MS IIS Application Pool

[jkinning]

I thought I had everything in place and working from this thread:

Code: Select all

https://support.nagios.com/forum/viewtopic.php?f=16&t=38662#p184527

Today I am getting a message back which triggered a critical alert and thus a response but when checked everything was working correctly. Here is the message -

Code: Select all

Application Pool "EasServices" not found in WMI

[tgriep]

Is there any errors in the nsclient.log file on the windows system?
Have you tried to restart the NSClient++ service to see if that fixes the issue?

[jkinning]

2016-06-02 08:51:50: error:D:\source\nscp\service\NSClient++.cpp:893: Unknown command(s): check_ms_iis_application_pool available commands: commands {, alias_cpu, alias_cpu_ex, alias_disk, alias_disk_loose, alias_event_log, alias_file_age, alias_file_size, alias_mem, alias_process, alias_process_count, alias_process_hung, alias_process_stopped, alias_sched_all, alias_sched_long, alias_sched_task, alias_service, alias_service_ex, alias_up, alias_volumes, alias_volumes_loose, check_always_critical, check_always_ok, check_always_warning, check_counter, check_cpu, check_critical, check_drivesize, check_eventlog, check_files, check_memory, check_multi, check_negate, check_nscp, check_ok, check_os_version, check_pagefile, check_pdh, check_process, check_service, check_timeout, check_uptime, check_version, check_warning, checkalwayscritical, checkalwaysok, checkalwayswarning, checkcounter, checkcpu, checkcritical, checkdrivesize, checkeventlog, checkfiles, checkmem, checkmultiple, checkok, checkprocstate, checkservicestate, checkuptime, checkversion, checkwarning, filter_perf, negate, render_perf, timeout, xform_perf}, plugins {, 0, 1, 2, 3, 4, 5}
2016-06-02 08:51:50: error:D:\source\nscp\include\nscapi\nscapi_core_wrapper.cpp:159: Failed to execute command
2016-06-02 08:51:50: error:D:\source\nscp\include\nscapi\nscapi_core_helper.cpp:95: Failed to execute command: check_ms_iis_application_pool
2016-06-02 08:52:48: error:D:\source\nscp\service\NSClient++.cpp:893: Unknown command(s): check_ms_iis_application_pool available commands: commands {, alias_cpu, alias_cpu_ex, alias_disk, alias_disk_loose, alias_event_log, alias_file_age, alias_file_size, alias_mem, alias_process, alias_process_count, alias_process_hung, alias_process_stopped, alias_sched_all, alias_sched_long, alias_sched_task, alias_service, alias_service_ex, alias_up, alias_volumes, alias_volumes_loose, check_always_critical, check_always_ok, check_always_warning, check_counter, check_cpu, check_critical, check_drivesize, check_eventlog, check_files, check_memory, check_multi, check_negate, check_nscp, check_ok, check_os_version, check_pagefile, check_pdh, check_process, check_service, check_timeout, check_uptime, check_version, check_warning, checkalwayscritical, checkalwaysok, checkalwayswarning, checkcounter, checkcpu, checkcritical, checkdrivesize, checkeventlog, checkfiles, checkmem, checkmultiple, checkok, checkprocstate, checkservicestate, checkuptime, checkversion, checkwarning, filter_perf, negate, render_perf, timeout, xform_perf}, plugins {, 0, 1, 2, 3, 4, 5}
2016-06-02 08:52:48: error:D:\source\nscp\include\nscapi\nscapi_core_wrapper.cpp:159: Failed to execute command
2016-06-02 08:52:48: error:D:\source\nscp\include\nscapi\nscapi_core_helper.cpp:95: Failed to execute command: check_ms_iis_application_pool
2016-06-02 08:53:45: error:D:\source\nscp\service\NSClient++.cpp:893: Unknown command(s): check_ms_iis_application_pool available commands: commands {, alias_cpu, alias_cpu_ex, alias_disk, alias_disk_loose, alias_event_log, alias_file_age, alias_file_size, alias_mem, alias_process, alias_process_count, alias_process_hung, alias_process_stopped, alias_sched_all, alias_sched_long, alias_sched_task, alias_service, alias_service_ex, alias_up, alias_volumes, alias_volumes_loose, check_always_critical, check_always_ok, check_always_warning, check_counter, check_cpu, check_critical, check_drivesize, check_eventlog, check_files, check_memory, check_multi, check_negate, check_nscp, check_ok, check_os_version, check_pagefile, check_pdh, check_process, check_service, check_timeout, check_uptime, check_version, check_warning, checkalwayscritical, checkalwaysok, checkalwayswarning, checkcounter, checkcpu, checkcritical, checkdrivesize, checkeventlog, checkfiles, checkmem, checkmultiple, checkok, checkprocstate, checkservicestate, checkuptime, checkversion, checkwarning, filter_perf, negate, render_perf, timeout, xform_perf}, plugins {, 0, 1, 2, 3, 4, 5}
2016-06-02 08:53:45: error:D:\source\nscp\include\nscapi\nscapi_core_wrapper.cpp:159: Failed to execute command
2016-06-02 08:53:45: error:D:\source\nscp\include\nscapi\nscapi_core_helper.cpp:95: Failed to execute command: check_ms_iis_application_pool

