WMI Wizard on nagios XI 5.5.4 Evaluation

[cafetechla]

Something is amiss with your WMI wizard on my Nagios XI 5.5.4 evaluation system. Here is the system profile:

Nagios XI - System Info
System
Nagios XI version: 5.5.4
XI installed from: ova
XI UUID: 253b6d86-f838-4c7c-b27a-9935baf815de
Release info: NagiosXI.cafetechla.local 3.10.0-862.11.6.el7.x86_64 x86_64
CentOS Linux release 7.5.1804 (Core)

==========================================================
WMI Error Output:

UNKNOWN - The WMI query had problems. You might have your username/password wrong or the user's access level is too low. Your Authentication File might be incorrectly formatted or inaccessible. Wmic error text on the next line.

Password for [WORKGROUP\Admin]:[librpc/rpc/dcerpc_util.cdcerpc_pipe_auth_recv()] Failed to bind to uuid (redacted) - NT_STATUS_NET_WRITE_FAULT

[librpc/rpc/dcerpc_connect.c:790:dcerpc_pipe_connect_b_recv()] failed NT status (c0000022) in dcerpc_pipe_connect_b_recv

[wmi/wmic.c:196:main()] ERROR: Login to remote object.

NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied
=================================================================

I get this same output error whether I input the User Name and Password in the wizard, or I use an authorization file containing the user name and password. I have been thru your WMI Monitoring documentation in great detail and followed it to a tee. The account in question is a local account, Local Admin rights, etc on the target machine. That's not the problem.

As I see it, something in your script is appending "WORKGROUP" in front of the user name which is causing the problem. If I format the user name for a domain account such as "domain/user" or "domain//user" of "pcname/user" the output error is always the same referencing WORKGROUP\user. This should not be happening, and I cannot find a way to stop your wizard from appending WORKGROUP in front of the user name.

I find it quite curious that I can monitor the same device using the free version of Nagios Core and WMI with no problem, but with the paid for version of Nagios XI (and not cheap either) WMI monitoring isn't made easier of better, but rather worse.

Somebody needs to look into this and solve this. Why would I sell this system into a customer environment when it doesn't work out of the box as advertised? Customers who pay do not want to have to go into the backend system and do the development work that they thought they were paying for by buying from the developers.

Charles ‘Duke’ Fleming
President
https://www.cafetech-la.com
State of CA DVBE Certification: 1733100
CVE Certified Service Disabled Veteran Owned Business
DUNS: 036804879
Cage # 78LX9

[npolovenko]

Hello, @cafetechla. I apologize for the inconvenience. I will be glad to work with you on this issue so that we can make appropriate changes.

To start, what version of the WMI wizard do you have installed on your XI? Please go to the Admin menu, then manage Config Wizards in the left column and in the list of wizards find the "Windows WMI" and tell me the version number.

Please finish the WMI wizard configuration and then click on one of the generated services in Core Configurations Manager and send me a screenshot of the command and arguments(You may send it to me in a personal message if you'd like).

Also, please run the same query that worked for you with the Nagios Core from the XI servers command line and let me know of the output.
Thank you

[cafetechla]

Hello

WMI Wizard version is 2.1.0. I ran the "Check for Updates" from Admin page for Wizrd Management, and it returned a message that all wizards are at the latest available version.

I have attached the host.cfg file, services.cfg file, and password.cfg file that were used and generated when running the WMI wizard. The output is the same, injecting WORKGROUP into the script in front of the defined user.

Pls advise.

I will attach screenshots in a subsequent reply as the system only is allowing 3 attachments per message.

[cafetechla]

Screen shots attached.

[cafetechla]

I have attached the CFG files that I am using on Nagios Core 4.3.4 to access the same machine, and getting the proper output and service checking.

[npolovenko]

@cafetechla, Thanks for the detailed info. Can you try changing the authentication file to look like this and let me know if the output looks any different?

username=bak_svc
password=(password redacted)
domain=chivaroli

[cafetechla]

nope. sorry. that did not solve the problem.

[npolovenko]

@cafetechla, Please run the following command from the NagiosXI server:

/usr/local/nagios/libexec/check_wmi_plus.pl -H 192.168.0.12 -u bak_svc/chivaroli -p password redacted -m checkdrivesize -w '80' -c '95'

*Please replace the "password redacted" with the actual password, and show me the putput of the command.

[cafetechla]

UNKNOWN - The WMI query had problems. You might have your username/password wrong or the user's access level is too low. Wmic error text on the next line.
[librpc/rpc/dcerpc_util.cdcerpc_pipe_auth_recv()] Failed to bind to uuid 4d9f4ab8-7d1c-11cf-861e-0020af6e7c57 - NT_STATUS_NET_WRITE_FAULT
[librpc/rpc/dcerpc_connect.c:790:dcerpc_pipe_connect_b_recv()] failed NT status (c0000022) in dcerpc_pipe_connect_b_recv
[wmi/wmic.c:196:main()] ERROR: Login to remote object.
NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied

[scottwilkerson]

Have you given this user all the permissions required based on this document, specifically starting on page 4?
https://assets.nagios.com/downloads/nag ... ios-XI.pdf