Windows WMI monitoring - CPU: Need at least 2 WMI samples

This support forum board is for support questions relating to Nagios XI, our flagship commercial network monitoring solution.
Locked
henrik.x.persson
Posts: 7
Joined: Tue Apr 13, 2021 8:16 am

Windows WMI monitoring - CPU: Need at least 2 WMI samples

Post by henrik.x.persson »

Hi, my first support request on this forum. :)

In short, I have an issue especially with the standard "CPU Usage" monitoring, giving the "Average CPU Utilisation Need at least 2 WMI samples", where other standard monitors: Memory Usage, Page File Usage, Drive C: Disk Usage, System Log.. and Application Log... works correctly.

Details and background: In a newer environment, I have set up Nagios XI to WMI-monitor around 20 VM Windows 2019 servers, using a domain wmiagent user, being member of Administrators; Distributed COM Users; Event Log Readers; Performance Log Users; Performance Monitor Users; Remote Management Users; Domains Users.
I have followed the Nagios related doc, using DCOMCnfg.exe, WMImgmt.msc and sc sdset commands and as written, most standard monitors works as expected.

On the AD servers, the "CPU Usage" monitoring DO work, but on all other Win servers in the domain, I have the "Need at least 2 WMI samples" issue. I have compared sc sdshow SCMANAGER output on AD server and other server, but they are identical.

