WMI ERROR

[thrivikramr]

Hi,

I have added a Windows 2008 R2 servers to Nagios monitoring using WMI. I am getting error output on all services.

OUTPUT: UNKNOWN - The WMI query had problems. The error text from wmic is: [librpc/rpc/dcerpc_connect.c:329:dcerpc_pipe_connect_ncacn_ip_tcp_recv()] failed NT status (c0000236) in dcerpc_pipe_connect_ncacn_ip_tcp_recv
[librpc/rpc/dcerpc_connect.c:790:dcerpc_pipe_connect_b_recv()] failed NT status (c0000236) in dcerpc_pipe_connect_b_recv
[librpc/rpc/dcerpc_connect.c:329:dcerpc_pipe_connect_ncacn_ip_tcp_recv()] failed NT status (c0000236) in dcerpc_pipe_connect_ncacn_ip_tcp_recv
[librpc/rpc/dcerpc_connect.c:790:dcerpc_pipe_connect_b_recv()] failed NT status (c0000236) in dcerpc_pipe_connect_b_recv
[wmi/wmic.c:196:main()] ERROR: Login to remote object.
NTSTATUS: NT code 0xc002001b - NT code 0xc002001b

Note - I have used domain/username while adding it to Nagios.

I used WBEMtest and connected to remote system using the same credentials that I am configured on Nagios and I am able to get query results.

Nagios XI version - 5.2.7 hosted on CentOS

[mcapra]

Does the password used for this domain account contain any special characters such as $ ! # etc?

Can you try running the check command from the CLI of your Nagios XI machine and share the debug output? The command might look something like this:

Code: Select all

/usr/local/nagios/libexec/check_wmi_plus.pl -H HOSTNAME -u DOMAIN/USER -p PASSWORD -m checkcpu -w '80' -c '90' -d

[thrivikramr]

Code: Select all

OUTPUT:
/usr/local/nagios/libexec/check_wmi_plus.pl -H system.domain.com -u 'domain/ar_user' -p 'Passwrd123' -m checkdrivesize -a 'C': -w '80' -c '95' -d
Command Line (v1.6): /usr/local/nagios/libexec/check_wmi_plus.pl -H system.domain.com -u USER -p PASS -m checkdrivesize -a C: -w 80 -c 95 -d
Base Dir: /usr/local/nagios/libexec
Conf File Dir: /usr/local/nagios/libexec
Loaded Conf File /usr/local/nagios/libexec/check_wmi_plus.conf
Round #1 of 1
QUERY: /usr/bin/wmic '-U' 'USER%PASS' '--namespace' 'root/cimv2' '//system.domain.com' 'Select DeviceID,freespace,Size,VolumeName from Win32_LogicalDisk where DriveType=3'
OUTPUT: [librpc/rpc/dcerpc_connect.c:329:dcerpc_pipe_connect_ncacn_ip_tcp_recv()] failed NT status (c0000236) in dcerpc_pipe_connect_ncacn_ip_tcp_recv
[librpc/rpc/dcerpc_connect.c:790:dcerpc_pipe_connect_b_recv()] failed NT status (c0000236) in dcerpc_pipe_connect_b_recv
[librpc/rpc/dcerpc_connect.c:329:dcerpc_pipe_connect_ncacn_ip_tcp_recv()] failed NT status (c0000236) in dcerpc_pipe_connect_ncacn_ip_tcp_recv
[librpc/rpc/dcerpc_connect.c:790:dcerpc_pipe_connect_b_recv()] failed NT status (c0000236) in dcerpc_pipe_connect_b_recv
[wmi/wmic.c:196:main()] ERROR: Login to remote object.
NTSTATUS: NT code 0xc002001b - NT code 0xc002001b

Could not find the CLASS: line - an error occurred
WMI DATA:$VAR1 = [
          [
            {
              '_ColSum_Size' => 0,
              '_QuerySum_Size' => 0,
              '_ColSum_FreeSpace' => 0,
              '_QuerySum_FreeSpace' => 0
            }
          ]
        ];
UNKNOWN - The WMI query had problems. The error text from wmic is: [librpc/rpc/dcerpc_connect.c:329:dcerpc_pipe_connect_ncacn_ip_tcp_recv()] failed NT status (c0000236) in dcerpc_pipe_connect_ncacn_ip_tcp_recv
[librpc/rpc/dcerpc_connect.c:790:dcerpc_pipe_connect_b_recv()] failed NT status (c0000236) in dcerpc_pipe_connect_b_recv
[librpc/rpc/dcerpc_connect.c:329:dcerpc_pipe_connect_ncacn_ip_tcp_recv()] failed NT status (c0000236) in dcerpc_pipe_connect_ncacn_ip_tcp_recv
[librpc/rpc/dcerpc_connect.c:790:dcerpc_pipe_connect_b_recv()] failed NT status (c0000236) in dcerpc_pipe_connect_b_recv
[wmi/wmic.c:196:main()] ERROR: Login to remote object.
NTSTATUS: NT code 0xc002001b - NT code 0xc002001b

[Mike S]

I have this error too. I run the trial VM for Hyper-V, and use the same account that works with my OP5 WMI-checks. (tried other account as well)

/Mike

[mcapra]

@thrivikramr, have you tested this command using the local Windows administrator account's credentials? If the administrator account works, that would help narrow down the list of possible causes.