This plugin requires the linux implementation of wmic eg fro

[bosecorp]

what ports should be open?

I have open ports 135 and http

Yes, I can ping it

root@gearmandce1:(03-30 11:05): /usr/local/nagios/libexec
# /usr/local/nagios/libexec/check_wmi_plus.pl -H usmadcops01.bose.com -u 'us_nt_bose\svcnagios' -p 'mypassword' -m checkcpu -w '80' -c '90'
UNKNOWN - Plugin Timed out (15 sec). There are multiple possible reasons for this, some of them include - The host usmadcops01.bose.com might just be really busy, it might not even be running Windows.

[jdalrymple]

root@gearmandcn1:(03-27 11:58): /root
# telnet usmadcops01.bose.com 135
Trying 10.100.21.134...
Connected to usmadcops01.bose.com.
Escape character is '^]'.

This is good for gearmandcn1 - it can connect to the WMI listener and that's great.

root@gearmandce1:(03-30 11:05): /usr/local/nagios/libexec
# /usr/local/nagios/libexec/check_wmi_plus.pl -H usmadcops01.bose.com -u 'us_nt_bose\svcnagios' -p 'mypassword' -m checkcpu -w '80' -c '90'
UNKNOWN - Plugin Timed out (15 sec). There are multiple possible reasons for this, some of them include - The host usmadcops01.bose.com might just be really busy, it might not even be running Windows.

This attempt was done from gearmandce1. We need to focus on 1 server at a time otherwise there is no possibility that we can help. We simply don't understand enough about your environment. With that said, which server should we troubleshoot first? gearmandcn1 or gearmandce1?

If gearmandce1, we need to see the output of

Code: Select all

telnet usmadcops01.bose.com 135

The firewall ports AND PROCESSES needing exceptions can be found in this document:

http://assets.nagios.com/downloads/nagi ... ios-XI.pdf

[bosecorp]

can can start with gearmandce1

so firewall is fine



# telnet usmadcops01.bose.com 135
Trying 10.100.21.134...
Connected to usmadcops01.bose.com.
Escape character is '^]'.

[jdalrymple]

Try running wmic with debugging:

Code: Select all

/usr/local/bin/wmic --debug-level=1 --debug-stderr -U us_nt_bose\svcnagios%mypassword //usmadcops01.bose.com "Select FreePhysicalMemory from Win32_OperatingSystem"

[bosecorp]

I get this

Usage: [-?NPV] [-?|--help] [--usage] [-d|--debuglevel DEBUGLEVEL] [--debug-stderr] [-s|--configfile CONFIGFILE] [--option=name=value] [-l|--log-basename LOGFILEBASE] [--leak-report]
[--leak-report-full] [-R|--name-resolve NAME-RESOLVE-ORDER] [-O|--socket-options SOCKETOPTIONS] [-n|--netbiosname NETBIOSNAME] [-W|--workgroup WORKGROUP] [--realm=REALM]
[-i|--scope SCOPE] [-m|--maxprotocol MAXPROTOCOL] [-U|--user [DOMAIN\]USERNAME[%PASSWORD]] [-N|--no-pass] [--password=STRING] [-A|--authentication-file FILE]
[-S|--signing on|off|required] [-P|--machine-pass] [--simple-bind-dn=STRING] [-k|--kerberos STRING] [--use-security-mechanisms=STRING] [-V|--version] [--namespace=STRING]
[--delimiter=STRING] //host query

something in the parameters is not right

[tgriep]

There was an extra - in the debuglevel argument.
Try this

Code: Select all

/usr/local/bin/wmic --debuglevel=1 --debug-stderr -U us_nt_bose\svcnagios%mypassword //usmadcops01.bose.com "Select FreePhysicalMemory from Win32_OperatingSystem"

[bosecorp]

# /usr/bin/wmic --debuglevel=1 --debug-stderr -U us_nt_bose\svcnagios%mypasswordblablabla //usmadcops01.bose.com "Select FreePhysicalMemory from Win32_OperatingSystem"
[auth/kerberos/kerberos_util.c:236:kinit_to_ccache()] kinit for us_nt_bosesvcnagios@ failed (Cannot contact any KDC for requested realm: unable to reach any KDC in realm )
[auth/credentials/credentials_krb5.c:300:cli_credentials_get_client_gss_creds()] Failed to get CCACHE for GSSAPI client: Cannot contact any KDC for requested realm
[librpc/rpc/dcerpc_util.cdcerpc_pipe_auth_recv()] Failed to bind to uuid 4d9f4ab8-7d1c-11cf-861e-0020af6e7c57 - NT_STATUS_NET_WRITE_FAULT
[librpc/rpc/dcerpc_connect.c:790:dcerpc_pipe_connect_b_recv()] failed NT status (c0000022) in dcerpc_pipe_connect_b_recv
[wmi/wmic.c:196:main()] ERROR: Login to remote object.
NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied

[tgriep]

Are you using Active Directory or LDAP for authentication?
It looks like the gearman worker server cannot verify the Authentication Credentials you are using.
Can you check to see if the worker system can access your domain controller or LDAP server?

[bosecorp]

Yes, I am

how do I verify that?

from the JOB server works fine

[tgriep]

From your worker server and the Nagios XI server, try running the following to see if they can access the ports on the Domain Controller.
Post the output from both systems.

Code: Select all

nmap <IPoftheDomainController>