Running a local cmd: Get-WmiObject -Query 'select PercentProcessorTime,Timestamp_Sys100NS from Win32_PerfRawData_PerfOS_Processor where Name="_Total"'
gives data, e.g. :
  • __GENUS : 2
    __CLASS : Win32_PerfRawData_PerfOS_Processor
    __SUPERCLASS :
    __DYNASTY :
    __RELPATH :
    __PROPERTY_COUNT : 2
    __DERIVATION : {}
    __SERVER :
    __NAMESPACE :
    __PATH :
    PercentProcessorTime : 849716054687
    Timestamp_Sys100NS : 132768640947402191
    PSComputerName :
Running the cmd on Nagios seems not to give the expected PercentProcessorTime output:
  • Command Line (v1.65): /usr/local/nagios/libexec/check_wmi_plus.pl -H 10.12.11.65 -u USER -p PASS -m checkcpu -d
    Base Dir: /usr/local/nagios/libexec
    Conf File Dir: /usr/local/nagios/libexec
    Loaded Conf File /usr/local/nagios/libexec/check_wmi_plus.conf
    WMI Ini Dir: /usr/local/nagios/libexec
    Starting Keep State Mode
    STATE FILE: /tmp/cwpss_checkcpu__10121165___.state
    Checking previous data's expiry - Timestamp 1632389800 vs Expiry After 1632386371 (Keep State Expiry setting is 3600sec)
    Using Existing WMI DATA of:$VAR1 = [
    [
    {
    '_ItemCount' => '0',
    '_KeepStateCreateTimestamp' => 1632389800
    }
    ]
    ];
    Round #2 of 2
    QUERY: /usr/bin/wmic '-U' 'USER%PASS' '--namespace' 'root/cimv2' '//10.12.11.65' 'select PercentProcessorTime,Timestamp_Sys100NS from Win32_PerfRawD
    ata_PerfOS_Processor where Name="_Total"'
    OUTPUT:
    WMI DATA:$VAR1 = [
    [
    {
    '_ChecksOK' => 1,
    '_KeepStateSamplePeriod' => 171,
    '_ItemCount' => '0',
    '_KeepStateCreateTimestamp' => 1632389800
    }
    ],
    [
    {
    '_ItemCount' => 0
    }
    ]
    ];
    Storing new WMI results in the state file $VAR1 = [
    [
    {
    '_ItemCount' => 0
    }
    ]
    ];
    Copying predefined fields to the last WMI result set [0] to [1]
    NEW WMI DATA:$VAR1 = [
    [
    {
    '_ItemCount' => '0'
    }
    ],
    [
    {
    '_KeepStateSamplePeriod' => 171,
    '_ChecksOK' => 1,
    '_KeepStateCreateTimestamp' => 1632389800,
    '_ItemCount' => 0
    }
    ]
    ];
    Creating '_AvgCPU' (WMIQuery:1, Row:0) using 'PERF_100NSEC_TIMER_INV' (Parameters: PercentProcessorTime,%.2f,100)
    Setting _AvgCPU to Need at least 2 WMI samples
    Testing TEST VALUES $VAR1 = {
    '_KeepStateSamplePeriod' => 171,
    '_ChecksOK' => 1,
    '_AvgCPU' => 'Need at least 2 WMI samples',
    '_KeepStateCreateTimestamp' => 1632389800,
    '_ItemCount' => 0
    };
    WARNING SPECS: $VAR1 = undef;
    CRITICAL SPECS: $VAR1 = undef;
    ------------ Critical Check ------------
    ------------ Warning Check ------------
    ------------ End Check ------------
    Data Passed back from check: $VAR1 = {
    '_AvgCPU' => 'Need at least 2 WMI samples',
    '_DisplayMsg' => 'OK (Sample Period 171 sec)',
    '_TestResult' => 0,
    '_KeepStateCreateTimestamp' => 1632389800,
    '_ChecksOK' => 1,
    '_KeepStateSamplePeriod' => 171,
    '_StatusType' => 'OK (Sample Period 171 sec)',
    '_ItemCount' => 0,
    '_Triggers' => ''
    };
    ---------- Building Up Display
    Incoming Data $VAR1 = {
    '_submode' => '',
    '_staticsubcriteria' => '1',
    '_nodatastring' => 'WMI Query returned no data. The item you were looking for may NOT exist or the software that creates the WMI Class may
    not be running, or all data has been excluded.
    ',
    '_TestResult' => 0,
    '_KeepStateCreateTimestamp' => 1632389800,
    '_arg5' => undef,
    '_ChecksOK' => 1,
    '_KeepStateSamplePeriod' => 171,
    '_host' => '10.12.11.65',
    '_ignorezerosizedrives' => '',
    '_nodatamode' => '',
    '_mode' => 'checkcpu',
    '_savedbytefactor' => '',
    '_ItemCount' => 0,
    '_convertslash' => undef,
    '_arg3' => '',
    '_forcevariablescriteriaspec' => '',
    '_AvgCPU' => 'Need at least 2 WMI samples',
    '_DisplayMsg' => 'OK (Sample Period 171 sec)',
    '_arg1' => '',
    '_truncate_output' => 8192,
    '_arg2' => '',
    '_timeout' => '',
    '_StatusType' => 'OK (Sample Period 171 sec)',
    '_delay' => 171,
    '_bytefactor' => 1024,
    '_nodataexit' => '',
    '_arg4' => undef,
    '_Triggers' => ''
    };
    ------- Processing _DisplayMsg||~|~| - ||
    Complex Format:_DisplayMsg,,~,~, - ,,
    _DisplayMsg||~|~| - || ----> OK (Sample Period 171 sec) -
    ------- Processing _AvgCPU|%|Average CPU Utilisation| |~||
    Complex Format:_AvgCPU,%,Average CPU Utilisation, ,~,,
    _AvgCPU|%|Average CPU Utilisation| |~|| ----> Average CPU Utilisation Need at least 2 WMI samples%
    ---------- Building Up Performance Data
    ------- Processing _AvgCPU|%|Avg CPU Utilisation
    Complex Format:_AvgCPU,%,Avg CPU Utilisation
    Ignoring perf data since it is not numeric
    ---------- Done
    OUT:OK (Sample Period 171 sec) - Average CPU Utilisation Need at least 2 WMI samples%
Best regards
Henrik
User avatar
pbroste
Posts: 1288
Joined: Tue Jun 01, 2021 1:27 pm

Re: Windows WMI monitoring - CPU: Need at least 2 WMI sample

Post by pbroste »

Hello Henrik

Thanks for reaching out, sounds like a permissions issue, since it is working on other instances. I want to do some more recon on this so we can help determine what is going on.

You are using a Domain User account 'wmiagent' which is a member of "Administrators; Distributed COM Users; Event Log Readers; Performance Log Users; Performance Monitor Users; Remote Management Users; Domains Users". From what I understand Administrators and Performance Log Users should do it.

With that, want to find out what results you get when you run the command as Local Administrator:

Code: Select all

/usr/local/nagios/libexec/check_wmi_plus.pl -H 10.12.11.65 -u <[localcomputernamehere/]localadmnistratoruseraccounthere> -p PASS -m checkcpu -d
Also, verify that "Remote Enable" in the Security Tab for WMI local control for User or Usergroup Account.

Please let us know the results,
Perry
henrik.x.persson
Posts: 7
Joined: Tue Apr 13, 2021 8:16 am

Re: Windows WMI monitoring - CPU: Need at least 2 WMI sample

Post by henrik.x.persson »

Hi Perry,

Thanks for the reply and suggestion for investigation. Running the command with the local administrator account gives the expected output (and running it twice gives as CPU usage percent).

