Convincing company to use XI

[BanditBBS]

I need help!

I need some talking points to mention, that would help sway my company to use XI. We already have an Enterprise License and it setup with Multitech iSMS and distributed environment using gearman. It is working great....for the 10 things being monitored

I used XI in my previous job as well, and had it monitoring all our network devices, linux servers, windows servers and more. So I am very familiar with what it can do. Some of the groups here won't give it the time of day. The continue to investigate other monitoring solutions. While I have no issue doing best or breed(i.e. OEM for Oracle databases), I know XI will monitor AIX well and will do everything they need on the windows servers. Currently they use SCOM for windows, but have no real admin, license costs are going through the roof this coming summer and other issues. They are investigating a plethora of other monitors for windows...help me convince them to use XI. The linux and networking groups are coming on board, just slowly, it is really the windows team giving me the most headache!

Thanks,
Frustrated monitoring admin!

[slansing]

This sounds fairly typical, Nagios and Nagios XI are generally a lot more well known to Linux admins in my experience, and in most cases they cannot point and click next, next, finish in their environments. I will give a little run down on popular monitoring techniques for Windows:

NSClient++: I am going to combine a few things under the NSClient++ umbrella as it is an agent with a wide variety of solutions inside. The most common use for NSClient++ Is NRPE monitoring on windows systems, think of it as a NRPE agent, it gives you all the ease of use that NRPE does on Linux inside of a windows environment. It uses a single plain text based configuration file where you define encryption, ports, allowed IP's, and handlers for your plugins. Nearly every non Linux or Linux Software specific plugin found on our Exchange can be used with NSClient++ via NRPE. NSClient++ Also comes with it's own check form called check_nt which makes calls directly to the system bypassing individual plugins that you place in NSClient's plugin directory. These checks are most commonly found on our Windows monitoring wizards as they require very little tinkering from the Nagios side. NSClient++ Also allows for passive monitoring via NSCA, and is as easily configured as NSCA is on the Linux side. Find the link to this application at the bottom of this post.

SNMP: Nagios XI can also be integrated with Windows SNMP checks and traps. I have a document on trap integration with Windows however that is the only document we have at this time for Windows SNMP. All configuration is done through the Windows SNMP Interface and is piped directly to Nagios.

EventLogs: For monitoring Windows Event Logs most people turn to the NagEventLog agent as it provides a simplistic GUI with a point and click interface that allows you to configure event log monitoring passively.

PerformanceCounters: Performance counters are most easily monitored by pairing them with NRPE checks ran through NSClient++, I have set this up numerous times with customers and they are very pleased with the amount of detail you can go into while integrating Windows Perf Counters with Nagios XI. The latest one I helped set up was the "outgoing bandwidth" from the Windows server. You can get very granular with Perf Counter checks as they are nested pretty deep within the system.

NRDS: If you cannot directly reach the Windows system through your environment, or you simply want another solution you can try out NRDSWin, built in house here in lovely St.Paul it allows for passive checking over HTTP, you can even use it for plugin distribution and it is very lightweight

WMI: As far as WMI checking goes you can integrate with either NSClient or agentlessly..word? With check_wmi_plus. Check_wmi_plus allows you to use the built in configuration for deep WMI system calls or even write your own queries giving it the flexibility a Windows Sys admin needs to track down those "Windows Only" issues they may run into.

NSClient++:

http://assets.nagios.com/downloads/nagi ... _Agent.pdf
http://www.nsclient.org/nscp/wiki/doc/about
http://assets.nagios.com/downloads/nagi ... Checks.pdf
http://assets.nagios.com/downloads/nagi ... Client.pdf

SNMP:

Configured using built in Windows SNMP handling.
See "If You're a Windows User" Section- http://assets.nagios.com/downloads/nagi ... ios_XI.pdf



NagEventLog:

http://exchange.nagios.org/directory/Ad ... og/details

NRDSWin:

http://labs.nagios.com/2012/05/22/nagio ... -nrds_win/

CheckWMIPlus:

http://exchange.nagios.org/directory/Pl ... us/details

[BanditBBS]

Thanks. I'll be adding this to the talking points I already have.

[slansing]

Awesome, let us know if you need more information.

[BanditBBS]

slansing, I have one good question for you.....

With the NRDSWin, is there any way to have it only send check results if there is an issue? Saving bw (Yeah, I know, Nagios is barely a blip on the radar) is a real big concern. Having the checks kicked off on the host is great, no command has to be pushed over the network. Is there any way to have NRDS only send warning and critical messages and basically do nothing with OK or normal?

Thanks,
Jim/Bandit

[BanditBBS]

Here is what I am considering.

Adding a host and all services into XI. Leave the host check as an active check, so a ping it done at whatever interval I want. Make all the service passive checks. Install NRDS on the windows machines that are are out stores or other low BW locations. in the vbs file change:

Code: Select all

postResult = PostData( postXML, nrdp_url )

to only to it if status=warning or critical.

I'm thinking that idea is going to work, can anyone point out something I didn't think of? If my idea is good, I may have just shutup the windows admins

[slansing]

I will have to check with it's developer on that one, I do know of course that it will send warnings and criticals as they happen from the host, and I know that when they drop below the warning or critical thresholds they will return to an Ok state. I'll get back to you if there would be some way to remove that, though you will have constant warnings or criticals then and would have to modify your alerting to stop the annoyance.

[BanditBBS]

I will have to check with it's developer on that one, I do know of course that it will send warnings and criticals as they happen from the host, and I know that when they drop below the warning or critical thresholds they will return to an Ok state. I'll get back to you if there would be some way to remove that, though you will have constant warnings or criticals then and would have to modify your alerting to stop the annoyance.

Yeah, they would have to submit a passive check result to set it back to OK state. But if they want this functionality, then they would just have to add that to the list of procedures.

[slansing]

It should already switch back to an Ok state once it changes on the server and triggers that passive result, sorry I did not see your second reply after posting my answer haha.

[BanditBBS]

It should already switch back to an Ok state once it changes on the server and triggers that passive result, sorry I did not see your second reply after posting my answer haha.

but as I said, I am going to modify the vbs to not send OK or Normal results. Some of our stores have very little bandwidth and they don't want anything coming over the wire that isn't needed. So what I am going to do is this:

Modify vbs to only send Critical and Warning.
Instruct Windows admins to acknowledge issues and when fixed, submit a passive result resetting it back to OK.

They want the services checked every 5 minutes, but they don't want OK and Normals sent over the wire for every service every 5 minutes.