WMI Error

[SETR]

What version of Nagios XI are you using? 5.4.1
VMware Image or Manual Install of XI? VMware image
Windows version: 2008 R2, 2012, 2003
user account: Local Admin account
Error:
The wizard detected that the WMI plugin returned an unsuccessful output code. This will prevent the automatic scan of services and processes and prevent services from running successfully. Below is the given error output:

WMI Error Output:

UNKNOWN - The WMI query had problems. You might have your username/password wrong or the user's access level is too low. Wmic error text on the next line.

[wmi/wmic.c:196:main()] ERROR: Login to remote object.

NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied

using the same credentials and WMI protocol, we are able to connect to our windows servers through third party software such as PRTG/Solarwinds. But with Nagios, we are getting the above error. Tried removing special characters from the password with no luck.

Any help in resolving this issue is really appreciated.

[dwhitfield]

Are you specifying a domain when querying WMI? If so, use domain "/" not domain "\".

Aside from that, have you taken a look at https://assets.nagios.com/downloads/nag ... ios-XI.pdf ?

Also, have you set up a 1-hour quickstart session? https://www.nagios.com/services/quickstart/

[SETR]

Are you specifying a domain when querying WMI? If so, use domain "/" not domain "\". --No, I am not using domain. However, I tried using domain name as you suggested with no luck

Aside from that, have you taken a look at https://assets.nagios.com/downloads/nag ... ios-XI.pdf ? Yes, I followed the steps with no luck

Also, have you set up a 1-hour quickstart session? https://www.nagios.com/services/quickstart/

-- Yes, I have scheduled it for this Thursday

[SETR]

Are you specifying a domain when querying WMI? If so, use domain "/" not domain "\". ---> No, However, I did try using domain with no luck

Aside from that, have you taken a look at https://assets.nagios.com/downloads/nag ... ios-XI.pdf ? Yes, I followed the document with no luck

Also, have you set up a 1-hour quickstart session? https://www.nagios.com/services/quickstart/, Yes, I have one setup for this coming Thursday

[dwhitfield]

Can you show us the actual command that you are running from the command line along with the output of it? Hide/obfuscate sensitive data.

Also, are you getting the same error on all three versions of Windows?

The setup is a little different on 2012. You'll want to take a look at http://www.edcint.co.nz/checkwmiplus/node/60 for 2012.

[SETR]

I did not run anything through command line, I was just using the WMI wizard to add a windows VM.

Yes, we are having this issue with all versions of Windows. What I don't understand is that I am able to connect to the same machines using spiceworks and PRTG without any issue.

[dwhitfield]

We need you to run the command from the command line so we can see the command line output. More detail at https://support.nagios.com/kb/article.php?id=167

That will help us determine your authentication issue.

[SETR]

Is this the command I should be using? If so, what values should I be using for mode(-m)?


/usr/local/nagios/libexec/check_wmi_plus.pl -H $HOSTADDRESS$ -u $ARG1$ -p $ARG2$ -m $ARG3$ $ARG4$

[dwhitfield]

Replace those ARGS and HOSTADDRESS with the actual username, password, etc.

Also, can you send a screenshot of how you have it set up in XI? Scrub as necessary.

[SETR]

nagiosxi.ams.com>>/root>>/usr/local/nagios/libexec/check_wmi_plus.pl -H 162.70.xxx.xx -u admin -p password -m checkeventlog -a system -o 2 -3 4 -w 4 -c 6
UNKNOWN - The WMI query had problems. You might have your username/password wrong or the user's access level is too low. Wmic error text on the next line.
[wmi/wmic.c:196:main()] ERROR: Login to remote object.
NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied
nagiosxi.ams.com>>/root>>/usr/local/nagios/libexec/check_wmi_plus.pl -H 162.70.xxx.xx -u admin -p password -m checkeventlog -a system -o 2 -3 4 -w 4 -c 6
UNKNOWN - The WMI query had problems. You might have your username/password wrong or the user's access level is too low. Wmic error text on the next line.
[librpc/rpc/dcerpc_util.cdcerpc_pipe_auth_recv()] Failed to bind to uuid 4d9f4ab8-7d1c-11cf-861e-0020af6e7c57 - NT_STATUS_NET_WRITE_FAULT
[librpc/rpc/dcerpc_connect.c:790:dcerpc_pipe_connect_b_recv()] failed NT status (c0000022) in dcerpc_pipe_connect_b_recv
[wmi/wmic.c:196:main()] ERROR: Login to remote object.
NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied