So why has this all come about. In my job I’ve been working on a small helpdesk type application written in PHP. The idea being that it presents all the information about the user, computer and helpdesk ticket that we are working on in one place. It also provides a quicker interface for searching information than the existing systems on their own. For this I needed to be able to hook into Active Directory, the MSSQL job tracking DB and of course WMI data for the remote PC. All this from the Linux based server.

So I branched off some code from the CactiWMI project and initially wrote it as a simple wmi() type function to run basic queries against remote machines. This quickly became a bit of a pain as I needed to add more arguments to allow filters and then more code to decide if a filter had been supplied or not etc so dumped it and rewrote it into a WMI object.

Now what we have is a reasonably simple library which you can include into your project, create the WMI object and throw some queries at hosts. The data returned at the moment is a little rough as its just a numerically indexed multi dimensional array but should make iteration very easy. I’ll be looking for suggestions as to what I can improve as it’s the first library like this I have had to write and I’ve probably made plenty of rookie mistakes.

I’ve attached a copy of the current stable release and an example file which should get people started until I can add some documentation. I may look at releasing the helpdesk app as well as it’s come in quite useful

SVN Repository is located here http://svn.parkingdenied.com/PHPWMILib/

The script is attached below and requires PHP. Configure the config options within the script and then to provision a new VM you simply sudo ./makevm.php <vmname> and it will take care of everything.

• Creates the snapshot of the original logical volume
• Sets the permissions on the device so that the user can access it
• Creates the raw VMDK file and registers it with VirtualBox
• Creates the base VM with the name provided
• And finally it configures the VM to use the correct disk and network setting etc

That’s all there is to it

• Update templates to suit new input method
• Backwards compatibility for old argument input method
• Overhaul how arguments are passed to wmi.php
• Debug mode via console option
• Add support for alternate namespaces
• Use isset() instead of is not null
• Prevent passwords from showing up in process list
• Fix data template MIN & MAX
• Enterprise Vault Templates

I have added support for additional namespaces and overhauled how  input arguments are passed to support this. As you can see below the cmd line help details how input is now passed.

Usage:
-h <hostname>         Hostname of the server to query.
-u <credential path>  Path to the credential file. See format below.
-n <namespace>        What namespace to use. (optional, defaults to root\CIMV2)
-w <wmi class>        WMI Class to be used.
-c <columns>          What columns to select. (optional, defaults to *)
-k <filter key>       What key to filter on. (optional, default is no filter)
-v <filter value>     What value for the key. (required, only when using filter key)
-d <debug level>      Debug level. (optional, default is none, levels are 1 & 2)

All special characters and spaces must be escaped or enclosed in single quotes!

Example: wmi.php -h 10.0.0.1 -u /etc/wmi.pw -w Win32_ComputerSystem -c PrimaryOwnerName,NumberOfProcessors -n ‘root\CIMV2′

Password file format: Plain text file with the following 3 lines replaced with your details.

username=<your username>
password=<your password>
domain=<your domain> (can be WORKGROUP if not using a domain)

In addition to this there is now no longer any need for additional PHP files. The passwords are stored in a separate file and called via passing the path. This prevents passwords showing up in your process list and allows you to secure it further by limiting access to the password file to the cacti user.

To ease the upgrade process backwards compatibility has been maintained however there is one gotcha. You will still need to update your templates to point to the new password file instead of the reference to the key pair in wmi-logins.php. Aside from this the old templates will all work.

So basically this version is a bit cleaner, adds a few key features, improves security and lays the foundation for further feature upgrades. As per usual the download is attached to this post and any fault tickets can be lodged on my Mantis bug tracker page (Link) and the subversion repository in the usual spot (Link).

So how does one accomplish this task, well it’s really quite simple, LVM snapshots. If you have never heard or used LVM before it is a logical volume manager. It’s job is to take a bunch of physical volumes such as hard disks or raid arrays and combine them into a storage group. From this storage group you can then create multiple logical volumes (similar to luns in the Netapp world) which act like standard disk devices allowing you to easily carve up your storage in a more logical way. Now LVM is really quite a powerful tool and has many extra features which are outside of the scope of this article but see my links at the end to find out more on the specifics.

Anyway the feature we are going to use as I already mentioned is snapshots, what these are is an instantaneous snapshot of a volume which we can then mount separate to the real volume and use as a normal disk. The beauty of this is that your original volume remains completely untouched and any changes that are written to the snapshot are stored as just that changes or differences between that and the original volume. This means for our VM’s that only a few hundred meg or so will change that our disk usage is significantly reduced. You can see now just how useful this can be. The other big advantage is that they are fast, you can create a snapshot in a matter of seconds whereas to copy a vmdk or vdi file it takes a lot longer for it to copy, especially if using a dynamic disk as it locates all the used blocks.

Now lets get down to using it in the real world.

First things first get your VM installed using a raw device mapping.

lvcreate -L20G -nvbox_win2003std_base storage /dev/md2
Logical volume “vbox_win2003_base” created

In this instance I have created a 20gb volume called “vbox_win2003_base” on my storage volume group and forced it to allocate all its extents on /dev/md2. I prefer to do this just to make sure no logical volumes cross over physical volumes unless absolutely needed.

Now you have your volume ready you will need to create a disk for VirtualBox to use.

VBoxManage internalcommands createrawvmdk -filename “win2003_base.vmdk” -rawdisk /dev/storage/vbox_win2003std_base -register
VirtualBox Command Line Management Interface Version 2.2.2
(C) 2005-2009 Sun Microsystems, Inc.
All rights reserved.

RAW host disk access VMDK file win2003_base.vmdk created successfully.

This creates a vmdk file with a raw mapping to the logical volume and automatically registers it for use within VirtualBox.

Now prepare your VM like you would any other Windows machine being cloned. Preinstall all your OS, applications, software, any patches or tweaks and get it configured just the way you like. However try to keep things reasonably simple, this means don’t promote the machine to a DC or any other service which when cloned will break. For my builds I have been testing with Windows 2003 Standard edition. So this means you need to extract the deploy.cab from your Windows 2003 CD to c:\sysprep and run the setupmgr.exe app to generate a sysprep.inf. If you want to avoid problems don’t set a password for the admin account in the sysprep if you have already set one for the machine as it appears to fail when updating it. So you have generated your sysprep.inf, do a quick check to ensure everything is in it’s place and run sysprep.exe –reseal –mini –pnp. The machine will do its bit and then shut down meaning it is ready to be cloned.

Now the fun part, time to make a snapshot of your logical volume.

lvcreate -L5G -s -nvbox_vodka_dc /dev/storage/vbox_win2003std_base
Logical volume “vbox_vodka_dc” created

Now in the blink of an eye it has created a snapshot of your base VM’s logical volume with a maximum growth of 5gb. This means the VM can have a maximum of 5gb of changes before it runs out of space. You will need to fine tune this depending on your VM’s and workload. To keep an eye on it simply use lvdisplay as per normal.

lvdisplay storage/vbox_vodka_dc
— Logical volume —
LV Name                /dev/storage/vbox_vodka_dc
VG Name                storage
LV UUID                IOFUF4-Bxze-Xpij-Qd5b-nH7k-FeEx-k6936B
LV Write Access        read/write
LV snapshot status     active destination for /dev/storage/vbox_win2003std_base
LV Status              available
# open                 0
LV Size                20.00 GB
Current LE             5120
COW-table size         5.00 GB
COW-table LE           1280
Allocated to snapshot  0.00%
Snapshot chunk size    4.00 KB
Segments               1
Allocation             inherit
Read ahead sectors     auto
- currently set to     256
Block device           253:4

Now that we have the snapshot volume all we need to do is create another raw device vmdk.

VBoxManage internalcommands createrawvmdk -filename “Vodka_DC.vmdk” -rawdisk /dev/storage/vbox_vodka_dc
VirtualBox Command Line Management Interface Version 2.2.2
(C) 2005-2009 Sun Microsystems, Inc.
All rights reserved.

RAW host disk access VMDK file Vodka_DC.vmdk created successfully.

