WMI Unknown

[cwscribner]

Is the removal of those files something that I should run through change control? i.e. will deleting those files stop the WMI monitoring?

[yancy]

Yes, between the time you remove those files, and re-run the WMI wizard, WMI monitoring will fail as the needed files will be missing.

[cwscribner]

By re-run the wizard, you mean re-upload the WMI wizard, correct?

[lmiltchev]

Admin->System Extensions->Manage Config Wizards->Browse->Upload Wizard, then re-run the wizard.

Hope this helps.

[cwscribner]

I was looking for clarification because I have several hundred servers being monitored with WMI. However, I only ran one through the config wizard and then applied those config files to a hostgroup. I know how to run the wizard...but that's obviously not doable with this amount of devices.

[scottwilkerson]

You won't need to rerun the wizard for the old items already added.

Here is the "safe" procedure.

in the terminal

Code: Select all

cd /usr/local/nagios/libexec/
mv check_wmi_plus.conf check_wmi_plus.conf.old
mv check_wmi_plus.ini check_wmi_plus.ini.old
mv check_wmi_plus.pl check_wmi_plus.pl.old

Then upload the new wizard.

Now in the terminal you should see the old and new files

Code: Select all

ll /usr/local/nagios/libexec/check_wmi_plus*

Once you have confirmed everything is working correctly, you can remove the .old files.

If something goes wrong, you can revert to the old files with:

Code: Select all

mv check_wmi_plus.conf.old check_wmi_plus.conf
mv check_wmi_plus.ini.old check_wmi_plus.ini
mv check_wmi_plus.pl.old check_wmi_plus.pl

[yancy]

Scott makes a good point to back up your current config files.

However, yes re-run the wizard means re-add using manage-config wizard.

You shouldn't need to re-add all your Windows hosts/services, because the host and service definitions won't change. They'll just point to the new check_wmi_plus.pl which will be in the same place and same name as the old check_wmi_plus.pl....

Hopefully that adds a little more clarification.

[cwscribner]

-I backed up the files
-Readded the wizard. This didn't replace the .pl and .ini files in libexec/ so I copied the originals (.backup) to their original file names. So the .backup files are the same as the originals
-There was no .conf in libexec/ so I copied it from the configwizard directory to libexec/
-Below are the file permissions and the error that I'm now getting.
-Version for .pl is now 1.49

Code: Select all

-rwxr-xr-x 1 root   root     2405 Mar  1 13:22 check_wmi_plus.conf
-rwxr-xr-x 1 root   root    42323 Mar  1 13:01 check_wmi_plus.ini
-rwxr-xr-x 1 nagios users   42323 Sep 27 14:18 check_wmi_plus.ini.backup
-rwxr-xr-x 1 root   root   237155 Mar  1 13:10 check_wmi_plus.pl
-rwxr-xr-x 1 nagios users  135018 Sep 27 14:18 check_wmi_plus.pl.backup

Code: Select all

UNKNOWN - The WMI query had problems. You might have your username/password wrong or the user's access level is too low. Wmic error text on the next line.
[librpc/rpc/dcerpc_util.c:1290:dcerpc_pipe_auth_recv()] Failed to bind to uuid 4d9f4ab8-7d1c-11cf-861e-0020af6e7c57 - NT_STATUS_NET_WRITE_FAULT
[librpc/rpc/dcerpc_connect.c:790:dcerpc_pipe_connect_b_recv()] failed NT status (c0000022) in dcerpc_pipe_connect_b_recv
[wmi/wmic.c:196:main()] ERROR: Login to remote object.
NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied

[scottwilkerson]

Yancy may need to chime in here on this but it looks like it isn't able to login to Windows..

A little search found this possible problem

When you get this error it is generally because you are creating a limited permission user to access WMI datasources. This particular error is caused because your service user did not have access to the server due to the local users group that had been removed from "access this computer from the network" in User Rights Assignment of the Local Group Policy. Re-Add that permission to the account to fix this.

Additionally, for some house keeping we should run

Code: Select all

chown nagios:users /usr/local/nagios/libexec/check_wmi_plus*

Also, because the upload wasn't writing the files to the libexec directory, we may have a permissions problem on the directory, lets run

Code: Select all

ls -l /usr/local/nagios/ |grep libexec

it should look like

Code: Select all

drwxrwxr-x  2 nagios nagios 4096 Mar  1 13:13 libexec

[cwscribner]

I feel stupid for not considering this earlier but the user is in active directory so I've reached out to the client to explore if they've had a problem in that regard.

As far as the check_wmi files, they were root:root but I've changed them per your suggestion. libexec/ has the correct permissions (775)