So why has this all come about. In my job I’ve been working on a small helpdesk type application written in PHP. The idea being that it presents all the information about the user, computer and helpdesk ticket that we are working on in one place. It also provides a quicker interface for searching information than the existing systems on their own. For this I needed to be able to hook into Active Directory, the MSSQL job tracking DB and of course WMI data for the remote PC. All this from the Linux based server.

So I branched off some code from the CactiWMI project and initially wrote it as a simple wmi() type function to run basic queries against remote machines. This quickly became a bit of a pain as I needed to add more arguments to allow filters and then more code to decide if a filter had been supplied or not etc so dumped it and rewrote it into a WMI object.

Now what we have is a reasonably simple library which you can include into your project, create the WMI object and throw some queries at hosts. The data returned at the moment is a little rough as its just a numerically indexed multi dimensional array but should make iteration very easy. I’ll be looking for suggestions as to what I can improve as it’s the first library like this I have had to write and I’ve probably made plenty of rookie mistakes.

I’ve attached a copy of the current stable release and an example file which should get people started until I can add some documentation. I may look at releasing the helpdesk app as well as it’s come in quite useful

SVN Repository is located here http://svn.parkingdenied.com/PHPWMILib/

• Update templates to suit new input method
• Backwards compatibility for old argument input method
• Overhaul how arguments are passed to wmi.php
• Debug mode via console option
• Add support for alternate namespaces
• Use isset() instead of is not null
• Prevent passwords from showing up in process list
• Fix data template MIN & MAX
• Enterprise Vault Templates

I have added support for additional namespaces and overhauled how  input arguments are passed to support this. As you can see below the cmd line help details how input is now passed.

Usage:
-h <hostname>         Hostname of the server to query.
-u <credential path>  Path to the credential file. See format below.
-n <namespace>        What namespace to use. (optional, defaults to root\CIMV2)
-w <wmi class>        WMI Class to be used.
-c <columns>          What columns to select. (optional, defaults to *)
-k <filter key>       What key to filter on. (optional, default is no filter)
-v <filter value>     What value for the key. (required, only when using filter key)
-d <debug level>      Debug level. (optional, default is none, levels are 1 & 2)

All special characters and spaces must be escaped or enclosed in single quotes!

Example: wmi.php -h 10.0.0.1 -u /etc/wmi.pw -w Win32_ComputerSystem -c PrimaryOwnerName,NumberOfProcessors -n ‘root\CIMV2′

Password file format: Plain text file with the following 3 lines replaced with your details.

username=<your username>
password=<your password>
domain=<your domain> (can be WORKGROUP if not using a domain)

In addition to this there is now no longer any need for additional PHP files. The passwords are stored in a separate file and called via passing the path. This prevents passwords showing up in your process list and allows you to secure it further by limiting access to the password file to the cacti user.

To ease the upgrade process backwards compatibility has been maintained however there is one gotcha. You will still need to update your templates to point to the new password file instead of the reference to the key pair in wmi-logins.php. Aside from this the old templates will all work.

So basically this version is a bit cleaner, adds a few key features, improves security and lays the foundation for further feature upgrades. As per usual the download is attached to this post and any fault tickets can be lodged on my Mantis bug tracker page (Link) and the subversion repository in the usual spot (Link).

Below are some examples of what we now have!

So we have some standard Windows stats such as system calls, context switches and process/processor stats.

We can now also monitor processes themselves on an individual basis.

And some new Exchange graphs including the much requested SMTP graphs.

And here is the download. Any questions or suggestions let me know and feel free to stop by the thread on the Cacti forums (Link!).

Aside from just supporting Exchange here are the changes below:

• Now parses out spaces and replaces with an underscore (needed for anything that has a name with spaces in it)
• Included new debug mode which logs detailed information to a per host text file
• Code cleanup, should make it a bit easier to configure
• General tweaking

The biggest issue with Exchange that I encountered was that the store names could have spaces which would throw off Cacti when it interpreted the data being passed to it. But as you can see from below the changes have fixed this issue and allow for some useful monitoring.

The templates are included in the attached tar file, please note however that the active client logons will need tweaking to suit your system. For me I created two graphs based on the template then removed the template so that the name of each store could be displayed on the graph. You can do this or alternatively do per store graphs however I found it to be overkill and used two graphs of 5 stores each.

The new debug mode logs by default to /tmp but you can adjust this to wherever you like so long as it has the correct permissions. Effectively what you will end up with is a log file per host of the filename dbug_xx.xx.xx.xx where the x’s are your IP. Inside it will contain basically all the variables being passed in and out as well as the direct output from wmic etc. With this you should be able to track whats going on and debug any issues.