And that’s it, you now have a complete clone of that machine ready to load into a new VM within VirtualBox and boot. It will run through the mini-setup as per normal for any cloned machine and that’s it. All done!

With a few batch commands you can quickly automate the creating of a whole fleet of VM’s ready to plug into your dev environment.

Hope this helps a few people out there

Links:

• LVM (wiki)
  
• VirtualBox (wiki)
  

Below are some examples of what we now have!

So we have some standard Windows stats such as system calls, context switches and process/processor stats.

We can now also monitor processes themselves on an individual basis.

And some new Exchange graphs including the much requested SMTP graphs.

And here is the download. Any questions or suggestions let me know and feel free to stop by the thread on the Cacti forums (Link!).

Aside from just supporting Exchange here are the changes below:

• Now parses out spaces and replaces with an underscore (needed for anything that has a name with spaces in it)
• Included new debug mode which logs detailed information to a per host text file
• Code cleanup, should make it a bit easier to configure
• General tweaking

The biggest issue with Exchange that I encountered was that the store names could have spaces which would throw off Cacti when it interpreted the data being passed to it. But as you can see from below the changes have fixed this issue and allow for some useful monitoring.

The templates are included in the attached tar file, please note however that the active client logons will need tweaking to suit your system. For me I created two graphs based on the template then removed the template so that the name of each store could be displayed on the graph. You can do this or alternatively do per store graphs however I found it to be overkill and used two graphs of 5 stores each.

The new debug mode logs by default to /tmp but you can adjust this to wherever you like so long as it has the correct permissions. Effectively what you will end up with is a log file per host of the filename dbug_xx.xx.xx.xx where the x’s are your IP. Inside it will contain basically all the variables being passed in and out as well as the direct output from wmic etc. With this you should be able to track whats going on and debug any issues.

So there you have it everything you need to get started. I will have some additional Exchange templates over the next few weeks so stay tuned! For now if you need help leave a message or drop by the Cacti forums. Also one last note you can browse the latest code and check out any build you like from the web based Subversion repository. Check it out at http://svn.parkingdenied.com/

CactiWMI is the project I have been working on as a method to monitor Windows servers and applications such as Exchange and SQL from a Linux based Cacti install. To do this it uses a combination of some PHP scripting and the WMI client for Linux which just so happens to be available as a Debian package

Anyway I’ve posted up some previous examples of what can be done and they were pretty rough. So here are a few examples of what can be done and what templates are available in the package.

Here we can monitor memory usage, this one showing the physical memory usage compared against the commit limit and the current commited bytes.

Simple disk space monitor. It also does not suffer from the SNMP remapping problem where when you add a new disk the OID’s are remapped and thus your stats break.

Pretty straight forward, disk I/O so you can see what is really going on when you have load problems.

CPU usage, available with templates for 1, 2 and 4 core machines. I will do one for an 8 core machine shortly.

SQL performance. Tested against SQL 2005.

Domain controller LDAP stats. If you use a lot of query based distribution groups or use LDAP for external authentication this can be invaluable to see when there are performance problems.

NT Domain Controller stats. Both authentications per second as well as the read/write/searches against your domain. Good for performance troubleshooting and detecting rogue applications.

Pretty useful no?

So how to set them up… Grab the package attached to this post. It will contain two PHP scripts and a number of templates. Extract the two files to your Cacti scripts folder and then start editing the wmi-logins.php file. In this file are listed the username/password pairs which are referenced by the script. This separates the credential itself from Cacti meaning your Cacti admins don’t actually need to know your WMI user which you are using to pull the stats. In any case add the credential as per the file which should be pretty self explanitory.

Before we go too much further there are some gotcha’s that need to be taken care of regarding the user you have selected to do the WMI queries. This user needs to both have access to remotely query WMI but also to be able to query the subsystems from WMI. What this means in our case is that the user needs have remote access to WMI, be allowed to remote query and then also to be allowed to access perfmon. From my understanding this is due to perfmon being a subsystem which WMI is accessing and thus the credential being used must also have access to the perfmon counters in order to be able to graph anything. For the WMI portion of things you can get most of the information from this MSDN link http://msdn2.microsoft.com/en-us/library/aa393266.aspx. The basics are you grant the user permission to remote WMI as discussed, you then need to grant the user access to the appropriate WMI namespace, in our case this is CIMV2 and then add the user to the perfmon group which by default the 2003 server and up machines should have. This should grant it all the permission it requires, however if you do have problems test with an admin credential and see if you get results. If you do get results as admin but not as your non-admin user then you have a permission issue.

