OSMC 2010 | Clientless Windows Monitoring über WMI mit Samba4 by Thomas Sesselmann

06.10.2010
Clientless Windows Monitoring
über WMI mit Samba4 (wmic)
ThomasSesselmann
ITCF

Seite 206.10.2010| Thomas Sesselmann ITCF
Ziel:Clientless Windows-Monitoring
• Problem laufende Infrastruktur/Server
 Zusätzlicher Client/Software ist ein Eingriff
 Schlechte Erfahrung mit anderen Agenten
 neue Probleme  letzte Änderung Schuld
• Vorteile:
• Keine zusätzliche Software notwendig
• Muss nicht jedes System „anfassen“
• Standardmethoden nutzen
 WMI

Windows Management Instrumentation
• Erweiterung von CIM (Common Information Model)
• Implementierungvon WBEM (Web Based Enterprise Mangement)
• Kernfunktion von Windows (nicht ohne lauffähig)
• Zugriff zu Einstellungen und aktuellen Werten
• Inventardaten von Hardware + Software + BIOS
• Computer neu starten
• Ereignisprotokolle
• PerformanceMonitor Daten
• Registry
• Programme, Prozesse, Dienste und Warteschlangen
• Ordner und Dateien des Dateisystems
• …

WMI Query Language (WQL)
• Zugriff auf WMI
• SQL ähnlicher Syntax
• nur Select unterstützt (lesen)
SELECT Caption,BuildNumber
FROM Win32_OperatingSystem
Microsoft(R) Windows(R) Server 2003,
Standard Edition|3790

Wege zu WMI
• NSClient++ (CheckWMI)
• OpenPegasus (WBEM-WMI-Gateway)
• HP WMI Mapper Tool (WBEM-WMI-Gateway)
• WMI Explorer
• .NET
• Samba4  wmic (WMI-Client)

WMI-Mapper vs. WMI-Client
• Extra Server (Windows) mit HTTP Abfragen
• Skalierbarkeit
• Abhänigkeit von WBEM-Server

Zugriff zu WMI
• CIFS/Samba Ports
• User mit Recht WMI lesen zu können
• http://forums.cacti.net/about30438-0-asc-15.html
• User zur Performance Monitor/Logging Group hinzufügen
• keine weiteren Admin-Rechte

WMI Explorer

WMI-Client kompilieren
• Ubuntu Paket (http://packages.ubuntu.com/hardy/python/wmi-client)
• kompilieren von Samba:
git clone git://git.samba.org/samba.git samba
cd samba/source4/lib/wmi/tools
make wmic # fails
cd ../../../..
git checkout -b v4-0-test origin/v4-0-test
cd source4
./autogen.sh
./configure
make #fails => vi main.mk #WMI fails :(

WMI-Client kompilieren
• Ubuntu Paket (http://packages.ubuntu.com/hardy/python/wmi-client)
• kompilieren von Zenoss :
ver=1.3.13
wget
http://dev.zenoss.org/svn/trunk/inst/externallibs/
wmi-$ver.tar.bz2
tar -xjf wmi-$ver.tar.bz2
cd wmi-$ver
export ZENHOME=/tmp/xx
make
find /tmp/xx/

WMI-Client testen
• Abfrage Tests mit Domain User
• Neuere wmic-Version mit ‚--delimiter‘-Option
$ wmic --help # usage
$ wmic -U AD/nagios%xxx //win01
"select * from Win32_ComputerSystem"
…
$ wmic –U AD/nagios%xxx //win01
"select dnshostname,domain
from Win32_ComputerSystem"
CLASS: Win32_ComputerSystem
DNSHostName|Domain|Name
win01|ad.dkfz-heidelberg.de|WIN01

Check-Skript (check_wmi.pl)
Usage: ./check_wmi.pl [Options]* [check]
Options: (-h, -v, -d, -w, -c, -a, -t, --tmpdir)
-U, --user=<s> User with WMI-Read rights
-P, --password=<s> Password for User
-H, --host=<s> Host to query (Default: '')
--wmic=<s> wmic-command (Default: '/usr/…/wmic')
--delimiter=<s> delimiter for wmic (Default: '-xXx-')
Check:
CPULOAD - Gets (total) CPU load
DISKFREE - Free disk space
MEMFREE - Gets memory and pagefile usage
PROCS - Get number of running processes
RESGROUP - Gets MSCluster (resource group) status
SERVICE - Check service state
SYSTEM - Gets system name and uptime
USERS - Get number of connected users
VOLFREE - Free disk space (check volumes)
Hint:
Try to use 'check_wmi.pl -h [check]' to see the defaults for the
check!

