Page 2 of 2

Re: passive (nsclient++) and WMICheck

Posted: Thu Dec 18, 2014 3:48 am
by lejeczek
I have a simple passive checks working, yes. I've got tangled up in all documentation and WMI is the bit which perplexed me and I cannot work it out.
My understanding is that WMI for simple information harvesting would be a natural way to pursue , lightweight and quicker than scripts.
They have this: http://www.nsclient.org/nscp/wiki/CheckWMI/CheckWMI
but like I said, translate it to a passive version I failed.
thanks gents.

Re: passive (nsclient++) and WMICheck

Posted: Thu Dec 18, 2014 6:38 am
by Box293
OK so I have some answers and a headache to go along with it :lol:

I tried using NSClient 0.4.1.90 and ran into some issues.

So I went to NSClient 0.3.9 to prove that it could work. The information here on is specific to 0.3.9.

First problem I found (this one took me about three hours to work out). There is some bug in 0.3.9 which causes the NSCA module to not send any data if more than ONE command is defined. So in my steps below, I only have one NSCA command defined. OK so getting past that!
EDIT: NSClient 0.3.9 and below ONLY works with NSCA 2.7.2

You need the CheckWMI module enabled, this is as simple as uncommenting the line from the nsc.ini file:
CheckWMI.dll

First do a normal NRPE check to get the command you want. I know NRPE isn't what you're after, but testing this way will save some headaches (of course you're going to need to add allow_arguments=1 to the [NRPE] section). For example:

Code: Select all

Command:
check_nrpe -H dc01 -c CheckWMI -a "Query=Select Version,Caption,BuildNumber from win32_OperatingSystem"

Output:
BuildNumber=7600Caption=Microsoft Windows Server 2008 R2 Standard Version=6.1.7600|'wmi query'=1
Now it is assumed you have all the standard [NSCA Agent] settings defined in NSC.ini.

Next take that command and create a command under [NSCA Commands]. NOTE: you want CheckWMI onwards EXCEPT remove the -a

Code: Select all

[NSCA Commands]
Operating System Version=CheckWMI "Query=Select Version,Caption from win32_OperatingSystem"
Now restart the NSClient++ service. If all works OK you'll see something end up in the /usr/local/nagios/var/nagios.log:

Code: Select all

[1418902363] EXTERNAL COMMAND: PROCESS_SERVICE_CHECK_RESULT;DC01;Operating System Version;0;Caption=Microsoft Windows Server 2008 R2 Standard Version=6.1.7600|'wmi query'=1
[1418902363] Warning:  Passive check result was received for service 'Operating System Version' on host 'DC01', but the host could not be found!
[1418902363] Error: External command failed -> PROCESS_SERVICE_CHECK_RESULT;DC01;Operating System Version;0;Caption=Microsoft Windows Server 2008 R2 Standard Version=6.1.7600|'wmi query'=1
[1418902363] External command error: Command failed
The errors are expected because no service exists for this passive check result.

Sweeet.

Next I'll figure it out in NSClient 0.4.1.x ...

EDIT: below are the steps for NSClient++ 0.4.x

The basic difference from the old version to the new version is the addition of the [/settings/scheduler/schedules] which replaces [NSCA Commands] and interval has been moved to [/settings/scheduler/schedules/default].

Here's the absolute minimum nsclient.ini file required to make WMI checks work through NSCA.

Code: Select all

[/modules]
CheckWMI = enabled
NSCAClient = enabled
Scheduler = enabled


[/settings/NSCA/client]
channel = NSCA
hostname = auto


[/settings/NSCA/client/targets/default]
address = 10.25.5.2
encryption = 0
password = Passw0rd


[/settings/scheduler/schedules/default]
interval = 1m


[/settings/scheduler/schedules]
Operating System Version = CheckWMI "Query=Select Version,Caption from win32_OperatingSystem"

In either version, any of the commands/ you execute can be from other NSClient++ modules. For example if I wanted to use the built in check "checkCPU" I would need to enable the CheckSystem module:

Code: Select all

[/modules]
CheckSystem = enabled

[/settings/scheduler/schedules]
CPU Load = checkCPU warn=80 crit=90 time=5m time=1m time=30s
To take this a step further, if I wanted to use the checkCPU through an alias, I would need to enable the CheckExternalScripts module AS WELL:

Code: Select all

[/modules]
CheckSystem = enabled
CheckExternalScripts = enabled

[/settings/external scripts/alias]
alias_cpu = checkCPU warn=80 crit=90 time=5m time=1m time=30s

[/settings/scheduler/schedules]
CPU Load = alias_cpu

Hope this is everything you were looking for.

Re: passive (nsclient++) and WMICheck

Posted: Sun Dec 21, 2014 11:10 pm
by Box293
OK so I did a little more digging and diagnosed that NSClient 0.3.9 only works with NSCA server 2.7.2. There appears to be some changes in NSCA Server 2.9.x which makes NSClient 0.3.9 not compatible.

However NSClient 0.4.x works fine with NSCA server 2.9.x.

Finally, because I learnt so much about this while answering your WMI question I created a guide for NSCA which is located here:

http://sites.box293.com/nagios/guides/nsca