Categorizing different Citrix Box roles
So I was asked if we can include all the different Citrix box roles in our Dynamic Citrix Group which looks for any devices that has the Category with different Citrix property sources. For reference there are Citrix StoreFronts (SF) >> Deskstop Delivery Controlers (DDC) >> Provisioning Services Servers (PVS) >> XenApp Farm Servers So for the PVS servers I did created a new Property Source entry and used Embedded Groovy Script and took the content from another PS and just modified the contains xxxx section: import com.santaba.agent.groovyapi.win32.WMI; //================================== def host = hostProps.get("system.hostname"); // get a list of running services def service_list = WMI.queryAll(host, "select * from win32_service"); def datacoreServices = service_list.findAll { service -> service["DISPLAYNAME"].contains("Citrix PVS") } // Did we find any Citrix PVS Services? if (datacoreServices.size() > 0) { println "system.categories=CitrixPVS"; } return(0); //=== END ==== But in searching how to set this up I noticed that DataSources have a much simpler way to query boxes for properties. Example there's a DS called: WinCitrixServices- that in its Active Discovery section we can define the Discovery Method, and the parameters can specify which WMI Class to look at and then easily specify the filter properties, etc..: Why can't Property Sources have this same method to allow me to easily define the criteria I'm looking for? Why is it only groovy or powershell scripts? Also with regards to the different Citrix box roles are there no PVS or StoreFront datasources ?0Views0likes0Comments
PSA: Collect from windows systems without admin rights
Don't know if anyone else noticed, but MS released a pretty slick script that enables WMI access remotely without admin rights. I have done a brief test with LM and it seems to be working well. https://blogs.technet.microsoft.com/askpfeplat/2018/04/30/delegate-wmi-access-to-domain-controllers/ That's the article. I created an AD group instead of a user to delegate, and I put the LM collector service in that group. Everything else I've followed as documented. I haven't tested anything else, but this alone is a huge step in the right direction.10Views3likes7CommentsIs anyone interested in a utility to remotely bulk set WMI permissions (non-admin) ?
Some peopledon't want to use'Domain Admin' level credentials or even local admin credentials for Windows monitoring via WMI. l havecreated a utility in PowerShell that allows you to set these in bulk from a central location without doing all the tedious steps. The relevant help doc is here Let me know if you're interested. I will send it to you so you can test/use. Click this link to see a demo:https://share.vidyard.com/watch/6Bgp9ksd5aWAN9J93h2d2F6Views0likes8CommentsNo WMI data is being collected from <host>
I get an error in LM on a few of our hosts: Quote No WMI data is being collected from <host>. This started at <time>. This means the LogicMonitor agent does not have permissions to collect data from <host>, or the traffic is being blocked. If the host is in a domain, ensure the LogicMonitor agent service is running as a domain account that has local administrator privileges on the host, or running as LocalSystem on a domain controller. Ensure there are no firewalls preventing the agent from accessing the host. These hosts don't really have anything particularly different on them - i have run through the WMI guide here : https://www.logicmonitor.com/support/monitoring/os-virtualization/troubleshooting-wmi/ After going to LM Tech support (who are very helpful) they said that the only solution they can give is to disable UAC. This will not work for us as this will introduce a security issue on those devices. Other machines in very similar configurations do not have this issue, so it seems odd that particular machines present this behavior even though others have UAC on as well. Can further investigation be done in this area to diagnose the fault specifically, and a different solution than UAC deactivation be provided. Thanks17Views0likes0Comments
Automatic grouping by service status
A customer recently requested assistance with grouping some of their hosts that were running a particular service. This can be achieved by a combination of Active Discovery, Dynamic Groups, PropertySources, and of course functioning WMI. ? First, we have to figure out how to dynamically group these. We can rely on a custom query to automatically match the devices we want to see, but must depend on the properties from a device’s Info tab for any evaluation. We can use a PropertySource to do some of this work for us, and have it perform a check for the service and apply a property if it is found. Let's confirm we can query this host, and see how it identifies itself. I can query the win32_service class for a test host and see what gets returned: Great, so I've found an example of the service I want, and canreference its NAME attribute in our PropertySource to check for a match and determine if a host has this service installed. This PropertySource runs a WMI query against the win32_service class, looking for the NAME of the service as it’s report as an attribute. If it finds a match, it checks to seeif it’s running, and if those two pass it applies a property called "auto.GoldenEye" to the device. The nice thing about this PropertySource is that if discovery finds the device no longer runs the installed service, it will remove the autoproperty, and thus remove it from the dynamic group. This allows you to have a top level view of only thosedevices with the service actually running. Now that we have a method to automatically flag the service we want to track, we can reference this property name in our Dynamic Group query. This is a simple boolean check to see if the property is applied to any given host As an optional step, but highly advised, we can add the services as monitored instances. You may already know that running services can be added into LM through the Add Other Monitoring option in the UI, but this can become cumbersome if you want to add the same or multiple services into monitoring for manydevices. Since the wizard in the link above is just a frontend for the WinServices datasource, we can work with a clone of it, enable Active Discovery to automatically apply to eligibledevices, and utilize filtering to specify which services to monitor.Here I've specified that I want it to match by the DISPLAYNAMEattribute of the win32_service class: Once this is applied, discovery automatically checks each host for the desired service, and returns it as an alertable instance so you can be notified when it is not running or has degraded performance. Further reading: LogicMonitor Scripting Monitoring Processes and Services Creating PropertySources PropertySource embedded Groovy script example: import com.santaba.agent.groovyapi.win32.WMI import com.santaba.agent.groovyapi.win32.WMISession // Set hostname def hostname = hostProps.get('system.hostname'); // Form the full query. def wmiQuery = "Select name,state from Win32_Service Where name='someservicenameNOTdisplayname'"; try { // using default namespace def session = WMI.open(hostname); def result = session.queryFirst("CIMv2", wmiQuery, 10); // Did we get anything? if (result.STATE == "Running") { // Yes, apply the properties println 'auto.somedesiredpropname=yes' } } catch(Exception e) { println e return 1; } // Exit by returning 0. return 0;4Views0likes0Comments
issues with WMI in windows server 2003
Hello to everyone, I've problems when monitoring windows server 2003, always the collector tells me that it can not connect to port 135, but doing the tests locally the WMI service with some tools like WBEMTEST or PORTQRY seemsworking properly. please help me to verify if this problem is in general with the version windows server 2003 or I must do something else. thanks1View0likes1Comment
Secondary WMI Credentials
Use case: We have parts of the business that have some standalone servers and servers joined to different domains. We create our device groups based on our business services, which means we have business services that are made up of devices that are standalone, and from different domains. Problem: We have to set the WMI user for these servers indepdently because one user ID inherited from parent groups won't work in such a scenario. Enhancement: It would be useful to be able to use afunction (in the manner of Applies To) to supply the WMI user value. The function could inspect device properties to determine which WMI user account to use.4Views0likes0Comments
Better Win_WMI_Access_Denied, with error code identification
Win_WMI_Access_Denied- identifies that a probably-windows device isn't giving up WMI data (auto properties and active discovery) This scripted alternative version,Win_WMI_Access_Denied_ErrorCodes, parses the error code returned from the Windows devices and converts that to a human-friendly alert message to help identify the likely cause (DCOM permissions, Windows Firewall, etc). As in Exchange it has AppliesTo of '!(system.sysinfo) && isDevice()' as the original DataSource has, i.e. only devices that have never returned data. However, you could clone or change the datasource to apply to previously-working devices, all Windows devices, etc, such that if collection fails for any reason, alerts can be triggered. 4CKLN25Views0likes1Comment
Gather and store more relevant WMI data for auto-grouping and category population
During the initial and periodic device auto-discovery tasks, there should be far more information stored about each device. This information should be easily accessible from the device information page and populated with data such as "Installed Programs", "Installed Features", "Running Services", "Domain Role", etc. This information could then be used to auto-group devices. For example, I should be able to create an auto-discover rule that automatically grabs all Domain Controllers based on the system.installedservices and system.installedfeatures categories. There is no reason I should have to manually movethis server that is clearly a Domain Controller into my group labeled "Domain Controllers". This approach would allow administrators to "set it and forget it" instead ofhaving to be hands-on every time a new device is added or discovered. This data can be easily populated from standard WMI classes: system.installedservices = win32_services.displayname system.serverfeatures = win32_serverfeature.Name Please help me organize my devices automatically. We have too many machines in too many environments to manually sort them allinto groups.1View0likes3Comments