Beispiel check_wmi.pl system
$ check_wmi.pl -H win01 system
OK - System: win01, Microsoft(R) Windows(R)
Server 2003, Standard Edition, Service Pack 2
(Version: 5.2.3790), Installed 2003.11.06 (6
years 334 days ago), Up 12 days RAM: 3.7GB,
Pagefile: 1.8GB|uptime=1076058s

Beispiel check_wmi.pl system --verbose
$ check_wmi.pl -H win01 system -v
Run Query 'SELECT Caption,CSDVersion,CSName,Version,InstallDate,
LastBootUpTime,LocalDateTime,Status,TotalVirtualMemorySize,
TotalVisibleMemorySize FROM Win32_OperatingSystem'
1>> Class: Win32_OperatingSystem
2>> Header
3>>
0 Caption = Microsoft(R) Windows(R) Server 2003, Standard Edition
1 CSDVersion = Service Pack 2
2 CSName = WIN01
3 InstallDate = 20031106113716.000000+060
4 LastBootUpTime = 20100922051838.125000+120
5 LocalDateTime = 20101004161259.191000+120
6 Name = Microsoft Windows Server 2003 R2 Standard
Edition|C:WINDOWS|DeviceHarddisk0Partition1
7 Status = OK
8 TotalVirtualMemorySize = 5869088
9 TotalVisibleMemorySize = 3931584
10 Version = 5.2.3790
OK - System: win01, Microsoft(R) Windows(R) Server 2003, Standard Edition,
Service Pack 2 (Version: 5.2.3790), Installed 2003.11.06 (6 years 334 days ago),
Up 12 days RAM: 3.7GB, Pagefile: ...1.8GB|uptime=1076058s

PNP4Nagios (OSMC2009)
• http://pnp4nagios.org
• Verlaufsgrafiken gut für
• Erkennung von Trends
• Erkennung von Mustern
• Historie
 Problem neu?

check_wmi.pl … SYSTEM
• Class: Win32_OperatingSystem
• Attr: InstallDate, LastBootUpTime, Caption
OK - System: INFO, Microsoft(R) Windows(R) Server 2003,
Standard Edition, Service Pack 2 (Version: 5.2.3790),
Installed 2006.02.06 (4 years 241 days ago), Up 20 days
RAM: 2.0GB, Pagefile: 1.9GB|uptime=1752789s

check_wmi.pl … PROCS
• Attr: NumberOfProcesses
OK - PROCS: 45 running Processes|procs=45;200;500;0;

check_wmi.pl …USERS
• Attr: NumberOfUsers
OK - USERS: 7 connected user sessions
|users=7;200;500;0;

check_wmi.pl … DISKFREE/VOLFREE
• Class: Win32_LogicalDisk / Win32_Volume
• Attr: Caption, FreeSpace, DirtyBitSet
OK - FREE Diskspace: C: 12/30GB (41.6%), D: 24/70GB
(34.4%)|C=13414371840B;3221838899;1610919449;0;3221
8388992 D=25857097728B;7516260761;3758130380;0;
75162607616

check_wmi.pl … DISKFREE/VOLFREE
• Exchange Backup erfolgreich?
• Log Volumes nicht geleert

check_wmi.pl … MEMFREE
• Class: Win32_PerfRawData_PerfOS_Memory
• Attr: AvailableBytes, CacheBytes, CacheFaultsPersec, CommittedBytes,
PagesPersec, PoolNonpagedBytes, PoolPagedBytes
• Attr: FreeSpaceInPagingFiles, FreeVirtualMemory, TotalVirtualMemorySize,
TotalVisibleMemorySize
OK - MemFree: 0.5GB/2.0GB free (Virtual Memory:
2.4GB/3.9GB free)
|memFree=588996608B;0;0;0;2146861056
memCache=267448320B cacheFaults=524952503c
committed=1605709824B poolNonPaged=19288064B
poolPaged=65212416B pages=22006011c
virtMemFree=2533376000B;;;0;4139208704
freePageFile=1434091520B

check_wmi.pl … CPULOAD
• Class: Win32_PerfRawData_PerfOS_Processor
• Attr: PercentIdleTime, PercentInterruptTime, PercentPrivilegedTime,
PercentUserTime, Timestamp_Sys100NS, Frequency_Sys100NS
• Problem Mittelwertbestimmung
• Speicherung der alten Werte in Datei
OK - CPU-Load: 5.4% 5min AVG (300s), 5.0% 15min AVG
(914s) (ProcessorQueue=3)
|idleTime=162376042c;10;5;0;100
interruptTime=215851c;;;0;100
privilegedTime=7538467c;;;0;100
userTime=5685634c;;;0;100 processorQueueLength=3

check_wmi.pl … CPULOAD

check_wmi.pl … SERVICES
• Class: Win32_Service
• Attr: Name, Started, StartMode, State, Status
WARNING - SRV: 58 Running, 54 Stopped (State NOT
OK: Stopped=UPSMan)|Running=58 Stopped=54 Other=0
$ check_wmi.pl -H win1 service -w "symcscan ^kdc"
OK - SRV: 1 Running, 1 Stopped|Running=1 Stopped=1
Other=0

check_wmi.pl … RESGROUP (MS-Cluster)
• Namespace: root/MSCluster
• Class: MSCluster_ResourceGroup
• Attr: Name, State
• Class: MSCluster_Resource
• Attr: Name, PersistentState,State,Type
• Where: State != 2
OK - MSCluster ResGroup: 'dkfzex01' is Online,
'Cluster Group' is Online|dkfzex01=0
Cluster_Group=0