So I guess the question is, why it don't work with domain user.

Best regards
Henrik
Command Line (v1.65): /usr/local/nagios/libexec/check_wmi_plus.pl -H 10.12.11.65 -u USER -p PASS -m checkcpu -d
Base Dir: /usr/local/nagios/libexec
Conf File Dir: /usr/local/nagios/libexec
Loaded Conf File /usr/local/nagios/libexec/check_wmi_plus.conf
WMI Ini Dir: /usr/local/nagios/libexec
Starting Keep State Mode
STATE FILE: /tmp/cwpss_checkcpu__10121165___.state
Checking previous data's expiry - Timestamp 1632722793 vs Expiry After 1632719441 (Keep State Expiry setting is 3600sec)
Using Existing WMI DATA of:$VAR1 = [
[
{
'_ItemCount' => '0',
'_KeepStateCreateTimestamp' => 1632722793
}
]
];
Round #2 of 2
QUERY: /usr/bin/wmic '-U' 'USER%PASS' '--namespace' 'root/cimv2' '//10.12.11.65' 'select PercentProcessorTime,Timestamp_Sys100NS from Win32_PerfRawData_PerfOS_Processor where Name="_Total"'
OUTPUT: CLASS: Win32_PerfRawData_PerfOS_Processor
Name|PercentProcessorTime|Timestamp_Sys100NS
_Total|4147102890625|132771966417732961

Storing Class Row:CLASS: Win32_PerfRawData_PerfOS_Processor
Storing Header Row:Name|PercentProcessorTime|Timestamp_Sys100NS
COLUMNS(last index=2):Name|PercentProcessorTime|Timestamp_Sys100NS
Now looking for (.*?)\n (use_split=1)

Looking at Data Row: _Total|4147102890625|132771966417732961
FIELDS (via Split):COLNAME=Name,FIELD=_Total
COLNAME=PercentProcessorTime,FIELD=4147102890625
COLNAME=Timestamp_Sys100NS,FIELD=132771966417732961
Row Data Valid = 1

Row Data Found OK
WMI DATA:$VAR1 = [
[
{
'_ChecksOK' => 1,
'_KeepStateSamplePeriod' => 248,
'_ItemCount' => '0',
'_KeepStateCreateTimestamp' => 1632722793
}
],
[
{
'Timestamp_Sys100NS' => '132771966417732961',
'PercentProcessorTime' => '4147102890625',
'_ItemCount' => 1,
'Name' => '_Total'
}
]
];
Storing new WMI results in the state file $VAR1 = [
[
{
'_ChecksOK' => 1,
'Timestamp_Sys100NS' => '132771966417732961',
'PercentProcessorTime' => '4147102890625',
'_ItemCount' => 1,
'Name' => '_Total'
}
]
];
Copying predefined fields to the last WMI result set [0] to [1]
NEW WMI DATA:$VAR1 = [
[
{
'_ItemCount' => '0'
}
],
[
{
'_KeepStateSamplePeriod' => 248,
'_ChecksOK' => 1,
'Timestamp_Sys100NS' => '132771966417732961',
'PercentProcessorTime' => '4147102890625',
'_KeepStateCreateTimestamp' => 1632722793,
'_ItemCount' => 1,
'Name' => '_Total'
}
]
];
Creating '_AvgCPU' (WMIQuery:1, Row:0) using 'PERF_100NSEC_TIMER_INV' (Parameters: PercentProcessorTime,%.2f,100)
Setting _AvgCPU to Need at least 2 WMI samples
Testing TEST VALUES $VAR1 = {
'_AvgCPU' => 'Need at least 2 WMI samples',
'Timestamp_Sys100NS' => '132771966417732961',
'PercentProcessorTime' => '4147102890625',
'_KeepStateCreateTimestamp' => 1632722793,
'_ChecksOK' => 1,
'_KeepStateSamplePeriod' => 248,
'Name' => '_Total',
'_ItemCount' => 1
};
WARNING SPECS: $VAR1 = undef;
CRITICAL SPECS: $VAR1 = undef;
------------ Critical Check ------------
------------ Warning Check ------------
------------ End Check ------------
Data Passed back from check: $VAR1 = {
'_AvgCPU' => 'Need at least 2 WMI samples',
'_DisplayMsg' => 'OK (Sample Period 248 sec)',
'_TestResult' => 0,
'Timestamp_Sys100NS' => '132771966417732961',
'PercentProcessorTime' => '4147102890625',
'_KeepStateCreateTimestamp' => 1632722793,
'_ChecksOK' => 1,
'_KeepStateSamplePeriod' => 248,
'_StatusType' => 'OK (Sample Period 248 sec)',
'Name' => '_Total',
'_ItemCount' => 1,
'_Triggers' => ''
};
---------- Building Up Display
Incoming Data $VAR1 = {
'_submode' => '',
'_staticsubcriteria' => '1',
'_TestResult' => 0,
'_KeepStateCreateTimestamp' => 1632722793,
'_arg5' => undef,
'_ChecksOK' => 1,
'_KeepStateSamplePeriod' => 248,
'_ignorezerosizedrives' => '',
'_nodatamode' => '',
'_mode' => 'checkcpu',
'_ItemCount' => 1,
'_forcevariablescriteriaspec' => '',
'_AvgCPU' => 'Need at least 2 WMI samples',
'_arg1' => '',
'_arg2' => '',
'_bytefactor' => 1024,
'_nodataexit' => '',
'PercentProcessorTime' => '4147102890625',
'_nodatastring' => 'WMI Query returned no data. The item you were looking for may NOT exist or the software that creates the WMI Class may not be running, or all data has been excluded.
',
'_host' => '10.12.11.65',
'_savedbytefactor' => '',
'_convertslash' => undef,
'_arg3' => '',
'_DisplayMsg' => 'OK (Sample Period 248 sec)',
'Timestamp_Sys100NS' => '132771966417732961',
'_truncate_output' => 8192,
'_timeout' => '',
'_StatusType' => 'OK (Sample Period 248 sec)',
'_delay' => 248,
'Name' => '_Total',
'_Triggers' => '',
'_arg4' => undef
};
------- Processing _DisplayMsg||~|~| - ||
Complex Format:_DisplayMsg,,~,~, - ,,
_DisplayMsg||~|~| - || ----> OK (Sample Period 248 sec) -
------- Processing _AvgCPU|%|Average CPU Utilisation| |~||
Complex Format:_AvgCPU,%,Average CPU Utilisation, ,~,,
_AvgCPU|%|Average CPU Utilisation| |~|| ----> Average CPU Utilisation Need at least 2 WMI samples%
---------- Building Up Performance Data
------- Processing _AvgCPU|%|Avg CPU Utilisation
Complex Format:_AvgCPU,%,Avg CPU Utilisation
Ignoring perf data since it is not numeric
---------- Done
OUT:OK (Sample Period 248 sec) - Average CPU Utilisation Need at least 2 WMI samples%

