Hello Forum, I would like some help with the following if possible, Using SAM 5.5: 1 . Why do some W2003 servers poll with WMI and some do not (do with SNMP)?? In discovering our automation network, a number of seemingly similar W2003 servers, some end up polling with WMI, but the majority show SNMP as the polling method. I would like to poll all with WMI if possible. have quickly checked the following: * Firewall at servers is not the problem (disabled) * The WMI polling account is a local admin at all nodes * The WMI security seems ok per help found on this site. 2. Is there a way to configure the Windows event log monitor component in such a way that it does not indicate DOWN with a matching event but could still be used for e-mail alerting? Thanks for helping. Sky2830

Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

W2003 Servers not polling via WMI ??

Hello Forum,

I would like some help with the following if possible, Using SAM 5.5:

1 . Why do some W2003 servers poll with WMI and some do not (do with SNMP)?? In discovering our automation network, a number of seemingly similar W2003 servers, some end up polling with WMI, but the majority show SNMP as the polling method. I would like to poll all with WMI if possible. have quickly checked the following:

Firewall at servers is not the problem (disabled)
The WMI polling account is a local admin at all nodes
The WMI security seems ok per help found on this site.

2. Is there a way to configure the Windows event log monitor component in such a way that it does not indicate DOWN with a matching event but could still be used for e-mail alerting?

Thanks for helping.

Sky2830

Find more posts tagged with

wmi_polling

WMI

Polling

Accepted answers

All comments

aLTeReGo

When a host is discovered using the Network Sonar Discovery Wizard and it it accessible via both SNMP and WMI, SNMP is used. You can prevent this from occurring by disabling SNMP discovery in the Network Sonar Discovery profile, remove just the SNMP community string that's matching against those Windows hosts, or disabling SNMP on your windows hosts. Anytime after the node has been added to Orion you can change the polling preference by edit the node setting and switching the polling method from SNMP to WMI.

Switch Polling Method.png

2. Is there a way to configure the Windows event log monitor component in such a way that it does not indicate DOWN with a matching event but could still be used for e-mail alerting?

Yes. This is one of the lesser known new features included in SAM 6.0. Yow can now map event severity to Orion severity, or base a warning or critical threshold based on the number of matching events found, as pictured below.

Event Log Settings.png

Mike_Lomax

I am tagging onto this post because my situation is very similar to what sky2830 described but a bit different.

I also have a group of Windows 2003 Servers (actually Windows 2003 Standard SP2). In my case some are successfully being polled from NPM using WMI, thanks to assistance from aLTeReGo as well, but 3 others I am having difficulty with. I can use wbemtest to connect either from my NPM server to the servers being successfully polled by NPM but not to the other 3. The error I get on those 3 is "Access is denied."

These 2003 servers are all on a remote site to the NPM server so to be safe, I tried going from one of the successfully polled servers to the failing servers and get the same "Access is denied." error in wbemtest. I have double, triple, quadruple checked the Administrator creds I am using and can log onto the 3 servers using those creds.

My next test was to get onto each of the 3 and try attaching to themselves using wbemtest which was successful. I then tried from the 3 to connect to the successfully polled servers using wbemtest and get "Access is denied." going that opposite direction as well. I finally tried connecting from one failing server to the other failing servers using wbemtest and, you probably guessed it, "Access is denied."

I have compared settings for permissions at the user and WMI levels and all failing match with the successful servers. I also read SolarWinds Knowledge Base :: How to create a non-administrator user for APM polling. hoping that might lead me to something but again all matched between the failing and successful servers.

Any ideas?

THANKS

Mike

aLTeReGo

If there are router access control lists or firewalls in place between these hosts, then it's likely a port blocking issue. WMI uses a broad range of ports and does not work across a NAT as I discuss in the following blog post.

http://thwack.solarwinds.com/community/solarwinds-community/product-blog/blog/2013/01/08/wmi-portapocalypse

The following troubleshooting guide should also help you resolve common WMI issues

http://www.solarwinds.com/support/apm/docs/APMWMITroubleshooting.pdf