Page 3 of 4
Re: WMI Unknown
Posted: Mon Feb 27, 2012 1:54 pm
by cwscribner
Is the removal of those files something that I should run through change control? i.e. will deleting those files stop the WMI monitoring?
Re: WMI Unknown
Posted: Mon Feb 27, 2012 4:42 pm
by yancy
Yes, between the time you remove those files, and re-run the WMI wizard, WMI monitoring will fail as the needed files will be missing.
Re: WMI Unknown
Posted: Mon Feb 27, 2012 5:53 pm
by cwscribner
By re-run the wizard, you mean re-upload the WMI wizard, correct?
Re: WMI Unknown
Posted: Tue Feb 28, 2012 10:01 am
by lmiltchev
Admin->System Extensions->Manage Config Wizards->Browse->Upload Wizard, then re-run the wizard.
Hope this helps.
Re: WMI Unknown
Posted: Tue Feb 28, 2012 12:40 pm
by cwscribner
I was looking for clarification because I have several hundred servers being monitored with WMI. However, I only ran one through the config wizard and then applied those config files to a hostgroup. I know how to run the wizard...but that's obviously not doable with this amount of devices.
Re: WMI Unknown
Posted: Tue Feb 28, 2012 3:35 pm
by scottwilkerson
You won't need to rerun the wizard for the old items already added.
Here is the "safe" procedure.
in the terminal
Code: Select all
cd /usr/local/nagios/libexec/
mv check_wmi_plus.conf check_wmi_plus.conf.old
mv check_wmi_plus.ini check_wmi_plus.ini.old
mv check_wmi_plus.pl check_wmi_plus.pl.old
Then upload the new wizard.
Now in the terminal you should see the old and new files
Code: Select all
ll /usr/local/nagios/libexec/check_wmi_plus*
Once you have confirmed everything is working correctly, you can remove the .old files.
If something goes wrong, you can revert to the old files with:
Code: Select all
mv check_wmi_plus.conf.old check_wmi_plus.conf
mv check_wmi_plus.ini.old check_wmi_plus.ini
mv check_wmi_plus.pl.old check_wmi_plus.pl
Re: WMI Unknown
Posted: Tue Feb 28, 2012 4:15 pm
by yancy
Scott makes a good point to back up your current config files.
However, yes re-run the wizard means re-add using manage-config wizard.
You shouldn't need to re-add all your Windows hosts/services, because the host and service definitions won't change. They'll just point to the new check_wmi_plus.pl which will be in the same place and same name as the old check_wmi_plus.pl....
Hopefully that adds a little more clarification.
Re: WMI Unknown
Posted: Thu Mar 01, 2012 1:32 pm
by cwscribner
-I backed up the files
-Readded the wizard. This didn't replace the .pl and .ini files in libexec/ so I copied the originals (.backup) to their original file names. So the .backup files are the same as the originals
-There was no .conf in libexec/ so I copied it from the configwizard directory to libexec/
-Below are the file permissions and the error that I'm now getting.
-Version for .pl is now 1.49
Code: Select all
-rwxr-xr-x 1 root root 2405 Mar 1 13:22 check_wmi_plus.conf
-rwxr-xr-x 1 root root 42323 Mar 1 13:01 check_wmi_plus.ini
-rwxr-xr-x 1 nagios users 42323 Sep 27 14:18 check_wmi_plus.ini.backup
-rwxr-xr-x 1 root root 237155 Mar 1 13:10 check_wmi_plus.pl
-rwxr-xr-x 1 nagios users 135018 Sep 27 14:18 check_wmi_plus.pl.backup
Code: Select all
UNKNOWN - The WMI query had problems. You might have your username/password wrong or the user's access level is too low. Wmic error text on the next line.
[librpc/rpc/dcerpc_util.c:1290:dcerpc_pipe_auth_recv()] Failed to bind to uuid 4d9f4ab8-7d1c-11cf-861e-0020af6e7c57 - NT_STATUS_NET_WRITE_FAULT
[librpc/rpc/dcerpc_connect.c:790:dcerpc_pipe_connect_b_recv()] failed NT status (c0000022) in dcerpc_pipe_connect_b_recv
[wmi/wmic.c:196:main()] ERROR: Login to remote object.
NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied
Re: WMI Unknown
Posted: Thu Mar 01, 2012 2:18 pm
by scottwilkerson
Yancy may need to chime in here on this but it looks like it isn't able to login to Windows..
A little search found this possible problem
When you get this error it is generally because you are creating a limited permission user to access WMI datasources. This particular error is caused because your service user did not have access to the server due to the local users group that had been removed from "access this computer from the network" in User Rights Assignment of the Local Group Policy. Re-Add that permission to the account to fix this.
Additionally, for some house keeping we should run
Code: Select all
chown nagios:users /usr/local/nagios/libexec/check_wmi_plus*
Also, because the upload wasn't writing the files to the libexec directory, we may have a permissions problem on the directory, lets run
Code: Select all
ls -l /usr/local/nagios/ |grep libexec
it should look like
Code: Select all
drwxrwxr-x 2 nagios nagios 4096 Mar 1 13:13 libexec
Re: WMI Unknown
Posted: Thu Mar 01, 2012 3:28 pm
by cwscribner
I feel stupid for not considering this earlier but the user is in active directory so I've reached out to the client to explore if they've had a problem in that regard.
As far as the check_wmi files, they were root:root but I've changed them per your suggestion. libexec/ has the correct permissions (775)