Monitor Windows Service stats from Linux

[mrossTTX]

i have thold working to monitor a service.. HOWEVER.. it wont work if the service uses svchost.exe and it's many switches.

[TheWitness]

One of the reasons I despise certain OS'. Security through obscurity. What about WMI? Can you get better information from WMI?

[TheWitness]

You can run WMI queries from Cacti and store the table data in Cacti.

[mrossTTX]

You can run WMI queries from Cacti and store the table data in Cacti.

im trying to do that.. figured I'd give it a shot..
im using a WMI query tool to try to build the query, but in cacti, it tells me the WMI query doesnt exist
attached is the query screen shot in cacti, and a screen shot of the wmi explorer tool I am using.
Trying to get cacti to see the state is either running or not running, but cacti keeps telling me , when i look at the server im trying to query, "WMI Query Does Not Exist".
I know I am probably doing something wrong in the WMI query window in cacti.. but not sure what.

[TheWitness]

Take a look at the WMI Plugin. I've not touched in a while. It would be nicer to be able to run a SQL query against a local database vs. all the latency across the WAN to deal with.

[mrossTTX]

Take a look at the WMI Plugin. I've not touched in a while. It would be nicer to be able to run a SQL query against a local database vs. all the latency across the WAN to deal with.

thats the plug in i am using..

[TheWitness]

Example screen shot. It's pretty fast. I don't monitor big Windows farms, so I lost interest in completing this, or making it more tightly integrated into Cacti. But you can write a script server query that does a:

Code: Select all

select blah from blah blah where hostname='blah' and metric='blah';

[mrossTTX]

yup.. i did that.. my query is
ROOT\cimv2


SELECT state FROM Win32_Service WHERE Name='Spooler'

[TheWitness]

Take a look at the WMI Plugin. I've not touched in a while. It would be nicer to be able to run a SQL query against a local database vs. all the latency across the WAN to deal with.

thats the plug in i am using..

Cool. Here is your table of interest... I'm pretty sure anyway.

Code: Select all

MariaDB [cacti]> desc host_wmi_cache;
+--------------+-----------------------+------+-----+---------------------+-------------------------------+
| Field        | Type                  | Null | Key | Default             | Extra                         |
+--------------+-----------------------+------+-----+---------------------+-------------------------------+
| host_id      | mediumint(8) unsigned | NO   | PRI | 0                   |                               |
| wmi_query_id | mediumint(8) unsigned | NO   | PRI | 0                   |                               |
| field_name   | varchar(50)           | NO   | PRI |                     |                               |
| field_value  | varchar(4086)         | YES  | MUL |                     |                               |
| wmi_index    | varchar(255)          | NO   | PRI |                     |                               |
| present      | tinyint(4)            | NO   | MUL | 1                   |                               |
| last_updated | timestamp             | NO   | MUL | current_timestamp() | on update current_timestamp() |
+--------------+-----------------------+------+-----+---------------------+-------------------------------+
7 rows in set (0.001 sec)

[TheWitness]

So, you graph that status as 0/1 values 'Stopped vs. Running' and then alert on 0, and send you command to start again.

[mrossTTX]

FYI.. in Utilities , there is the WMI query tool.. assuming thats there to help you figure out the right syntax..
im running a simple one in there and getting nothing back, and in the cacti log i see

2023-01-03 12:13:40 - CMDPHP PHP ERROR Backtrace: (CactiShutdownHandler())
2023-01-03 12:13:40 - ERROR PHP ERROR: Uncaught com_exception: Failed to create COM object `WbemScripting.SWwebLocator': Invalid syntax in C:\inetpub\wwwroot\cacti\plugins\wmi\wmi_tools.php:600 Stack trace: #0 C:\inetpub\wwwroot\cacti\plugins\wmi\wmi_tools.php(600): com->com() #1 C:\inetpub\wwwroot\cacti\plugins\wmi\wmi_tools.php(36): walk_host() #2 {main} thrown in file: C:\inetpub\wwwroot\cacti\plugins\wmi\wmi_tools.php on line: 600

my query there is namespace root\\CIMV2 , command SELECT * FROM Win32_Service

[TheWitness]

Okay, I never tested from a Windows server to a Windows server. So, I'm not surprised this is not working. Should work from Linux to Windows though.

If you know anything about PHP you might be able to do some debugging to fix this. If you do, a Pull request would be appreciated at the GitHub location.

It's likely an escaping issue associated the the darn backslashes.

[mrossTTX]

ill try but im not that great at programing... lol

[TheWitness]

Just look at the lines in the error. My guess is that the back slashes in the namespace are causing some issues. Double them up maybe.

[TheWitness]

Hmm, looks even more fundamental than that. Spending 5 minutes on this.