So there you have it everything you need to get started. I will have some additional Exchange templates over the next few weeks so stay tuned! For now if you need help leave a message or drop by the Cacti forums. Also one last note you can browse the latest code and check out any build you like from the web based Subversion repository. Check it out at http://svn.parkingdenied.com/

CactiWMI is the project I have been working on as a method to monitor Windows servers and applications such as Exchange and SQL from a Linux based Cacti install. To do this it uses a combination of some PHP scripting and the WMI client for Linux which just so happens to be available as a Debian package

Anyway I’ve posted up some previous examples of what can be done and they were pretty rough. So here are a few examples of what can be done and what templates are available in the package.

Here we can monitor memory usage, this one showing the physical memory usage compared against the commit limit and the current commited bytes.

Simple disk space monitor. It also does not suffer from the SNMP remapping problem where when you add a new disk the OID’s are remapped and thus your stats break.

Pretty straight forward, disk I/O so you can see what is really going on when you have load problems.

CPU usage, available with templates for 1, 2 and 4 core machines. I will do one for an 8 core machine shortly.

SQL performance. Tested against SQL 2005.

Domain controller LDAP stats. If you use a lot of query based distribution groups or use LDAP for external authentication this can be invaluable to see when there are performance problems.

NT Domain Controller stats. Both authentications per second as well as the read/write/searches against your domain. Good for performance troubleshooting and detecting rogue applications.

Pretty useful no?

So how to set them up… Grab the package attached to this post. It will contain two PHP scripts and a number of templates. Extract the two files to your Cacti scripts folder and then start editing the wmi-logins.php file. In this file are listed the username/password pairs which are referenced by the script. This separates the credential itself from Cacti meaning your Cacti admins don’t actually need to know your WMI user which you are using to pull the stats. In any case add the credential as per the file which should be pretty self explanitory.

Before we go too much further there are some gotcha’s that need to be taken care of regarding the user you have selected to do the WMI queries. This user needs to both have access to remotely query WMI but also to be able to query the subsystems from WMI. What this means in our case is that the user needs have remote access to WMI, be allowed to remote query and then also to be allowed to access perfmon. From my understanding this is due to perfmon being a subsystem which WMI is accessing and thus the credential being used must also have access to the perfmon counters in order to be able to graph anything. For the WMI portion of things you can get most of the information from this MSDN link http://msdn2.microsoft.com/en-us/library/aa393266.aspx. The basics are you grant the user permission to remote WMI as discussed, you then need to grant the user access to the appropriate WMI namespace, in our case this is CIMV2 and then add the user to the perfmon group which by default the 2003 server and up machines should have. This should grant it all the permission it requires, however if you do have problems test with an admin credential and see if you get results. If you do get results as admin but not as your non-admin user then you have a permission issue.

Ok so thats out of the way now you may need to update the wmi.php file to ensure the correct path to your wmic binary so edit that and ensure it is correct. Additionally you can redirect the location of the wmi-logins.php by editing the appropriate variable. Most of the code should be commented to help explain what it is doing, basically its acting as the glue between Cacti and the wmic results. So everything is in place, all that you need to do is import the templates included and attach them to the hosts you want to graph. The slack way I have been doing things is simply adding the graph to the device or the host template which will auto generate the required data sources when you add the graph however your more than welcome to do the the manual way by adding the data source and then the graph and linking the two. Make sure if you used a different credential name to update the data templates as I have not set them to be a per data source credential reference, you will understand once you take a look. It’s up to you if you need the ability to do per data source credentials for different servers but the option is there should it need to be enabled.

So that should cover everything, add your graphs and start monitoring those hosts! If there are any questions feel free to leave a comment or drop me a PM on the Cacti forums

Advantages

• Built in.
• Plenty of documentation available.
• Supports most if not all performance counters (Exchange + SQL etc)
• Reliable.
• Possibly more secure.

Disadvantages

• RPC is required which could cause problems with firewalls.
• Requires an account with access to read WMI data.

The main problem with SNMP is that without spending a substantial amount of money on SNMP Informant or using the unreliable perf2mib it’s quite hard to get any useful results out of it. With WMI you can pull all sorts of information and monitor most performance counters across the system. And there are plenty of example power shell and vbscripts which can be used to monitor and access WMI information, so it’s relatively straightforward to monitor this data if you’re using a Windows server…

But if you’re not running Cacti on Windows you can’t use these scripts or the more common Perl:OLE. However we can rejoice for there is a WMI client available for Linux/Unix operating systems which can be used to harness the power of WMI and of course use Cacti to monitor these machines.

Now there is a plugin available for Cacti which allows you to query WMI whick looks promising but it does require manual patching of your Cacti install with the plugin architecture which is not always a viable option. Instead I have written up some scripts which will wrap around wmic and allow you to easily graph your windows hosts.

Some example graphs.

Disk I/O

CPU Usage

Disk Usage

As you can see they are quite useful and it can only get better as more scripts are made available. For now the PHP scripts and documentation (what little there is at the moment) can be found on my Subversion repository linked below, if you would like to help and expand this project swing me a message. At this stage there is no packaged release but ideally when they are stable and a lot cleaner packages will be made available.

http://svn.parkingdenied.com/CactiWMI