WMI cpu monitoring having issues

[lgaddam]

Can you login to the Windows machine as that user, or become that user on the Windows machine and try to execute the WMI call?

Could you please provide me the command which I have to run locally for WMI call ?

[mbellerue]

Absolutely, I recommend using Powershell for this, and definitely using the credentials that you're providing Nagios with to authenticate with the Windows machine. Start out in a regular cmd window.

Code: Select all

runas /profile /user <yourdomain\nagiosuser> powershell

That should open a Powershell window with the credentials that you provided to Nagios. In the Powershell window, run the following.

Code: Select all

Get-WmiObject -Class win32_PerfRawData_PerfOS_Processor

And if that returns a bunch of data, then try this command as well.

Code: Select all

Get-WmiObject -Class win32_PerfRawData_PerfOS_Processor -ComputerName <IPAddressOfWindowsMachine>

This second command will basically send the process out, and back into the server, very similar to trying it as an external call. These commands should help us identify that the credentials specified are allowed to collect the WMI data, and that they are allowed to connect to the Windows machine to collect the WMI data.

[lgaddam]

Hi,

Powershell is not installed in this 2003 server. I asked respective team they said right now its not possible to install software on this prod machine.
Is there any other way to check this.

Else we will move to other issue having CPU service not working and rest memory & disk services working fine on fewer servers.

[mbellerue]

Okay, so the first set of commands should be the same.

Code: Select all

runas /profile /user <yourdomain\nagiosuser> cmd.exe

Now we should have a cmd window open as the nagios user. You can get into a wmic command prompt just by running the command wmic and /? for help with commands and how to query information.

[lgaddam]

With your command it didnt work, I searched and got how to run command with wmiagent account. I ran as below, just a semicolon need to add between /user and wmi account domain.

runas /profile /user:<yourdomain\nagiosuser> cmd.exe


I was able to do it via cmd.exe with wmi agent configured in Nagios and able to see below output.

C:\WINDOWS\system32>wmic cpu LIST
AddressWidth Architecture Availability Caption Conf
igManagerErrorCode ConfigManagerUserConfig CpuStatus CreationClassName Curre
ntClockSpeed CurrentVoltage DataWidth Description Devic
eID ErrorCleared ErrorDescription ExtClock Family InstallDate L2CacheSize
L2CacheSpeed LastErrorCode Level LoadPercentage Manufacturer MaxClockSpeed
Name OtherFamilyDescription PNPDeviceID PowerMana
gementCapabilities PowerManagementSupported ProcessorId ProcessorType R
evision Role SocketDesignation Status StatusInfo Stepping SystemCreationCl
assName SystemName UniqueId UpgradeMethod Version VoltageCaps
32 0 3 x86 Family 21 Model 1 Stepping 2
1 Win32_Processor 2194
14 32 x86 Family 21 Model 1 Stepping 2 CPU0
200 2
21 1 AuthenticAMD 2194
AMD Opteron(TM) Processor 6274
FALSE 178BFBFF00600F12 3 2
58 CPU None OK 3 2 Win32_ComputerSy
stem SRVLICENCON 6 Modelo 1, nivel 2
32 0 3 x86 Family 21 Model 1 Stepping 2
1 Win32_Processor 2194
14 32 x86 Family 21 Model 1 Stepping 2 CPU1
200 2
21 2 AuthenticAMD 2194
AMD Opteron(TM) Processor 6274
FALSE 178BFBFF00600F12 3 2
58 CPU None OK 3 2 Win32_ComputerSy
stem SRVLICENCON 6 Modelo 1, nivel 2


C:\WINDOWS\system32>
C:\WINDOWS\system32>wmic cpu LIST brief
Caption DeviceID Manufacturer MaxClockSpeed Name
SocketDesignation
x86 Family 21 Model 1 Stepping 2 CPU0 AuthenticAMD 2194 AMD Opt
eron(TM) Processor 6274 None
x86 Family 21 Model 1 Stepping 2 CPU1 AuthenticAMD 2194 AMD Opt
eron(TM) Processor 6274 None


