||
#display=InstallDate|||~| ||
#---
[info os]
requires=1.451
inihelp=<<EOT
This check shows the Operating System Name and Service Pack version.
It also shows the Installation Date timestamp and age in days.
You can check warn/critical against the age of the Installation Date. The warn/critical specification should be in seconds.
Use the time multipliers to make this simpler. See the section "WARNING and CRITICAL Specification".
eg -w 2yr to test if the installation is older than 2 years.
EOT
query=Select Caption,CSDVersion,InstallDate From Win32_OperatingSystem
# this query returns data which contains |
# so we need to specify exactly which fields to look at
# it will output like
# 1 2 3
# Microsoft Windows XP Professional|Service Pack 3|20100528105127.000000+600|Microsoft Windows XP Professional|C:\WINDOWS|\Device\Harddisk0\Partition1
# so we want these fields
dataregex=1,2,3
customfield=_InstallSec,WMITimestampToAgeSec,InstallDate
# have to do this one after _InstallSec has been calculated
customfield=_InstallDays,SectoDay,_InstallSec,%.1f
test=_InstallSec
# the first display field is the standard one we use for the core plugin checks. It includes the status of the check and what triggered a warning/critical state (if any)
display=_DisplayMsg||~|~| - ||
display=Caption||OS is |~|||
display=CSDVersion||~|~|||
display=InstallDate||Installation Timestamp|| ||
display=_InstallDays||~|~|~|(| days old)
perf=_InstallDays|days|OS Installation Age
# these are variable substitutions that are local to this check only - they are added to the global ones, if any
# any defined here the same as global static variables will over ride the global ones
# define static variable substitutions in one of the following formats
# VARIABLE,VALUE,REVERSEFIELD,FORWARDFIELD
# VARIABLE,VALUE,REVERSEFIELD
# VARIABLE,VALUE
# where
# VARIABLE is the name of the variable that should be substituted for the VALUE (reverse)
# VALUE is the value that should be substituted for VARIABLE (forward)
# REVERSEFIELD is a regular expression that defines the display fields that reverse mapping will be applied to. _DISABLED effectively disables reverse lookups since it will never match anything
# FORWARDFIELD is a regular expression that defines the display fields that forward mapping will be applied to. _DISABLED effectively disables reverse lookups since it will never match anything
# examples only
# limited to the Caption field for reverse lookups
static=XP,Microsoft Windows XP Professional,Caption
static=with SP3,Service Pack 3
static=HighEndVersion,Professional,_DISABLED
#---
[info net]
# not sure if this is useful
requires=1.451
inihelp=<<EOT
This check shows basic networking information (sometimes includes duplicate information).
Looks OK in Nagios with multi-line plugin output and not so good on the command line!
EOT
query=Select DNSDomain,DNSHostName,IPAddress,IPSubnet,MACAddress,Description from Win32_NetworkAdapterConfiguration where MACAddress Like "%:%:%:%:%:%"
#createlist=NEWFIELDNAME|LINEDELIM|FIELDDELIM|UNIQUE|FIELD1,FIELD2,etc
createlist=_NetInfo|\n|, |1|DNSHostName,DNSDomain,IPAddress,IPSubnet,MACAddress,Description
predisplay=_DisplayMsg||~|~||| - Network information shown is DNSHostName,DNSDomain,IPAddress,IPSubnet,MACAddress,Description - may include Null data (results shown on next line)\n
display=_NetInfo||~|~|~||
#display=DNSHostName||~|~|, ||
#display=DNSDomain||~|~|, ||
#display=IPAddress||~|~|, ||
#display=IPSubnet||~|~|, ||
#display=MACAddress||~|~|, ||
#display=Description||~|~|, ||\n
processallrows=0
#---
[info cpu]
# not sure if this is useful
requires=1.451
inihelp=<<EOT
This check shows basic cpu information.
EOT
query=select DeviceID,Name,NumberOfCores from Win32_Processor
predisplay=_DisplayMsg||~|~||| - CPU Information for {_ItemCount} CPUs (results shown on next line)\n
display=DeviceID||~|~|, ||
display=Name||~|~|, ||
display=NumberofCores||~|~|, ||\n
#---
[checkusers count]
requires=1.451
inihelp=<<EOT
Check the count of users. You can specify the attributes of the users using ARG1.
ARG1 You must specify everything that follows the "where" clause in the WMI query. You can use any combination of valid WMI fields for the Win32_UserAccount class. Use ' ' to quote strings.
Note: Use --nodatamode and/or NODATAEXIT settings to control what happens if no matching users are found.
