zbxwmi : agentless WMI monitoring

[tatapoum]

Hi all,

You will find a python script named zbxwmi in attachment. The purpose of this script is to simplify agentless WMI monitoring of Windows machines from a Zabbix server or proxy. Here is the usage :

Usage:
  zbxwmi [-a action] [-z <server>] -h <host> -k <key> -i <items> -c <class> [-f <filter>] [-D <domain>] [-U <username>] [-P<password] [-d] [-o <logfile>] [-w <wmic>] [-s <zabbix_sender>]
  zbxwmi -a get -h <host> -i <item> -c <class> [-f <filter>] [-D <domain>] [-U <username>] [-P<password] [-d] [-o <logfile>] [-w <wmic>]
  zbxwmi --help
  zbxwmi --version

Options:
  -a, --action <action>                       The action to take. Possible values : get, bulk, discover, both
                                              [default: both]
  -h, --host <host>                           The host to query
  -z, --zabbix-server <server>                The Zabbix server or proxy
                                              [default: localhost]
  -v, --version                               Display version and exit
  -k <key>, --key <key>                       The key to use as an index for Zabbix LLD discovery
  -i <items>, --items <items>                 The list of items to query for
  -c <class>, --class <class>                 The class to use in the query
  -f <filter>, --filter <filter>              An optional filter to the query
  -D <domain>, --domain <domain>              The domain to use for authentication
  -U <username>, --username <username>        The username to use for authentication
  -P <password>, --password <password>        The password to use for authentication
  -d, --debug                                 Debug mode, be more verbose
  -o <logfile>, --output <logfile>            The log file to use
  -w <wmic>, --wmic <wmic>                    The path to the wmic binary
                                              [default: /usr/bin/wmic]
  -s <zabbix_sender>, --zabbix-sender <zabbix_sender>      The path to the zabbix_sender binary
                                                           [default: /usr/bin/zabbix_sender]

zbxwmi must be installed on a server or proxy and depends on wmic (can be installed from rpmforge or compiled from source, http://dev.zenoss.org/svn/tags/wmi-1.3.14/), and zabbix_sender.
It supports four actions :
- get : query a specific WMI item and returns the value. It can be used as an external check for a few item checks.

ZABBIX externalscripts # ./zbxwmi -a get -h myserver.domain.local -i "AvailableBytes" -c "Win32_PerfRawData_PerfOS_Memory"
4988350464

The item must be configured like this :

- discover : query WMI for a list of items and displays a JSON-formatted object for use with Low-Level Discovery. It helps to automatically create WMI checks with LLD, as WMI can sometimes return a lot of items (ex: processes).

ZABBIX externalscripts # ./zbxwmi -a discover -h myserver.domain.local -k "Name" -i "Name,Size,FreeSpace" -c "Win32_LogicalDisk" -f "MediaType = 12"
{
    "data": [
        {
            "{#WMI.NAME}": "C:"
        },
        {
            "{#WMI.NAME}": "D:"
        },
        {
            "{#WMI.NAME}": "E:"
        },
        {
            "{#WMI.NAME}": "F:"
        }
    ]
}

The "Name" key name is converted to the {#WMI.NAME} macro, which can be used in item prototypes. Configure it like this :

- bulk : query WMI for a list of items and sends them to the server using zabbix_sender. It's a bulk insert, which is way more effective than single checks.

ZABBIX externalscripts # ./zbxwmi -a bulk -h myserver.domain.local -k "Name" -i "Name,Size,FreeSpace" -c "Win32_LogicalDisk" -f "MediaType = 12"

It sends this to the server :

myserver.domain.local FreeSpace[C:] 10070560768
myserver.domain.local Size[C:] 42842714112
myserver.domain.local DeviceID[C:] C:
myserver.domain.local FreeSpace[D:] 17642258432
myserver.domain.local Size[D:] 107371032576
myserver.domain.local DeviceID[D:] D:
myserver.domain.local FreeSpace[E:] 32522383360
myserver.domain.local Size[E:] 42946523136
myserver.domain.local DeviceID[E:] E:
myserver.domain.local FreeSpace[F:] 181060218880
myserver.domain.local Size[F:] 268432306176
myserver.domain.local DeviceID[F:] F:

The WMI item checks must be configured as "Zabbix trapper" to accept these inserts.
- both : this action combines discover and bulk. It displays a JSON-formatted object for use with LLD and bulk sends the matching values to the server with zabbix_sender in a single command. It allows to automatically create all items and to update them efficiently using zabbix_sender. This is the default action.

ZABBIX externalscripts # ./zbxwmi -a both -h myserver.domain.local -k "Name" -i "Name,Size,FreeSpace" -c "Win32_LogicalDisk" -f "MediaType = 12"
{
    "data": [
        {
            "{#WMI.NAME}": "C:"
        },
        {
            "{#WMI.NAME}": "D:"
        },
        {
            "{#WMI.NAME}": "E:"
        },
        {
            "{#WMI.NAME}": "F:"
        }
    ]
}

So you need to configure a discovery item like this :

And item prototypes like this :


Zabbix will then do the job, create all the necessary item checks automatically, and update them using bulk checks at the interval specified in the discovery item screen.

This script was tested with python 2.7 and it is provided as-is. Don't forget to use a secure Windows account to query your hosts (a domain admin will work but it's not recommended). You can add the credentials into the script if you don't want to display them into the Zabbix frontend.

Let me know if you find this script useful.