From the nsclient.log file

[Box293]

Can you please post your nsclient.ini file.

[jkinning]

This worked for a little while. Attaching nsclient.ini file.

[lmiltchev]

Is the "check_ms_iis_application_pool.ps1" script located in the NSClient++ "scripts" directory or in "scripts/powershell"?

In the "nsclient.ini" you have:

Code: Select all

; WRAPPING - An external script wrapping
ps1 = cmd /c echo scripts\\%SCRIPT% %ARGS%; exit($lastexitcode) | powershell.exe -command -

Does it help if you change this line to this:

Code: Select all

ps1 = cmd /c echo If (-Not (Test-Path "scripts\%SCRIPT%") ) { exit(3) }; scripts\\%SCRIPT% %ARGS%; exit($lastexitcode) | powershell.exe -command -

as described in this post?

[jkinning]

Still getting the same message after replacing that line with the new one you mentioned and restarting the NSClient++ service.

Code: Select all

./check_nrpe -H eas3t -t 30 -c check_ms_iis_application_pool -a '-A EasServices'
CRITICAL: Application Pool "EasServices" not found in WMI.

[lmiltchev]

Can you run the PS script locally?

Open the powershell prompt, run:

Code: Select all

cd 'C:\Program Files\NSClient++\scripts\powershell'
./check_ms_iis_application_pool.ps1 '-A EasServices'

and show the output.

[jkinning]

Here is the output. It is bizarre because it appeared to work when I first set it up and then just stopped and started all this.

I also confirmed with the App Teams and nothing has been modified with this server.

[mcapra]

It is bizarre because it appeared to work when I first set it up and then just stopped and started all this.

I also noticed this behavior with this particular script. My process:

1) Create application pool CoolPool
2) Test script, works fine and displays process data
3) Restart machine
4) Test script, returns CRITICAL: Application Pool "CoolPool" not found in WMI.
5) Stop CoolPool
6) Test script, returns CRITICAL: Application Pool "CoolPool" is Stopped.

What appears to be happening is this particular script is failing to access specific process information for the application pool. Why this is happening I cannot say as my knowledge of WMI is limited.