C:\WINDOWS\system32>

C:\WINDOWS\system32>wmic cpu LIST full


AddressWidth=32
Architecture=0
Availability=3
Caption=x86 Family 21 Model 1 Stepping 2
ConfigManagerErrorCode=
ConfigManagerUserConfig=
CpuStatus=1
CreationClassName=Win32_Processor
CurrentClockSpeed=2194
CurrentVoltage=14
DataWidth=32
Description=x86 Family 21 Model 1 Stepping 2
DeviceID=CPU0
ErrorCleared=
ErrorDescription=
ExtClock=200
Family=2
InstallDate=
L2CacheSize=
L2CacheSpeed=
LastErrorCode=
Level=21
LoadPercentage=36
Manufacturer=AuthenticAMD
MaxClockSpeed=2194
Name=AMD Opteron(TM) Processor 6274
OtherFamilyDescription=
PNPDeviceID=
PowerManagementCapabilities=
PowerManagementSupported=FALSE
ProcessorId=178BFBFF00600F12
ProcessorType=3
Revision=258
Role=CPU
SocketDesignation=None
Status=OK
StatusInfo=3
Stepping=2
SystemCreationClassName=Win32_ComputerSystem
SystemName=SRVLICENCON
UniqueId=
UpgradeMethod=6
Version=Modelo 1, nivel 2
VoltageCaps=


AddressWidth=32
Architecture=0
Availability=3
Caption=x86 Family 21 Model 1 Stepping 2
ConfigManagerErrorCode=
ConfigManagerUserConfig=
CpuStatus=1
CreationClassName=Win32_Processor
CurrentClockSpeed=2194
CurrentVoltage=14
DataWidth=32
Description=x86 Family 21 Model 1 Stepping 2
DeviceID=CPU1
ErrorCleared=
ErrorDescription=
ExtClock=200
Family=2
InstallDate=
L2CacheSize=
L2CacheSpeed=
LastErrorCode=
Level=21
LoadPercentage=43
Manufacturer=AuthenticAMD
MaxClockSpeed=2194
Name=AMD Opteron(TM) Processor 6274
OtherFamilyDescription=
PNPDeviceID=
PowerManagementCapabilities=
PowerManagementSupported=FALSE
ProcessorId=178BFBFF00600F12
ProcessorType=3
Revision=258
Role=CPU
SocketDesignation=None
Status=OK
StatusInfo=3
Stepping=2
SystemCreationClassName=Win32_ComputerSystem
SystemName=SRVLICENCON
UniqueId=
UpgradeMethod=6
Version=Modelo 1, nivel 2
VoltageCaps=

C:\WINDOWS\system32>

Let me know after this what to do

[mbellerue]

So that proves that the user has access to query WMI, which is great. Now we just need to prove that we can get from Nagios to WMI. On the Nagios server, can you run this command and give me the output?

Code: Select all

nmap -Pn <WindowsServerIP> -p 135

[lgaddam]

Sure, below is the output for post listening.

[root@nagiosp01 ~]# nmap -Pn 192.168.72.242 -p 135

Starting Nmap 6.47 ( http://nmap.org ) at 2020-02-14 03:44 CET
Nmap scan report for 192.168.72.242
Host is up (0.00087s latency).
PORT STATE SERVICE
135/tcp open msrpc

Nmap done: 1 IP address (1 host up) scanned in 0.07 seconds

[mbellerue]

Would it be possible to put the user into the Local Administrators group just to test? I did a little searching, and I found some references that remote WMI calls need to be done as a user that is in the Administrators group. It didn't specify Local vs Domain.

[lgaddam]

I have checked and found the wmi agent(adm.patrol) is available in local admin group only.
Attached is the reference.


Will we can monitor performance monitoring on windows 2003 servers from Nagios without issues ?
Why im asking is that these server version is outdated as per Microsoft.

[mbellerue]

As long as your user has the rights to query WMI, Nagios should be able to monitor the server. After permissions, probably the biggest hassle with WMI is that the performance counter names change between different versions of Windows. You may have to take a look in Performance Monitor to make sure you have the names correct. Other than that, once it's working, you should be fine to monitor indefinitely.