check_wmi_plus checksmart fails when other checks OK

[Chris Hardick]

Hi

I am running Nagios XI 5.6.2, using the check_wmi_plus plugin (v1.6) to interrogate a Windows 10 PC
We have set up a minimal permission account on the Windows PC for the remote monitoring.
Most service checks set up are working perfectly, but the checksmart fails, configuration is simply:

-m checksmart

warning is:
The WMI query had problems. The error text from wmic is: [wmi/wmic.c212:main()] error: retrieve result data

I have checked the query using the -d option and run it from the XI command line with the same results.

I have logged into the target machine as the minimal user account and using WMI Explorer 2.0.0.2 entered the queries for both checkcpu and checksmart.
checkcpu accesses root/cimv2 and is successful.
checksmart accesses root/wmi and fails with "error running query against ROOT\WMI namespace. Access denied.
I have rechecked the WMI permissions for the minimal user account, the same permissions are present for both namespaces: "Enable account" and "remote enable"

Any ideas on what the problem is?

Thanks for your help

[ssax]

Please run the command like this and send us the full output:

Code: Select all

/usr/local/nagios/libexec/check_wmi_plus.pl -H 192.168.X.X -u 'user' -p 'XXXXX' -m checksmart -d -d -d

[Chris Hardick]

Hi

here is the output

checksmartoutput.txt

Thanks

[tgriep]

I ran the plugin (Version 1.64) against a Windows 7 system and it did return valid data.
I did not use a minimal account so can you setup the account to have full access to the system?
Also, try upgrading to the newer copy of the plugin which you can get here.
http://edcint.co.nz/checkwmiplus/?q=downloads

[Chris Hardick]

Thanks for getting back to me.

Unfortunately I cannot extend the rights for this account to be full access - the nature of the system in which its going to be used requires a minimal account

It does seem strange that the latest XI release does not come with the latest version of its plugins - I only downloaded the XI VM a few weeks ago.
I have looked for instructions on how to update the plugin, but I haven't found anything yet - can you provide a link please?

Thanks for your help

[tgriep]

To upgrade the plugin, download the tar.gz file and extract just the plugin check_wmi_plus.pl

Edit the plugin and change a few options from

Code: Select all

my $conf_file='/etc/check_wmi_plus/check_wmi_plus.conf';
use lib "/usr/lib/nagios/plugins";
use lib "/usr/lib64/nagios/plugins"; 

to

Code: Select all

my $conf_file='/usr/local/nagios/libexec/check_wmi_plus.conf';
#use lib "/usr/lib/nagios/plugins";
#use lib "/usr/lib64/nagios/plugins"; 
use lib "/usr/local/nagios/libexec";

Save the changes and upload it to the Nagios server by logging in to the GUI and go to the Admin > Manage Plugins menu.
Browse to it and upload it to the server.

Upgrading the plugin may not fix the issue as it is a permission issue with remote WMI access.

[Chris Hardick]

Thanks for the information on how to update the plugin.

I have made progress on the checksmart issue. I read here:

https://docs.microsoft.com/en-us/window ... ol-and-wmi

that the first time wmic is run after install, it needs an elevated command prompt, so i tried adding the minimal access user to the Administrator group - as expected the command now ran successfully. I then removed the minimal access account from the Administrators group and the command continued to work. Im not sure why this works as its not quite the same scenario as the MS doc, but it seems to have solved the problem.
I will check later to see if it it continuing to work.

[tgriep]

Thanks for reporting back what was done to get the plugin to work.

[Chris Hardick]

Hi

I have found that after a reboot of the monitored PC, the checksmart check fails with the same permission error. If I temporarily add the minimal user to the Administrators group, run teh check successfully, and then remove it, the checks continue to work - this process needs to be repeated after every reboot of the monitored PC.
Im still hoping for a permanent solution that does not require the minimal WMI monitoring user to be a member of the Administrators group, but it looks like this could be a Windows bug?

Thanks

[tgriep]

Microsoft has been locking down their operating system and remote WMI is one of the things they have been restricting.