Page 1 of 2

Help with WMI

Posted: Sun Dec 13, 2020 1:34 pm
by col
Im trying to set up WMI so i can monitor local disc, CPU etc.

I found this in the docs: https://docs.nemslinux.com/en/latest/ch ... k_wmi.html

Its probably me but im have problems getting this to work. On the window machine I'm trying to add a user 'remoteuser' as per the example in the docs but windows returns 'not found' when i try to add it.

any advice?

Re: Help with WMI

Posted: Mon Dec 14, 2020 6:47 am
by Marshman
Col,
The user “remoteuser” does not exist by default on Windows. This user must be added to the host being monitored using any of the Add User methods available on Windows. This will also be the user entered into the Windows Domain Access area of NEMS SST. You could use an existing user but if monitoring multiple Windows hosts and that user is different on all hosts, NEMS will only be successful on the one entered in NEMS SST. That is why the recommendation is to use a Local Admin account with access to all Windows hosts. I personally created “remoteuser” for my testing.
I do see how the doc cited is a little ambiguous and I apologize. I will submit a request to amend the documentation to provide clarity.
Hope this clears up your confusion and thank you for choosing to explore NEMS!

Re: Help with WMI

Posted: Mon Dec 14, 2020 8:50 am
by col
Thank you Marshman. Much appreciated. I'm sure it's me and not the documentation :)

So if I create a new user. Do I need to create the same user name and password on all my windows devices so NEMS can access them all?

Re: Help with WMI

Posted: Mon Dec 14, 2020 10:27 am
by Marshman
Yes. You get one entry for a Windows user in NEMS on the SST page.

Re: Help with WMI

Posted: Mon Dec 14, 2020 12:33 pm
by Robbie Ferguson
Thanks Marshman. Merged your clarification to the docs. I appreciate you clarifying that for the users.

It's easy to take for granted that users know what they need to do and how to do it, yet it would just take one person entering 'administrator' as their remote user to raise some very serious concerns.

Perhaps the Windows user creation process, while not specifically part of NEMS Linux, should be detailed in bullet form just for the protection of users who are novice when it comes to Windows security. We'd want to clearly state and demonstrating that the user should NOT have any access to anything, other than WMI as needed. I'd hate to see someone use a regular user account for WMI as this would be a significant security concern.

Thoughts?

Cheers,
Robbie // The Bald Nerd

Re: Help with WMI

Posted: Mon Dec 14, 2020 12:50 pm
by Marshman
Robbie,
It is already stated in the docs so RTFM is in effect. :)
WMI_Sec.png
WMI_Sec.png (57.48 KiB) Viewed 5894 times

Re: Help with WMI

Posted: Mon Dec 14, 2020 2:08 pm
by col
I'm new to this so i'm probably creating problems :)

I'v successfully added a new user and set WMI up. I have entered the username and password in NEMS SST.

I have added C: drive usage, mem usage and CPU temp to the windows profile in NEMS confg. I have generated a nagios config with no errors and deployed.

NEMS Adagios is reporting a socket timeout error for each of these parameters so I guess I have done something incorrectly. I haven't changed any of the ARGs in the advanced service profiles.

Any ides as to what I might have done incorrectly.

Re: Help with WMI

Posted: Mon Dec 14, 2020 2:19 pm
by Marshman
Have you followed the instructions at the bottom of the doc page: https://docs.nemslinux.com/en/latest/ch ... k-commands ?
You must use the check_win_xxx checks and NOT the other checks eg. C:\Drive Space etc. which will not work with WMI

Re: Help with WMI

Posted: Mon Dec 14, 2020 2:28 pm
by col
Ah. Sorry did not realise that. I think I just clicked on the existing c:\ etc parameters. Let me go back to that part. oops.

Re: Help with WMI

Posted: Mon Dec 14, 2020 5:35 pm
by col
I have added the services as you suggest. Im getting the following error message:

UNKNOWN - The WMI query had problems. The error text from wmic is: [/usr/src/tmp.JjCzaVaVh2/nems-wmic/wmi/wmic.c:196:main()] ERROR: Login to remote object.

NTSTATUS: NT code 0x80010111 - NT code 0x80010111

I have double checked the net user account and password and copied that to the NEMS SST to make absolutely sure thy are the same, so not sure why I'm getting this error. I'll walk through the documentation again and double check everything.