Monitor IIS AppPool Using NagiosXI and NCPA Agent

[imadc]

Code: Select all

# Extensions for plugins
# ----------------------
# The extension for the plugin denotes how NCPA will try to run the plugin. Use this
# for setting how you want to run the plugin in the command line.
#
# NOTE: Plugins without an extension will be ran in the cmdline as follows:
#       $plugin_name $plugin_args
#
# Defaults:
# .sh = /bin/sh $plugin_name $plugin_args
# .py = python $plugin_name $plugin_args
# .ps1 = powershell -ExecutionPolicy Bypass -File $plugin_name $plugin_args
# .vbs = cscript $plugin_name $plugin_args //NoLogo
# .bat = cmd /c $plugin_name $plugin_args
#
# Since windows NCPA is 32-bit, if you need to use 64-bit powershell, try the following for
# the powershell plugin definition:
# .ps1 = c:\windows\sysnative\windowspowershell\v1.0\powershell.exe -ExecutionPolicy Unrestricted -File $plugin_name $plugin_args
#

# Linux / Mac OS X
.sh = /bin/sh $plugin_name $plugin_args
.py = python $plugin_name $plugin_args

# Windows
#.ps1 = powershell -ExecutionPolicy Bypass -File $plugin_name $plugin_args
.ps1 = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Unrestricted -File $plugin_name $plugin_args
.vbs = cscript $plugin_name $plugin_args //NoLogo
.bat = cmd /c $plugin_name $plugin_args

[lmiltchev]

I suspect that this may not be a 32 vs 64 bit issue but a group policy permissions issue. I could be wrong though.

Can you open a CMD prompt on the Windows server, go to the NCPA plugins directory, run the following command, and show the output?

Code: Select all

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Unrestricted -File check_ms_iis_application_pool.ps1

[imadc]

Here are the output of the script when cmd runs in administrator mode vs regular mode

Regular mode

Code: Select all

C:\Users\imacha>C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -Execu
tionPolicy Unrestricted -File "C:\Program Files (x86)\Nagios\NCPA\plugins\test2.
ps1" DefaultAppPool
Process should have elevated status to access IIS configuration data.
get-webitemstate : Cannot find drive. A drive with the name 'IIS' does not
exist.
At C:\Program Files (x86)\Nagios\NCPA\plugins\test2.ps1:3 char:1
+ $AppPool_Status = (Get-WebAppPoolState $args[0]).Value
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (IIS:String) [Get-WebItemState],
    DriveNotFoundException
    + FullyQualifiedErrorId : DriveNotFound,Microsoft.IIs.PowerShell.Provider.
   GetItemStateCommand

DefaultAppPool Current Status is

C:\Users\imacha>

Administrator mode is resulting same results from the NCPA GUI and NagiosXI GUI

Code: Select all

Microsoft Windows [Version 6.3.9600]
(c) 2013 Microsoft Corporation. All rights reserved.

C:\Windows\system32>C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -E
xecutionPolicy Unrestricted -File "C:\Program Files (x86)\Nagios\NCPA\plugins\te
st2.ps1" DefaultAppPool
get-webitemstate : Retrieving the COM class factory for component with CLSID
{688EEEE5-6A7E-422F-B2E1-6AF00DC944A6} failed due to the following error:
80040154 Class not registered (Exception from HRESULT: 0x80040154
(REGDB_E_CLASSNOTREG)).
At C:\Program Files (x86)\Nagios\NCPA\plugins\test2.ps1:3 char:1
+ $AppPool_Status = (Get-WebAppPoolState $args[0]).Value
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Get-WebItemState], COMExcepti
   on
    + FullyQualifiedErrorId : System.Runtime.InteropServices.COMException,Micr
   osoft.IIs.PowerShell.Provider.GetItemStateCommand

DefaultAppPool Current Status is

C:\Windows\system32>

[lmiltchev]

What is the "test2.ps1" script? Is this a custom script or you just renamed "check_ms_iis_application_pool.ps1"?

Can you rerun the command from the CMD prompt, but using "sysnative" this time?

Code: Select all

c:\windows\sysnative\windowspowershell\v1.0\powershell.exe -ExecutionPolicy Unrestricted -File check_ms_iis_application_pool.ps1

Also, try:

Code: Select all

c:\windows\system32\windowspowershell\v1.0\powershell.exe -ExecutionPolicy Unrestricted -File check_ms_iis_application_pool.ps1

What is the version of IIS that you are currently using? Have you installed the IIS management scripts and tools?