Einbinden in Nagios
• Wie immer: command definition, …

Einbinden in Nagios: check_multi
• http://my-plugin.de/wiki/projects/check_multi
command[wmi_sys:wmi_sys] = check_wmi.pl -H $HOSTADDRESS$ system -t 20
command[wmi_cpu:wmi_cpu] = check_wmi.pl-H $HOSTADDRESS$cpuload $ARGSRV$ -t 20
command[wmi_mem:wmi_mem] = check_wmi.pl-H $HOSTADDRESS$memfree $ARGMEM$ -t 20
command[wmi_proc:wmi_proc] = check_wmi.pl-H $HOSTADDRESS$procs $ARGPROCS$ -t 20
command[wmi_users:wmi_users] = check_wmi.pl-H $HOSTADDRESS$ users $ARGUSERS$ -t 20

Planung / Ausblick
• weitere (spezielle) Abfragen für
• Disk-IO
• Network Usage
• Active Directory
• MSSQL
• Exchange
• Terminalserver
• Citrix-Counter
• Eventlogs

DiskIO
• CLASS: Win32_PerfRawData_PerfDisk_PhysicalDisk
• Attr:
• CurrentDiskQueueLength
• DiskReadBytesPersec
• DiskReadsPersec
• DiskWriteBytesPersec
• DiskWritesPersec
• Name
• SplitIOPerSec
• PercentDiskReadTime
• PercentIdleTime
• …

Network
• CLASS: Win32_PerfRawData_Tcpip_NetworkInterface
• Attr:
• BytesReceivedPersec
• BytesSentPersec
• CurrentBandwidth
• Name
• OutputQueueLength
• PacketsOutboundDiscarded
• PacketsOutboundErrors
• PacketsPersec
• …

Active Directory
• Namespace: root/MicrosoftActiveDirectory
• Class: MSAD_ReplNeighbor
 Wer bekommt Daten
 richtig synchronisiert?
• Class: MSAD_DomainController
 allgemeine Domaininformationen?

Exchange
• Viele PerfData-Klassen ~20
• Win32_PerfRawData_ESE_MSExchangeDatabase
• Win32_PerfRawData_MSExchangeIS_MSExchangeIS
• Win32_PerfRawData_MSExchangeIS_MSExchangeISMailbox
• Win32_PerfRawData_MSExchangeIS_MSExchangeISClient
• Win32_PerfRawData_MSExchangeADAcceess *

MSSQL
• Viele viele PerfData-Klassen > 40
• Win32_PerfFormattedData _MSSQLSERVER_*
• _SQLServerTransactions
• _SQLServerLocks
• _SQLServerDatabases
• …

Terminalserver
• CLASS: Win32_TerminalService
• DisconnectedSessions
• Started
• TotalSessions
• CLASS: Win32_PerfRawData_TermService_TerminalServices
• ActiveSessions
• InactiveSessions
• TotalSessions
• CLASS: Win32_PerfRawData_TermService_TerminalServicesSession
• PercentProcessorTime
• ThreadCount
• TotalBytes
• TotalErrors
• …

Citrix-Terminalserver
• CLASS: Win32_PerfFormattedData_CitrixICA_ICASession
• Attr:
• LatencySessionAverage
• Name

Eventlogs
• Problem sehr viele Einträge  Timeout
• Filter notwendig
• Besser auslesen und in zentrale DB speichern
 besser neues Skript
SELECT *
FROM Win32_NTLogEvent
WHERE Type="Error"
AND LogFile="System" AND
TimeGenerated > "20100629000000.000000+120"

Links
• http://de.wikipedia.org/wiki/Windows_Management_Instrumentation
• http://forums.cacti.net/viewtopic.php?p=148110
• http://jkern.posterous.com/compiling-wmic-for-linux-without-installing-s
• http://dev.zenoss.org/svn/trunk/inst/externallibs/
• http://www.openpegasus.org/
• http://msdn.microsoft.com/en-us/library/aa394582(v=VS.85).aspx
• http://www.ks-soft.net/hostmon.eng/wmi/index.htm
• http://my-plugin.de/wiki/projects/check_multi
• http://pnp4nagios.org
Fragen?

OSMC 2010 | Clientless Windows Monitoring über WMI mit Samba4 by Thomas Sesselmann

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Ähnlich wie OSMC 2010 | Clientless Windows Monitoring über WMI mit Samba4 by Thomas Sesselmann

Ähnlich wie OSMC 2010 | Clientless Windows Monitoring über WMI mit Samba4 by Thomas Sesselmann (20)

OSMC 2010 | Clientless Windows Monitoring über WMI mit Samba4 by Thomas Sesselmann