Adding a plugin for windows

[snapon_admin]

I'm familiar with adding plugins to unix hosts using NRPE, but up until now we've never had to do this with our windows servers. Our windows servers are using NSClient++, and we'd like to add a plugin to check total % of CPU utilization for specific processes, but I have no idea how to do that on the host side.

For example, with NRPE I know that the plugin needs to be added to the directory where all our other plugins are and that a command definition need to be added to the nrpe.cfg file. I'm not sure what the equivalent for nsclient would be since I've never had to do that before. Just need a nudge in the right direction.

[abrist]

You should be able to use performance counters for this task:
https://www.nsclient.org/nscp/wiki/Chec ... eckCounter

Code: Select all

check_nrpe -H <hostname> -p 5666 -t 60 -c CheckCounter -a "Counter:ExplorerCPUTime=\Process(explorer)\% Processor Time" ShowAll

You will need to enable NSClientListener.dll in your nsclient config if you have not done so already.

[snapon_admin]

Our windows servers are not using nrpe currently. I found a plugin on exchange that looks like it'll do what we want it to, but have no idea how to get nsclient to work with it.

http://exchange.nagios.org/directory/Pl ... ed/details

[abrist]

You could try using the check_nt perf counter check:

Code: Select all

$USER1$/check_nt $HOSTADDRESS$ -p 12489 -v COUNTER -l $ARG1$ -d SHOWALL -w $ARG2$ -c $ARG3$

Our windows servers are not using nrpe currently.

You will need to enable nrpe to run external scripts, so maybe try to use the check_nt command above.

Code: Select all

./check_nt -H <ip> -p 12489 -s <password> -v COUNTER -l "\\Process(firefox)\% Processor Time" -d SHOWALL

[snapon_admin]

Oh ok, I see now. Alright so the check_nt perf counter check, I would like to see if that will do what we want rather than worry about implementing nrpe and using a different plugin. When I run the command you specified the output, no matter what process I try, is always '0'. What exactly is this checking? Also, one other question; how does this check handle multiple processes with the same name? Is there a way to see if any process of a specific name (ours has 9 running that are the same name) is using more than say 50% CPU?

[sreinhardt]

Additional processes seem to be indicated with a processname, processname#1, processname#2, etc. You can see all of the named processes that are available by opening up perfmon, selecting Performance Monitor, and adding a new counter for Process, % User Time and finally selecting a process if you wish. As for the data abrist had you show, that is % user time, or the amount of cpu usage that process is using within user space, if it were to make a kernel space call, that would be under % Priviledged Time.

[snapon_admin]

Ok, so for multiple processes that'd look something like this?

Code: Select all

./check_nt -H <IP ADDRESS> -p 12489 -v COUNTER -l "\\Process(prunsrv64.exe#2)\% Processor Time" -d SHOWALL

Also, is there anyway to do this and see the memory usage?

[slansing]

What is the output of that? If it looks correct chances are it should be. We can take a look for you. As far as memory usage goes you can find memory based counters in the windows performance monitor as well. Are you asking about seeing a process's memory usage?

[snapon_admin]

Not sure if the output is correct or not. I get '0' no matter what number I use, but of the 9 processes only 2 of them are actually above 0% CPU right now (one is 2, the other is 4), so for all I know it could be correct. As for the memory question yes, I would like to see how much RAM a process is using, either in MB/GB or percentage.

[lmiltchev]

Did you add all of the performance counters, that you are trying to monitor (Performance Monitor->Add) and restart the NSClient++ service?

If you get a "0" (zero), maybe your command is incorrect (you may need to do some escaping).

As for the memory, I believe you can use the "working set" counter, for example:

Code: Select all

./check_nt -H 192.168.x.x -p 12489 -s password -v COUNTER -l "\\Process(firefox)\Working Set" -d SHOWALL
854258000