Ok so thats out of the way now you may need to update the wmi.php file to ensure the correct path to your wmic binary so edit that and ensure it is correct. Additionally you can redirect the location of the wmi-logins.php by editing the appropriate variable. Most of the code should be commented to help explain what it is doing, basically its acting as the glue between Cacti and the wmic results. So everything is in place, all that you need to do is import the templates included and attach them to the hosts you want to graph. The slack way I have been doing things is simply adding the graph to the device or the host template which will auto generate the required data sources when you add the graph however your more than welcome to do the the manual way by adding the data source and then the graph and linking the two. Make sure if you used a different credential name to update the data templates as I have not set them to be a per data source credential reference, you will understand once you take a look. It’s up to you if you need the ability to do per data source credentials for different servers but the option is there should it need to be enabled.

So that should cover everything, add your graphs and start monitoring those hosts! If there are any questions feel free to leave a comment or drop me a PM on the Cacti forums

Attached below are the templates required, all that is really needed is a few Get SNMP data sources and away you go

For reference here are the SNMP OID’s required to pull the stats.

Down
Attenuation    .1.3.6.1.2.1.10.94.1.1.2.1.5.2
Sync        .1.3.6.1.2.1.10.94.1.1.4.1.2.2
SNR        .1.3.6.1.2.1.10.94.1.1.2.1.4.2

Up
Attenuation    .1.3.6.1.2.1.10.94.1.1.3.1.5.2
Sync        .1.3.6.1.2.1.10.94.1.1.5.1.2.2
SNR        .1.3.6.1.2.1.10.94.1.1.3.1.4.2

One last thing… I have attached to this post the latest open version of the firmware. As these modems were always branded when sold you may require the open version to get around the VOIP block and also enable a few of the hidden features that were turned off by some resellers.

Something like this…

Now this isn’t my idea, a member of the Cacti forums put up a rough guide to get people going. You can view this here http://forums.cacti.net/about25415.html. However to make things simple I have attached a template which should take care of the graph template, CDEF and also includes a few other changes. I have split the graph into positive for inbound and negative for outbound traffic and added a total traffic item to the graph which I use to monitor my ADSL traffic over a period of time.

Advantages

• Built in.
• Plenty of documentation available.
• Supports most if not all performance counters (Exchange + SQL etc)
• Reliable.
• Possibly more secure.

Disadvantages

• RPC is required which could cause problems with firewalls.
• Requires an account with access to read WMI data.

The main problem with SNMP is that without spending a substantial amount of money on SNMP Informant or using the unreliable perf2mib it’s quite hard to get any useful results out of it. With WMI you can pull all sorts of information and monitor most performance counters across the system. And there are plenty of example power shell and vbscripts which can be used to monitor and access WMI information, so it’s relatively straightforward to monitor this data if you’re using a Windows server…

But if you’re not running Cacti on Windows you can’t use these scripts or the more common Perl:OLE. However we can rejoice for there is a WMI client available for Linux/Unix operating systems which can be used to harness the power of WMI and of course use Cacti to monitor these machines.

Now there is a plugin available for Cacti which allows you to query WMI whick looks promising but it does require manual patching of your Cacti install with the plugin architecture which is not always a viable option. Instead I have written up some scripts which will wrap around wmic and allow you to easily graph your windows hosts.

Some example graphs.

Disk I/O

CPU Usage

Disk Usage

As you can see they are quite useful and it can only get better as more scripts are made available. For now the PHP scripts and documentation (what little there is at the moment) can be found on my Subversion repository linked below, if you would like to help and expand this project swing me a message. At this stage there is no packaged release but ideally when they are stable and a lot cleaner packages will be made available.

http://svn.parkingdenied.com/CactiWMI