Nagios Support Forum

I'm getting WMI errors on only one server.

==> /usr/local/nagiosxi/var/cmdsubsys.log <==
COMMAND DATA: a:4:{s:9:"host_name";s:23:"usvaplmcadwqa4.bose.com";s:12:"service_name";s:19:"Drive C: Disk Usage";s:3:"cmd";i:54;s:10:"start_time";i:1516645706;}
PHP Warning: date(): It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected the timezone 'UTC' for now, but please set date.timezone to select your timezone. in /usr/local/nagiosxi/html/includes/utils-auditlog.inc.php on line 95
CORE CMD: SCHEDULE_FORCED_SVC_CHECK;usvaplmcadwqa4.bose.com;Drive C: Disk Usage;1516645706

When we run the command manually it works PFA.

@bosecorp, Please check your timezone settings in etc/php.ini
Here's what I have: Also, can you show us the service check output from the Web Interface/Service overview?

I just made that change. Now i do not see that error in the log but still the service check fails.
After performing force check i see below logs

==> /usr/local/nagiosxi/var/cmdsubsys.log <==
COMMAND DATA: a:4:{s:9:"host_name";s:23:"usvaplmcadwqa4.bose.com";s:12:"service_name";s:19:"Drive C: Disk Usage";s:3:"cmd";i:54;s:10:"start_time";i:1516723702;}
CORE CMD: SCHEDULE_FORCED_SVC_CHECK;usvaplmcadwqa4.bose.com;Drive C: Disk Usage;1516723702

PFA

@bosecorp, Looks like someone who had a similar problem has found a solution: https://support.nagios.com/forum/viewto ... 11&p=18641
Otherwise, please include the command definition and the service check definition from this server, and also from one of the servers where this service check works as it should so that we could compare.

Attached is the .cfg for the service check. Same check works fine with other hosts.
Already tried adding the nagios user to administrator group, WMI checks are allowed on firewall.
Restarted Windows WMI service, but no luck.

Below is the logs i get when i try to do a force check
==> /usr/local/nagiosxi/var/cmdsubsys.log <==

PROCESSED 0 COMMANDS
COMMAND DATA: a:4:{s:9:"host_name";s:23:"usvaplmcadwqa4.bose.com";s:12:"service_name";s:9:"CPU Usage";s:3:"cmd";i:54;s:10:"start_time";i:1516820705;}
CORE CMD: SCHEDULE_FORCED_SVC_CHECK;usvaplmcadwqa4.bose.com;CPU Usage;1516820705
COMMAND DATA: a:4:{s:9:"host_name";s:23:"usvaplmcadwqa4.bose.com";s:12:"service_name";s:12:"Memory Usage";s:3:"cmd";i:54;s:10:"start_time";i:1516820712;}
CORE CMD: SCHEDULE_FORCED_SVC_CHECK;usvaplmcadwqa4.bose.com;Memory Usage;1516820712

UNKNOWN - The WMI query had problems. You might have your username/password wrong or the user's access level is too low. Wmic error text on the next line.
[librpc/rpc/dcerpc_util.cdcerpc_pipe_auth_recv()] Failed to bind to uuid 4d9f4ab8-7d1c-11cf-861e-0020af6e7c57 - NT_STATUS_NET_WRITE_FAULT
[librpc/rpc/dcerpc_connect.c:790:dcerpc_pipe_connect_b_recv()] failed NT status (c0000022) in dcerpc_pipe_connect_b_recv
[wmi/wmic.c:196:main()] ERROR: Login to remote object.
NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied

@bosecorp, Do the other servers use the same username? us_nt_bose/svcnagios I wonder if the '/' sign could be causing some kind of syntax related problems. Can you try to take out the -t 60!!!! part to see if it fixes the problem? You'd need to do it in Core Configurations Manager, not in the .cfg file directly.
Actually, before you do all that please update the plugin. Navigate to the Admin menu in GUI, then click on Manage Config Wizards in the left column, click on Check For Updates and then go down the page till you see Windows WMI wizard, click on 'install the update". 2.0.8 is the latest version. Then force immediate check in the service menu to see if the problem has gotten resolved.

Its says the plugin is up to date (2.0.7), the plugin works for all other servers. Secondly i'm not sure if upgrading the plugin is going to fix this issue.

I'm not sure if upgrading the plugin is going to fix this issue.

@bosecorp, Sometimes it does when they add patches. Can you change the service definition to the one below? I added an escape character between us_nt_bose/\svcnagios. You'd probably need to modify that in Core COnfigurations Manager, and then apply the configuration.