Code: Select all

## ~~(lines 216-240)
If (Get-ChildItem IIS:\AppPools | Where-Object {$_.Name -eq "$($IISStruct.ApplicationPool)"}) {
            $IISStruct.PoolState = Get-ChildItem IIS:\AppPools | Where-Object {$_.Name -eq "$($IISStruct.ApplicationPool)"} | Select-Object State -ExpandProperty State
            If ( $IISStruct.PoolState -eq 'Started') {
                $IISStruct.ProcessId = Get-WmiObject -NameSpace 'root\WebAdministration' -class 'WorkerProcess' | Where-Object {$_.AppPoolName -match $IISStruct.ApplicationPool}  | Select-Object -Expand ProcessId 
                If ( $IISStruct.ProcessId ) {
                    $IISStruct.Process = get-wmiobject Win32_PerfFormattedData_PerfProc_Process | ? { $_.IdProcess -eq $IISStruct.ProcessId } 
                    $IISStruct.CurrentCpu = $IISStruct.Process.PercentProcessorTime
                    Write-Log Verbose Info "Application pool $($IISStruct.ApplicationPool) process id: $($IISStruct.ProcessId) Percent CPU: $($IISStruct.CurrentCpu)"
                    $IISStruct.CurrentMemory = [Math]::Round(($IISStruct.Process.workingSetPrivate / 1MB),2)
                    Write-Log Verbose Info "Application pool $($IISStruct.ApplicationPool) process id: $($IISStruct.ProcessId) Private Memory: $($IISStruct.CurrentMemory)"
                    $Sites = Get-WebConfigurationProperty "/system.applicationHost/sites/site/application[@applicationPool='$($IISStruct.ApplicationPool)' and @path='/']/parent::*" machine/webroot/apphost -name name
                    $Apps = Get-WebConfigurationProperty "/system.applicationHost/sites/site/application[@applicationPool='$($IISStruct.ApplicationPool)' and @path!='/']" machine/webroot/apphost -name path
                    $IISStruct.PoolCount = ($Sites,$Apps | ForEach {$_.value}).count
                    $IISStruct.ExitCode = 0
                    $IISStruct.ReturnString = "OK: Application Pool `"$($IISStruct.ApplicationPool)`" with $($IISStruct.PoolCount) Applications. {CPU: $($IISStruct.CurrentCpu) %}{Memory: $($IISStruct.CurrentMemory) MB}"
                    $IISStruct.ReturnString += " | 'app_count'=$($IISStruct.PoolCount), 'pool_cpu'=$($IISStruct.CurrentCpu)%, 'pool_memory'=$($IISStruct.CurrentMemory)MB"
                }
                Else {
                    Throw "Application Pool `"$($IISStruct.ApplicationPool)`" not found in WMI."
                }
            }
            Else {
                Throw "Application Pool `"$($IISStruct.ApplicationPool)`" is $($IISStruct.PoolState)."       
            }
        }

This might be the sequence where things are getting confused. Specifically If ( $IISStruct.ProcessId ) is what I believe is failing to evaluate to true. I suspect this means the below line is causing $IISStruct.ProcessId to evaluate as null/undefined. In order to get specific process information, this line would need to be revised:

Code: Select all

$IISStruct.ProcessId = Get-WmiObject -NameSpace 'root\WebAdministration' -class 'WorkerProcess' | Where-Object {$_.AppPoolName -match $IISStruct.ApplicationPool}  | Select-Object -Expand ProcessId 

If the process information is not 100% required for your use case, you could try replacing the aforementioned block of code like so:

Code: Select all

If (Get-ChildItem IIS:\AppPools | Where-Object {$_.Name -eq "$($IISStruct.ApplicationPool)"}) {
            $IISStruct.PoolState = Get-ChildItem IIS:\AppPools | Where-Object {$_.Name -eq "$($IISStruct.ApplicationPool)"} | Select-Object State -ExpandProperty State
            If ( $IISStruct.PoolState -eq 'Started') {
				$IISStruct.ReturnString = "OK: Application Pool `"$($IISStruct.ApplicationPool)`" is $($IISStruct.PoolState)."  
            }
            Else {
                Throw "Application Pool `"$($IISStruct.ApplicationPool)`" is $($IISStruct.PoolState)."       
            }
        }