Valid WMI Fields for Server 2003 R2/2008 R2 AccountType, Caption, Description, Disabled, Domain, FullName, InstallDate, LocalAccount, Lockout, Name, PasswordChangeable, PasswordExpires, PasswordRequired, SID, SIDType, Status
ARG1 Example List all users: -a "status like '%'"
ARG1 Example Show users where the Status is OK: -a "status='OK'"
ARG1 Example Show usernames that contains the string "EX": -a "name like '%EX%'"
ARG1 Example Show usernames that start with the string "Admin": -a "name like 'Admin%'"
ARG1 Example Show usernames that end with the string "test": -a "name like '%test'"
ARG1 Example Show users whose full name contains the String "Exchange": -a "fullname like '%Exchange%'"
ARG1 Example Show users that belong to the Domain called "TEST": -a "Domain='TEST'"
ARG1 Example Show users where a password is not required: -a "PasswordRequired!='True'"
ARG1 Example Show users that belong to the Domain called "TEST" and that where a password is not required: -a "PasswordRequired!='True' AND Domain='TEST'"
ARG1 Example Show users that do not belong to the Domain called "TEST": -a "Domain!='TEST'"
ARG1 Example Show users that have local accounts: -a "LocalAccount='True'"
EOT
# must use ARG1 to complete the Query otherwise it will fail
query=Select * from Win32_UserAccount Where {_arg1}
#createlist=NEWFIELDNAME|LINEDELIM|FIELDDELIM|UNIQUE|FIELD1,FIELD2,etc
createlist=_UserInfo|), |(|1|Name,FullName
test=_ItemCount
predisplay=_DisplayMsg||~|~| - ||
predisplay=_ItemCount||Number of Users|||| - User information shown on next line is: Name(FullName) \n
display=_UserInfo||~|~|~||)
perf=_ItemCount||Number of Users
processallrows=0
#---
[checkpower state]
requires=1.451
inihelp=<<EOT
This check shows the state of one or more power supplies. Only appears to work on Server 2008. Not tested on physical hardware. It would be really helpful of someone using this on physical hardware can send me the output of this check adding the -d option to the command line.
ARG1 The power supply number to view stats for. Power supplies start at 0.
Use % for wildcards. Use only a single % to include stats for all power supplies.
EOT
query=SELECT * FROM Win32_PowerSupply where DeviceID LIKE "Power Supply {_arg1}"
namespace=root/cimv2/power
customfield=_InstallSec,WMITimestampToAgeSec,InstallDate
# this check could benefit from being able to specify strings as warn/crit criteria
test=ActiveInputVoltage
test=TotalOutputPower
test=TotalPowerOnHours
predisplay=_DisplayMsg||Overall Status - |~| - ||
# will show the status of each item returned
#FIELD|UNITS|DISPLAY|SEP|DELIM|START|END
display=DeviceID||~|~|~||
display=_DisplayMsg||~|~| - |(|)
display=ActiveInputVoltage
display=DetailedStatus
display=HealthState
display=IsACInput
display=IsSwitchingSupply
display=OperatingStatus
display=OperationalStatus
display=PrimaryStatus
display=Status
display=TotalOutputPower
display=TotalPowerOnHours
perf=ActiveInputVoltage
perf=TotalOutputPower
perf=TotalPowerOnHours
#---
[checkad replication]
requires=1.461
inihelp=<<EOT
Check the full replication of an Active Directory. Tested with AD v2003. Shows the number of failed replicas.
Note: Use --nodatamode and/or NODATAEXIT settings to control what happens if no failed replicas are found.
Developed and tested by Patrick Fratczak. Typically run with -c 0, to go critical when any failed replicas are found.
EOT
namespace=Root/MicrosoftActiveDirectory
query=select * from MSAD_NamingContext WHERE IsFullReplica<>'True'
createlist=_ReplicaInfo|), |(|1|DistinguishedName,IsFullReplica
test=_ItemCount
predisplay=_DisplayMsg||~|~| - ||
predisplay=_ItemCount||Full Replication at False|||| - Replication Statuses : if False, info on next line is : DistinguishedName(IsFullReplica) \n
display=_ReplicaInfo||~|~|~||
perf=_ItemCount||Number of Failed Replicas
processallrows=0
#---
[checkdtc]
requires=1.41
inihelp=<<EOT
Check some counters for the Microsoft Distributed Transaction Coordinator.
EOT
query=select * from Win32_PerfRawData_MSDTC_DistributedTransactionCoordinator
test=AbortedTransactions
test=AbortedTransactionsPersec
test=ActiveTransactions
test=ActiveTransactionsMaximum
test=CommittedTransactions
test=CommittedTransactionsPersec
test=InDoubtTransactions
test=ResponseTimeAverage
test=ResponseTimeMaximum
test=ResponseTimeMinimum
test=TransactionsPersec
display=_DisplayMsg||~|~| - ||
display=AbortedTransactions
display=AbortedTransactionsPersec
display=ActiveTransactions
display=ActiveTransactionsMaximum
display=CommittedTransactions
display=CommittedTransactionsPersec
display=InDoubtTransactions
display=ResponseTimeAverage
display=ResponseTimeMaximum
display=ResponseTimeMinimum
display=TransactionsPersec
perf=AbortedTransactions
perf=AbortedTransactionsPersec
perf=ActiveTransactions
perf=ActiveTransactionsMaximum
perf=CommittedTransactions
perf=CommittedTransactionsPersec
perf=InDoubtTransactions
perf=ResponseTimeAverage
perf=ResponseTimeMaximum
perf=ResponseTimeMinimum
perf=TransactionsPersec