Passive Windows monitoring advice!

[BanditBBS]

Ok, I'm finally getting permission here to install agents on some Windows servers here for testing and I am just trying to figure out the best method to get done what I want done.

Here is some information regarding my environment:

• 1000+ Windows servers
• Over half in the same network as my main XI server
• remaining ones are behind different firewalls
• Security is very tight about opening ports(retail PCI evironment)
• I do have mod_gearman workers behind the firewalls
• Scheduled tasks(default NRDS_Win method) are not preferred here

Now for my desires:

• Prefer passive
• Prefer as much automation as possible (i.e. NRDS Configs in XI)
• All windows servers will by default have C:\ checked and then [ALL other drives] in one other check(Currently like this in my WMI configs)
• All servers will check memory, swap and CPU

So now, couple one-off examples of special circumstances:

• Server-1 will need to monitor some specific services. How would I have it doing that? If using NCPA, then I manually have to modify that server's ncpa config to monitor those services, correct?
• Server-2 will need to run a specific executable plugin that monitors a log file. I can't use the passive checks in NCPA(because everything has to be API, right?), so this server would need NRDS and I could then use NRDS in XI to manage that config, but can I get NCPA to run the NRDS so I don't have to use scheduled tasks?

Ugh....Seriously, how would any suggest I handle my monitoring here for Windows while hopefully getting as many of my desires as possible. feel free to say I'm thinking of something completely wrong, very open to criticism.

Thanks!

EDIT: Updated a typo and added some text

[scottwilkerson]

Server-1 will need to monitor some specific services. How would I have it doing that? If using NCPA, then I manually have to modify that server's ncps config to monitor those services, correct?

As of now, this is correct if the checks are going to be passive.

Server-2 will need to run a specific executable plugin that monitors a log file. I can't use the passive checks in NCPA, so this server would need NRDS and I could then use NRDS in XI to manage that config, but can I get NCPA to run the NRDS so I don't have to use scheduled tasks?

Unfortunately, NRDS requires scheduled tasks to kick off the checks.

Now I'm going to blow your mind with a possible work around...

Install both agents, with the NCPA agent just kicking off a plugin that calls the same thing that the scheduled task in NRDS normally calls. this should kick off the chain of events that will update the NRDS configuration, and send it's results back to the XI server.

I know this is somewhat hackish, but it is a workaround for not being able to use Scheduled Tasks"

[BanditBBS]

Now I'm going to blow your mind with a possible work around...

Install both agents, with the NCPA agent just kicking off a plugin that calls the same thing that the scheduled task in NRDS normally calls. this should kick off the chain of events that will update the NRDS configuration, and send it's results back to the XI server.

I know this is somewhat hackish, but it is a workaround for not being able to use Scheduled Tasks"

LOL - That would work for me. I was under the impression though(from wording in the NCPA docs) that passive checks in NCPA have to be API related

Code: Select all

Note
While the NCPA HTTP server does not have to active in order for the passive agent to work, the <instructions> must be an API address.

If that is not the case, care to tell me how?

EDIT: Also, both NCPA and NRDS would be using the same URL so that would only need one hole in firewall...or am I thinking wrong here?

[scottwilkerson]

Create a new plugin, we'll call it kickNRDS.vbs with the following contents

Code: Select all

Dim objShell
Set objShell = Wscript.CreateObject("WScript.Shell")

objShell.Run "C:\PROGRA~1\Nagios\NRDS_Win\NRDS_Win.vbs" 

' Using Set is mandatory
Set objShell = Nothing

save it in

Code: Select all

C:\Program Files (x86)\Nagios\NCPA\plugins

Then in you ncpa.cfg enter the following

Code: Select all

[passive]
uid = root
handlers = nrdp


[passive checks]
%HOSTNAME%|kickNRDS = /api/agent/plugin/kickNRDS.vbs/

Then restart the NCPA Passive listener

I am not a .vbs guru, but I believe this should work

[BanditBBS]

seems to be a bug in NCPA

Code: Select all

Input Error: Can not find script file "C:\windows\system32\plugins\kickNRDS.vbs".

I put it in exactly as shown and that's the error I see in nagios.

[BanditBBS]

I know why it is doing it, because NCPA calls cscript which defaults to that folder, so I need to maybe change the directive in the ncpa.cfg....not sure, trying a million things right now.

[BanditBBS]

OMG - You can't troubleshoot something that works once and then doesn't after no changes! LOL

Capture.JPG

Every time it went "OK" was after I restart the passive service. It runs once OK and kicks off NRDS but the second and rest of times it runs it gets the error until service is restarted!

[lmiltchev]

Did you try copying the "kickNRDS.vbs" to the "c:\progam files (x86)\nagios\ncpa\plugins" directory? You haven't modified the following entries, have you?

Code: Select all

[plugin directives]
plugin_path = plugins\

[BanditBBS]

Ludmil, that is where the script is and the setting plugin folder setting is fine.

As stated, it is really really weird, it works fine the first time after a service restart but until restarted it fails the 2nd and all further times. It for some reason gets the error in the image attached earlier.

[scottwilkerson]

Well, at least I said I wasn't a vbs expert A look at some other example made me think what I gave you as an example wouldn't work...

Lets change the kickNRDS.vbs to this

Code: Select all

Dim objShell
Set objShell = Wscript.CreateObject("WScript.Shell")

objShell.Run("""C:\PROGRA~1\Nagios\NRDS_Win\NRDS_Win.vbs""")

' Using Set is mandatory
Set objShell = Nothing