CheckWMI¶
Available on Windows only.
Check status via WMI
Enable module¶
To enable this module and allow using the commands you need to add CheckWMI = enabled to the [/modules] section in nsclient.ini:
[/modules]
CheckWMI = enabled
Queries¶
A quick reference for all available queries (check commands) in the CheckWMI module.
List of commands:
A list of all available queries (check commands)
| Command | Description |
|---|---|
| check_wmi | Check a set of WMI values and return rows which are matching criteria. |
List of command aliases:
A list of all short hand aliases for queries (check commands)
| Command | Description |
|---|---|
| checkwmi | Alias for: :query:check_wmi |
check_wmi¶
Check a set of WMI values and return rows which are matching criteria.
About check_wmi¶
check_wmi runs an arbitrary WQL query and turns each returned row into a
filter record. It is the escape hatch for everything the purpose-built checks do
not cover: if the data is in WMI, this exposes it to the same
filter= / warning= / critical= / top-syntax= machinery as every other
check.
Keywords are the query’s own columns¶
Unlike every other check, the keyword vocabulary is not fixed — it is
derived from the columns your query= selects. A query of
SELECT Name, FreeSpace FROM Win32_LogicalDisk gives you Name and
FreeSpace as keywords, and each is also emitted as performance data.
Because those keywords only exist once a query has been run, the generated
“Filter keywords” section below can only list the generic summary keywords —
none of this check’s own. There is one more that is always available and is not
listed there either: line, the whole row rendered as a comma-separated
string, which is what the default detail-syntax (%(line)) uses.
This also means SELECT * is usually the wrong thing to write: it produces a
keyword and a performance-data series per column of the class, most of which you
do not want graphed. Select the columns you intend to use.
Remote hosts¶
target= names a host to query instead of the local machine, resolved through
the module’s configured targets when one matches and treated as a hostname
otherwise; user= and password= supply alternate credentials.
namespace= binds to a WMI root other than the default root\cimv2 —
root\wmi for driver/ACPI classes, root\Microsoft\Windows\Storage for Storage
Spaces, and so on.
Remote WMI needs DCOM/RPC reachable through the firewall and an account with remote-WMI rights on the target. Where the data is available locally, running the check on the monitored host is both faster and simpler to secure.
Caveats¶
There are no default thresholds, and the default empty-state is ignored, so
a query that matches nothing returns OK. If “no rows” is itself the alarm
condition — a service class that should always have an instance — set
empty-state=critical explicitly.
A WMI query is comparatively expensive and can block for seconds on a busy or
unhealthy host; keep queries narrow and consider wrapping slow ones in
check_timeout.
Jump to section:
Sample Commands¶
Basic check to see/fetch information (no check)::
check_wmi "query=Select Version,Caption from win32_OperatingSystem"
OK: Microsoft Windows 8.1 Pro, 6.3.9600
A simple string check::
check_wmi "query=Select Version,Caption from win32_OperatingSystem" "warn=Version not like '6.3'" "crit=Version not like '6'"
OK: Microsoft Windows 8.1 Pro, 6.3.9600
Simple check via via NRPE::
check_nrpe --host 192.168.56.103 --command check_wmi -a "query=Select Version,Caption from win32_OperatingSystem" "warn=Version not like '6.3'" "crit=Version not like '6'"
OK: Microsoft Windows 8.1 Pro, 6.3.9600
A simple integer (number) check::
check_wmi "query=Select BuildNumber from win32_OperatingSystem" "warn=BuildNumber < 9600" "crit=BuildNumber < 8000"
L cli OK: 9600
L cli Performance data: 'BuildNumber'=9600;9600;8000
Using performance options to customize the performance data::
check_wmi "query=select Name, AvgDiskQueueLength from Win32_PerfFormattedData_PerfDisk_PhysicalDisk" "warn=AvgDiskQueueLength>0" "perf-syntax=%(Name)" "perf-config=*(prefix:'time')"
L cli OK: 0, _Total, 0, 0 C:, 0, 1 D:
L cli Performance data: 'time_Total'=0;0;0 'time0 C:'=0;0;0 'time1 D:'=0;0;0
Adding values to the message::
check_wmi "query=Select BuildNumber from win32_OperatingSystem" "warn=BuildNumber < 9600" "crit=BuildNumber < 8000" "detail-syntax=You have build %(BuildNumber)" show-all
L cli OK: You have build 10240
L cli Performance data: 'BuildNumber'=10240;9600;8000
Command-line Arguments¶
| Option | Default Value | Description |
|---|---|---|
| target | The target to check (for checking remote machines). | |
| user | Remote username when checking remote machines. | |
| password | Remote password when checking remote machines. | |
| namespace | root\cimv2 | The WMI root namespace to bind to. |
| query | The WMI query to execute. |
namespace:
The WMI root namespace to bind to.
Default Value: root\cimv2
Common options:
These options are shared by all filter based commands and are described on the common options page; the default values below are specific to this command.
| Option | Default Value |
|---|---|
| filter | |
| warning | |
| warn | |
| critical | |
| crit | |
| ok | |
| debug | false |
| show-all | false |
| empty-state | ignored |
| perf-config | |
| escape-html | false |
| list-separator | , |
| top-syntax | ${list} |
| ok-syntax | |
| empty-syntax | |
| detail-syntax | %(line) |
| perf-syntax | |
| byte-unit | |
| decimal-separator | |
| decimals | -1 |
| thousands-separator |
This command also accepts the standard help options: help, help-pb, show-default, help-short.
Filter keywords¶
This command also supports the common filter keywords: count, total, ok_count, warn_count, crit_count, problem_count, list, ok_list, warn_list, crit_list, problem_list, detail_list, sep, status.
Configuration¶
| Path / Section | Description |
|---|---|
| /settings/wmi/targets | TARGET LIST SECTION |
TARGET LIST SECTION ¶
A list of available remote target systems
This is a section of objects. This means that you will create objects below this point by adding sections which all look the same.