/dav3860

[tatapoum]

Here is the result after configuring a few checks with the "both" action :

[wnoisephx]

Ok, so I can get zbxwmi to work from the command line, but not in zabbix. It keeps complaining about the key being invalid

is there anyway you can post a template or at least make the images better?

[tatapoum]

If you can run it on the command line, it may be a permission issue.
- check that it's located in the Zabbix external scripts directory (usually /usr/lib/zabbix/externalscripts/)
- check that the zabbix user ows the script
- check that it has the permission to execute it

Restart the Zabbix service.

[vlam]

has any of you perhaps made a template for the WMI monitoring as I got the basics working. But I am not that good with scripting and am slightly pushed for time so please please if someone has got a template that they can share I would really really appreciate it.

Thanks

[vlam]

Hi All

I have gotton this working and have started to create a basic template for this, I would like to know:
In the script you have a username, password and domain
Is it possible to change this to macro's as I have 9 domains that we need to look at.

Please please I need some help

[tatapoum]

Hi,

Glad to see you've been able to set it up.
In fact, look at the script. You can pass the domain/username/password as parameters to the script :

-D <domain>, --domain <domain>              The domain to use for authentication
  -U <username>, --username <username>        The username to use for authentication
  -P <password>, --password <password>        The password to use for authentication

So you can create macros for this purpose and pass them as additional arguments to the discovery key. Something like :

zbxwmi[-a,"get",-h,"{HOST.HOST}",-k,"Name",-i,"Name,Started,StartMode",-c,"Win32_Service",-D,"{#WMIDOMAIN}"-U,"{#WMIUSER}"-P,"{#WMIPASSWORD}"]

[monosoul]

Could anyone share a template if there is one?
Thanks in advance.

Update: I've modified this script a little: added new argument "hostname" (-n). It would be usefull when hostname couldn't be used to access host (for example when there is no A record in DNS for it) and you're using IP address in "host". In that case argument "hostname" would be used to send data to zabbix via zabbix sender, so "hostname" should be the same hostname which used in zabbix for this host.

Example:

zbxwmi["-w","/bin/wmic","-s","/usr/sbin/zabbix-sender","-a","both","-h","{HOST.CONN}","-n","{HOST.HOST}","-k","Name","-i","Name,Size,FreeSpace","-c","Win32_LogicalDisk","-f","MediaType = 12","-D","{$WMIDOMAIN}","-U","{$WMIUSER}","-P","{$WMIPASSWORD}"]

Update 2:
Examples of queries to get amount of total/free memory, cpu load etc. would be highly appreciated!

[tatapoum]

For services :
properties: "Name,Started,StartMode", class : "Win32_Service"

For hard disks free space :
properties: "Name,Size,FreeSpace",class : "Win32_LogicalDisk", filter: "MediaType = 12"

For disks queues :
properties: "Name,CurrentDiskQueueLength",class : "Win32_PerfFormattedData_PerfDisk_PhysicalDisk ", filter: "NOT Name LIKE '_Total'"

[shemerdog]

Some fixes for null and 'space' including keys

First of all thank you very very much, this script saved a lot of work time for me.

Attached new file version
Added check to the script - if key returned is null - then "hostname" is inserted instead into "WMI.NAME" (or whatever)
If key contains spaces it seems like zabbix don't really like it so I'm replacing it with dots.

Will upload shortly a major template containing items for CPU, Memory&Swap, Disks latency queue and space, Processes handlers and working sets and last but not least some network traffic measures
Including triggers and graphs as well


p.s. if you windows machines are on VM's consider just monitoring them through there instead.

[flx]

added -p <serverport>

Thank you for this script it is exactly what we needed
Attached new file version
Update:
-added option -p <serverport> if port of zabbix server/proxy other as default 10051
-readded update from monosoul -n <zabbix-hostname> because his file was not extractable and update was not in other versions.

[misant]

That really what I was looking for.
But I spent alredty 2 day trying to get it work.

Now I `ve got wmic returning real valuese, but still cannot make to do it with zbxwmi. I tried every version that was posted here.

linux-ku3m:/usr/share/zabbix/externalscripts # ./zbxwmi -a get -h ntsrvr13 -i "name" -c Win32_Process -f "ProcessId = 1940" -D domain -U user -P pass -o ./log.txt -d
Traceback (most recent call last):
File "./zbxwmi", line 187, in <module>
main()
File "./zbxwmi", line 129, in main
print str(full[0][items])
KeyError: 'name'

Here what I am getting in log files:

2015-06-22 16:30:06,455 - INFO - zbxwmi[42398]: New query for host ntsrvr13 : SELECT name FROM Win32_Process WHERE ProcessId = 1940
2015-06-22 16:30:06,594 - DEBUG - zbxwmi[42398]: [lib/charset/charcnv.c:117:get_conv_handle()] dos charset 'CP850' unavailable - using ASCII
CLASS: Win32_Process
Handle|Name
1940|conhost.exe

2015-06-22 16:30:06,594 - DEBUG - zbxwmi[42398]: [{'CLASS: Win32_Process': 'Handle'}, {'CLASS: Win32_Process': '1940'}]

[wo0]

i got a problem that zabbix can't receive total values,.i have no idea . could you pls to give me little time to help me ,and give me some advise about this question,many thanks!!!

[captain118]

Secure Password

Is there a way to make sure the password is secure? IE not in plane text on the server?

[vlam]

Hi Guys

I have a new test environment where I am trying to get zbxwmi working but I keep on getting the following error.

ERROR:root:An error occured with wmic : [Errno 2] No such file or directory
An error occured with wmic.

How can I get this fixed