WMI checks timing out

[mlbsysops]

Hi all,

I'm getting the following error when trying to install monitoring on a Windows 8 machine using the WMI plugin wizzard.

Command Line (v1.49): /usr/local/nagios/libexec/check_wmi_plus.pl -H <IP OF HOST> -u USER -p PASS -m checkeventlog -a Application -o 2 -3 1 --debug
Conf File Dir: /usr/local/nagios/libexec
Loaded Conf File /usr/local/nagios/libexec/check_wmi_plus.conf
Round #1 of 1
QUERY: /usr/bin/wmic --namespace root/cimv2 -U USER%PASS //<IP OF HOST> 'Select Type,LogFile,SourceName,Message,TimeGenerated from Win32_NTLogEvent where Logfile="Application" and EventType<=2 and EventType>0 and TimeGenerated > "20150324163000.00000000"'
UNKNOWN - Plugin Timed out (15 sec)

In my research of this issue I've run across this thread and have verified that the configurations were done correctly however the checks still fail.
http://support.nagios.com/forum/viewtop ... =7&t=31715

The wmiagent user has root permissions on the host (and that the credentials are correct), the windows firewall has been opened up on port 135/5010-5020 and I've confirmed that the windows machine is listening on port 135. Is there anything that I'm missing?

I'm running R2.5 Nagiosxi on a Centos 6.5 host based of the nagiosxi baseline, the machine I'm trying to monitor is running windows 8.

Thanks,

[jdalrymple]

What do you get if you try a telnet test:

Code: Select all

[jrdalrymple@linux ~]$ telnet msserver 135
Trying 172.16.101.14...
Connected to msserver.
Escape character is '^]'.

If that fails, what if you disable your firewall temporarily for testing, being a desktop OS I assume that's an OK test to undertake.

[mlbsysops]

The connection times out. I've also verified that the firewall rules are in place opening up those ports.

[jdalrymple]

Is the service online?

Code: Select all

sc query "Winmgmt"

If it is, and you're certain the firewall isn't the problem, then there must be some network connectivity issue.

[mlbsysops]

Okay thank you, that was my hunch but just making sure I wasn't missing something.

[lmiltchev]

Let us know how it went.

Also, make sure you followed the steps, outlined in our "Nagios XI - Monitoring Windows Using WMI" document:

http://assets.nagios.com/downloads/nagi ... ios-XI.pdf

[mlbsysops]

I will once I get confirmation back from my netadmin team. Also I did run through those steps.

Thanks,

[lmiltchev]

Noted.

[mlbsysops]

I confirmed that the issue was with the networking on that host, it's still being looked at. I have multiple machines I'm working on so I've moved onto another one, followed the steps in the documentation but am running into this error:

Command Line (v1.49): /usr/local/nagios/libexec/check_wmi_plus.pl -H 10.113.111.77 -u USER -p PASS -m checkcpu -w 80 -c 90 --debug
Conf File Dir: /usr/local/nagios/libexec
Loaded Conf File /usr/local/nagios/libexec/check_wmi_plus.conf
Starting Keep State Mode
STATE FILE: /tmp/cwpss_checkcpu_1011311177___.state
Round #1 of 1
QUERY: /usr/bin/wmic --namespace root/cimv2 -U USER%PASS //10.113.111.77 'select PercentProcessorTime,Timestamp_Sys100NS from Win32_PerfRawData_PerfOS_Processor where Name="_Total"'
OUTPUT: [librpc/rpc/dcerpc_util.cdcerpc_pipe_auth_recv()] Failed to bind to uuid 4d9f4ab8-7d1c-11cf-861e-0020af6e7c57 - NT_STATUS_NET_WRITE_FAULT
[librpc/rpc/dcerpc_connect.c:790:dcerpc_pipe_connect_b_recv()] failed NT status (c0000022) in dcerpc_pipe_connect_b_recv
[wmi/wmic.c:196:main()] ERROR: Login to remote object.
NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied

Could not find the CLASS: line - an error occurred
WMI DATA:$VAR1 = undef;
UNKNOWN - The WMI query had problems. You might have your username/password wrong or the user's access level is too low. Wmic error text on the next line.
[librpc/rpc/dcerpc_util.cdcerpc_pipe_auth_recv()] Failed to bind to uuid 4d9f4ab8-7d1c-11cf-861e-0020af6e7c57 - NT_STATUS_NET_WRITE_FAULT
[librpc/rpc/dcerpc_connect.c:790:dcerpc_pipe_connect_b_recv()] failed NT status (c0000022) in dcerpc_pipe_connect_b_recv
[wmi/wmic.c:196:main()] ERROR: Login to remote object.
NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied


Verified that the credentials are correct and the firewall changes were made, so I'm thinking it's a configuration issue.

[jdalrymple]

What type of host?

I've followed the PDF instructions on Win7, 2008R2, 2012 and 2012R2 and never once had any sort of access is denied problem. It always has worked for me when I've followed the instructions carefully.