Monitoring Windows Remotely via WMI with Icinga#

Compiling from Source#

1. Download the Source Code:

   Visit: http://edcint.co.nz/checkwmiplus/download/zenoss-wmi-source-v1-3-14/

   Save the archive in a directory such as /usr/local/src/.

2. Extract and Build:

   1
   cd /usr/local/src/
   2
   tar -xzf zenoss-wmi-source-v1-3-14.tar.gz
   3
   cd Samba/source
   4
   ./autogen.sh
   5
   ./configure
   6
   make
   7
   # Optionally run "make install" if needed
   

3. Troubleshooting Compilation Issues:

   If you encounter an error like:

   1
   Can't use 'defined(@array)' (Maybe you should just omit the defined()?) at ./pidl/pidl line 583.
   

   Edit the indicated line to comment out the use of defined(), then re-run make.

   You might also see a message such as:

   1
   make: *** No rule to make target `wmi/wmiq.o', needed by `bin/wmiq'.  Stop.
   

   This can be safely ignored.

   If further errors occur, try adjusting compiler directives, for example:

   1
   make "CPP=gcc -E -ffreestanding"
   

4. Test the Installation:

   Run a basic WMIC query:

   1
   wmic -U [domain/]adminuser%password //host_or_IP "select TotalPhysicalMemory from Win32_ComputerSystem"
   

   Expected output:

   1
   CLASS: Win32_ComputerSystem
   2
   Name|TotalPhysicalMemory
   3
   hostname|412180664
   

Pre-packaged Binaries#

If compiling is problematic, you may consider using available RPMs or DEBs. Examples include:

• RPM: wmi-1.3.14-4.el7.art.x86_64.rpm
• DEB:
  • Debian: Inverse.ca Debian packages
  • Ubuntu: Inverse.ca Ubuntu packages

Installation Steps#

1. Install Required Perl Modules:

   For example, to install a module from CPAN:

   1
   cpan install Number::Format
   

   If you require a specific version, provide the full module distribution filename:

   1
   cpan SHLOMIF/Config-IniFiles-2.58.tar.gz
   

2. Download and Unpack check_wmi_plus:

   Obtain the latest release from the plugin Releases page and unpack it in a directory accessible by Icinga (ideally under your custom plugin directory).

3. Adjust the Plugin Configuration:

   Edit the main Perl script check_wmi_plus.pl and update:

   • Location of utils.pm: Adjust the path if it is not in /usr/lib/nagios/plugins.
   • Base Directory: Set the $base_dir variable to the installation directory of check_wmi_plus.pl.
   • WMIC Binary Path: Update $wmic_command with the full path to your WMIC executable.
   • Optional Settings: Configure $wmi_ini_dir (path for INI files) and $tmp_dir (for temporary files, default /tmp/).

Authentication File#

Create an authentication file (e.g., /etc/icinga2/wmi.auth) with the following content:

1
username=myusername
2
password=mypassword
3
domain=mydomain

Set proper permissions to secure the file:

1
chown root:root /etc/icinga2/wmi.auth
2
chmod 0400 /etc/icinga2/wmi.auth

Defining the CheckCommand#

Add the following command definition (e.g., in your commands.conf file):

1
object CheckCommand "check_wmi" {
2
    import "plugin-check-command"
3
    command = [ PluginDir + "/check_wmi_plus.pl" ]
4
    arguments = {
5
        "-H" = {
6
            value = "$host.address$"
7
            description = "Name or IP address of host to monitor"
8
        }
9
        "-A" = {
10
            value = "$wmi_authfile_path$"
11
            description = "Authentication file path"
12
        }
13
        "-m" = {
14
            value = "$check_mode$"
15
            description = "WMI mode to use for specific check"
16
        }
17
        "-s" = {
18
            value = "$wmi_submode$"
19
            description = "Optional WMI submode"
20
        }
21
        "-a" = {
22
            value = "$wmi_arg1$"
23
            description = "First argument to WMI"
24
        }
25
        "-o" = {
26
            value = "$wmi_arg2$"
27
            description = "Second argument to WMI"
28
        }
29
        "-3" = {
30
            value = "$wmi_arg3$"
31
            description = "Third argument to WMI"
32
        }
33
        "-4" = {
34
            value = "$wmi_arg4$"
35
            description = "Fourth argument to WMI"
36
        }
37
        "-y" = {
38
            value = "$wmi_delay$"
39
            description = "Delay between consecutive WMI queries"
40
        }
41
        "-w" = {
42
            value = "$wmi_warn$"
43
            description = "Warning threshold"
44
        }
45
        "-c" = {
46
            value = "$wmi_crit$"
47
            description = "Critical threshold"
48
        }
49
        "--nodatamode" = {
50
            set_if = "$wmi_nodatamode$"
51
        }
52
        "--inidir" = {
53
            value = "$wmi_inidir$"
54
            description = "Path to the INI directory"
55
        }
56
    }
57