OK (Sample Period 248 sec) - Average CPU Utilisation Need at least 2 WMI samples%
User avatar
pbroste
Posts: 1288
Joined: Tue Jun 01, 2021 1:27 pm

Re: Windows WMI monitoring - CPU: Need at least 2 WMI sample

Post by pbroste »

Hello @henrik.x.persson

Thanks for following up, I see that Domain Users to access WMI requires Performance Monitor Privillieges which you have already implemented.

Did you also check for remote access, remote launch, and remote activation permissions as well?

Let me know what you find,
Perry
henrik.x.persson
Posts: 7
Joined: Tue Apr 13, 2021 8:16 am

Re: Windows WMI monitoring - CPU: Need at least 2 WMI sample

Post by henrik.x.persson »

Hi Perry,

thanks for the answer.
Yes, through DCOMCnfg, I did check the domain user to have remote access/launch/activation permissions.

Best regards
Henrik
User avatar
pbroste
Posts: 1288
Joined: Tue Jun 01, 2021 1:27 pm

Re: Windows WMI monitoring - CPU: Need at least 2 WMI sample

Post by pbroste »

Hello @henrik.x.persson,

You can use a local administrator account on the check.
  • /usr/local/nagios/libexec/check_wmi_plus.pl -H 10.12.11.65 -u 'localcomputername/USER' -p PASS -m checkcpu -d
Thanks,
Perry
henrik.x.persson
Posts: 7
Joined: Tue Apr 13, 2021 8:16 am

Re: Windows WMI monitoring - CPU: Need at least 2 WMI sample

Post by henrik.x.persson »

Hi Perry,

Thanks for the answer.
Yes, I will use a local Admin account for the CPU usage monitoring.
Thanks for the support!

Best regards
Henrik
User avatar
pbroste
Posts: 1288
Joined: Tue Jun 01, 2021 1:27 pm

Re: Windows WMI monitoring - CPU: Need at least 2 WMI sample

Post by pbroste »

Hello @henrik.x.persson

Thanks for following up, I will go ahead and lock this post.

Please let us know if there is anything further that we can help with.
Perry
Locked