It’s very possible you will experience issues on lower IIS versions. You need to install the IIS Management Scripts and Tools feature for the script to work properly.

https://outsideit.net/monitoring-iis-application-pools/

[imadc]

Hey @lmiltchev

So when I try using c:\windows\sysnative\windowspowershell\v1.0\powershell.exe -ExecutionPolicy Unrestricted -File "C:\Program Files (x86)\Nagios\NCPA\plugins\check_ms_iis_application_pool.ps1" DefaultAppPool

Code: Select all

C:\Windows\system32>c:\windows\sysnative\windowspowershell\v1.0\powershell.exe -
ExecutionPolicy Unrestricted -File "C:\Program Files (x86)\Nagios\NCPA\plugins\c
heck_ms_iis_application_pool.ps1" DefaultAppPool
The system cannot find the path specified.

So when I try using c:\windows\system32\windowspowershell\v1.0\powershell.exe -ExecutionPolicy Unrestricted -File "C:\Program Files (x86)\Nagios\NCPA\plugins\check_ms_iis_application_pool.ps1" DefaultAppPool

This one works from CMD

Code: Select all

C:\Windows\system32>c:\windows\system32\windowspowershell\v1.0\powershell.exe -E
xecutionPolicy Unrestricted -File "C:\Program Files (x86)\Nagios\NCPA\plugins\ch
eck_ms_iis_application_pool.ps1" DefaultAppPool
DefaultAppPool Current Status is Started

The I placed this path into the ncpa.cfg

Code: Select all

# Linux / Mac OS X
.sh = /bin/sh $plugin_name $plugin_args
.py = python $plugin_name $plugin_args

# Windows
#.ps1 = powershell -ExecutionPolicy Bypass -File $plugin_name $plugin_args
.ps1 = c:\windows\system32\windowspowershell\v1.0\powershell.exe -ExecutionPolicy Unrestricted -File $plugin_name $plugin_args
.vbs = cscript $plugin_name $plugin_args //NoLogo
.bat = cmd /c $plugin_name $plugin_args

THe tried again through the GUI and got the problem reproduced

https://X.X.X.X:5693/api/plugins/check_ ... ultAppPool
{
"returncode": 3,
"stdout": "get-webitemstate : Retrieving the COM class factory for component with CLSID \n{688EEEE5-6A7E-422F-B2E1-6AF00DC944A6} failed due to the following error: \n80040154 Class not registered (Exception from HRESULT: 0x80040154 \n(REGDB_E_CLASSNOTREG)).\nAt C:\\Program Files \n(x86)\\Nagios\\NCPA\\plugins\\check_ms_iis_application_pool.ps1:4 char:1\n+ $AppPool_Status = (Get-WebAppPoolState $args[0]).Value\n+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n + CategoryInfo : NotSpecified: (:) [Get-WebItemState], COMExcepti \n on\n + FullyQualifiedErrorId : System.Runtime.InteropServices.COMException,Micr \n osoft.IIs.PowerShell.Provider.GetItemStateCommand\n \nDefaultAppPool Current Status is"
}

[lmiltchev]

If the command works from the command line it *should* work in NCPA as well. Did you restart NCPA Listener service after making your mods in the ncpa.cfg file? You need to restart the service so that changes can take effect.

[imadc]

Yes tried that serveral time with no luck

This happens with the script containing Get-WebAppPoolState

From what I saw online this have to do with running scripts on x86 vs x64 powershell. Not sure if this is the case over here

will grabbing any log help?

[lmiltchev]

Yes, let's take a look at the ncpa_listener.log. Can you upload the file on the forum (or copy/paste the text, wrapped in code wraps)?

[imadc]

The logs are empty

Although I validated the setting of logs in ncpa

Code: Select all

[general]

#
# Check logging is on by default, you can disable it if you do not want to record
# the check requests that are coming in or checks being sent over NRDP.
# Default: check_logging = 1
#
check_logging = 1

#
# Check logging time - how long in DAYS you'd like to keep checks in the database.
# Default: 30
#
check_logging_time = 30

[lmiltchev]

Make sure you have the following lines under the [listener] section:

Code: Select all

loglevel =debug
logfile = var/log/ncpa_listener.log
pidfile = var/run/ncpa_listener.pid

Save the ncpa.cfg file, restart the NCPA Listener service, and check the ncpa_listener.log again.