58
    vars.wmi_authfile_path = "/etc/icinga2/wmi.auth"
59
    vars.wmi_inidir = "/opt/icinga/plugins/check_wmi_plus.d"
60
    vars.wmi_nodatamode = false
61
}

Service Templates and Apply Rules#

Create a service template specifically for WMI-based checks (for example, in templates.conf):

1
template Service "wmi-service" {
2
    import "generic-service"
3
    check_command = "check_wmi"
4
    check_interval = 1m
5
    retry_interval = 1m
6
}

Then define service apply rules in a file (e.g., wmi-services.conf). Below are some sample rules:

1
apply Service "Free Disk Space" {
2
    import "generic-service"
3
    vars.check_mode = "checkvolsize"
4
    vars.wmi_arg1 = "."
5
    vars.wmi_arg2 = "1"
6
    vars.wmi_arg3 = "1"
7
    vars.wmi_warn = "88"
8
    vars.wmi_crit = "92"
9
    check_command = "check_wmi"
10
    assign where host.vars.os == "Windows"
11
    ignore where host.vars.disable_wmi
12
}

1
apply Service "CPU Utilization" {
2
    import "generic-service"
3
    vars.check_mode = "checkeachcpu"
4
    vars.wmi_warn = "95"
5
    vars.wmi_crit = "99"
6
    vars.wmi_timeout = "160"
7
    check_command = "check_wmi"
8
    assign where host.vars.os == "Windows" && host.vars.cpu_utilz
9
    ignore where host.vars.disable_wmi
10
}

1
apply Service "IIS: Connections" {
2
    import "generic-service"
3
    vars.check_mode = "checkiis"
4
    vars.wmi_submode = "connections"
5
    vars.wmi_arg1 = "_Total"
6
    vars.wmi_timeout = "190"
7
    check_command = "check_wmi"
8
    assign where host.vars.iis_server
9
    ignore where host.vars.disable_wmi
10
}

1
apply Service "MSSQL: General Statistics" {
2
    import "generic-service"
3
    vars.check_mode = "checksql"
4
    vars.wmi_submode = "general"
5
    if (host.vars.mssql_edition == "Express") {
6
        vars.wmi_arg1 = "MSSQLSQLEXPRESS_MSSQLSQLEXPRESS"
7
    }
8
    check_command = "check_wmi"
9
    assign where host.vars.mssql_server
10
    ignore where host.vars.disable_wmi
11
}

1
apply Service "Event Log: Application" {
2
    import "generic-service"
3
    vars.check_mode = "checkeventlog"
4
    vars.wmi_arg1 = "application"
5
    vars.wmi_arg2 = "2"
6
    vars.wmi_arg3 = "1"
7
    vars.wmi_warn = "50"
8
    vars.wmi_crit = "100"
9
    check_command = "check_wmi"
10
    assign where host.vars.os == "Windows" && host.vars.event_log_application
11
    ignore where host.vars.disable_wmi
12
}

Conclusion#

While using WMI via the check_wmi_plus plugin may not be the most future-proof solution (especially with enhanced PowerShell and SSH support in newer Windows versions), it remains a robust method for monitoring legacy environments. This guide should help you set up both the Linux side (WMIC and plugin) and the necessary Windows configurations, as well as integrate the checks into your Icinga setup.

FAQ#

Q: What types of services can I monitor using WMI? A: You can monitor uptime, disk usage, CPU load, Active Directory, RDP sessions, IIS, MSSQL, Event Logs, and process statuses.

Q: Can I create my own custom scripts? A: Yes, you can. However, many find that PowerShell (or SSH for Windows Server 2019 and later) offers a more versatile, future-proof approach.

Q: Need help with configuration files? A: The Icinga community forum is an excellent resource for support and discussion.

This document provides a comprehensive overview of setting up and using remote Windows monitoring through WMI with Icinga. Adapt the instructions as necessary for your infrastructure and security policies.