22 Replies Latest reply on Apr 5, 2018 6:27 PM by thwackdude

    General SAM Questions Involving WMI

    thwackdude

      Greetings Thwack,

       

      I hope this is the correct place to post these "new guy" questions.  I've recently been handed SAM to replace SCOM with the caveat of WMI only (I already attempted the Orion Agent pitch to no avail).  I keep easily getting lost in the training videos and documentation and I believe I've searched the right areas.  I will continue digging and I am not trying to "cop out," I've just found product forums to be more direct.  I do apologize for my "newness" and thank you for your time.

       

      Current Requirements:

      WMI only, single / very limited port range, and non-administrator WMI.  All of which I have documentation on.

      Generic (Drive%, up/down, certificate lifespan, services down).

       

      Anyway, concerning WMI:

       

      1.  There are some community templates that have "WMI - Only" in the title, am I correct in assuming these are the ones I should be seeking out as per my requirements?

      2.  Assuming I cannot find pre-made templates that fit my requirements, should I start researching strings and build my own?  Are there good programs for this or is MSDN (seems incredibly vast) the place to be?

        • Re: General SAM Questions Involving WMI
          jdumke

          So you aren't allowed to do SNMP at all?  Or you can't install anything special/extra to monitor?

           

          I often troll for the templates, assign them and test to see if I can get what I want.  If not, I just unassign them.

          2 of 2 people found this helpful
            • Re: General SAM Questions Involving WMI
              thwackdude

              Jdumke, thank you for your reply.

               

              As far as "agentless" is concerned, I don't think SNMP is off the table but it was my understanding (limited understanding) that when using WMI, there are more capture points available.  The only thing that is off the table as of today is the Orion Agent.  The goal is to start with a generalized "All Windows Servers" and move into things like SQL, IIS, Sharepoint, Exchange, etc.

              1 of 1 people found this helpful
            • Re: General SAM Questions Involving WMI
              bobmarley
              You should be able to do everything you outlined (Generic (Drive%, up/down, certificate lifespan, services down) using WMI with no problem. I use it -vs- snmp in my environment.
              If the SAM templates you need don't already exist its very easy to create custom ones on you own once you get the hang of using SAM.
              I find it much easier to use than SCOM even though we still use both tools.
              1 of 1 people found this helpful
                • Re: General SAM Questions Involving WMI
                  thwackdude

                  Bobmarley, thank you also for your reply.

                   

                  Also, thank you for reassuring me my assumptions are correct.  I get the basic structure of a WMI query, however, I suppose I'm looking for an easier way to get the strings I need to build my own template.  I've gone through a few of the templates that are already in the SAM system but they don't seem to fit exactly what I am looking for.  Essentially, I am learning by doing, definitely a learning curve.

                   

                  Logically, the example WMI query makes sense: Select AvailableMBytes From Win32_PerfRawData_PerfOS_Memory but I am not entirely sure where look other than the vast MSDN site.

                   

                  Just making sure I'm "barking up the right tree."

                  1 of 1 people found this helpful
                    • Re: General SAM Questions Involving WMI
                      bobmarley

                      Some of the metrics you wanted are available as soon as you add a node like CPU, Memory, Disk, Hardware, and Interfaces. The rest like services can be added as SAM templates.

                      Try opening up a node and using the 'real time process explorer' and it will make templates pretty easily.

                      There are a bunch already included with SAM and a bunch more you can download here on Thwack.

                      1 of 1 people found this helpful
                  • Re: General SAM Questions Involving WMI
                    jm_sysadmin

                    We replaced SCOM 4 years with Solarwinds. Assuming you are only gathering information from Windows devices WMI will not be a limitation, although somethings (like the application insight templates for Exchange, SQL and IIS) also use scripts.

                    As far as your requirements for "WMI only, single / very limited port range, and non-administrator WMI" you can do it, but that is not a Solarwinds thing, that will be how your monitoring servers talk to the monitored nodes. Solarwinds will just use the OS functions to make the WMI calls, so if or when it breaks they won't have a lot of advice. As you likely know from you post the best way to do what you want is to use the agent, and this is exactly what my company does for the DMZ servers. (And soon maybe all windows clients). We wanted to reduce the ports and limit the access, and the agent helps with both issues.

                     

                    As for finding things you need, what types of applications are you concerned about? I can say that most of our applications aren't widely used, and most of my templates are made by me, but its never really been an issue. If you run into problems, Thwack is a great first stop, go ahead an ask. 

                     

                     

                    2 of 2 people found this helpful
                      • Re: General SAM Questions Involving WMI
                        thwackdude

                        JM_Sysadmin, thank you as well for your reply.

                         

                        Good to know you were in the same boat I am currently.  Windows come first since that is our majority and Linux will have to use (assuming) SNMP.  Blanket system monitoring will come first and specialized (IIS, Exhcnage, SQL) ones will be built later.  I believe I can still accomplish the specialized ones just different templates via WMI or SNMP (for Linux).  I have relayed the support limitations of limited port range combine with non-administrative WMI access and it is understood.

                         

                        Currently, I am concerned about what, as hinted in the previous sentence, I can apply to all Windows servers that indicate server health.  Things like mounted disk space, downed services, certificate expiration, down/reboot, CPU over utilization, memory over utilization.  Again, I do understand that specialized applications will required extra care in template creation but I just haven't gotten there yet, baby steps.

                        1 of 1 people found this helpful
                          • Re: General SAM Questions Involving WMI
                            rharland2012

                            Can I assume that you're running SAM standalone with no NPM present or integrated?

                            1 of 1 people found this helpful
                              • Re: General SAM Questions Involving WMI
                                thwackdude

                                Rharland2012,

                                 

                                Arg, sorry, I should have clarified.  Running NPM, NQM, SAM, and VNQM; however, the SAM piece is what I was assigned since I currently administrate SCOM.  Additional Polling Engine license approval should be coming soon.

                                 

                                Just getting my hands dirty with what we have currently.

                                1 of 1 people found this helpful
                                  • Re: General SAM Questions Involving WMI
                                    jm_sysadmin

                                    If you have access into Orion, and can import a node things will start to make more sense quickly. Just the import process will show you alot of what has been mentioned, assuming the WMI communication is all worked out. If you don't see stuff, try to get admin access to a test box so you can see what it should look like. Also, if you don't have an account with the Solarwinds support, ask for the lowest level one. The recorded classes at: Virtual Classrooms | SolarWinds Customer Portal  will jump start you in the right direction.

                                    1 of 1 people found this helpful
                                      • Re: General SAM Questions Involving WMI
                                        thwackdude

                                        JMm_Sysadmin, thank you again,

                                         

                                        I do have access to Oroin and have been zipping around getting use to things.  I have 9 or so test boxes but getting WMI configured and working I think is first on my list; however, being able to test it with my template is also a part of that.  As I said before, the whole WMI query string sort of stopped me dead but now that I understand that WMI as a fetching method and the parameters don't necessarily have to be the query string (e.x. Windows Performance Monitor component type), I think I have some ammo to continue.

                                        1 of 1 people found this helpful
                                      • Re: General SAM Questions Involving WMI
                                        rharland2012

                                        Okay, that simplifies your life. Here's what I do when building SAM templates.

                                         

                                        1. Make sure the node is imported into NPM already via WMI. That gets a plethora of basic network/compute/disk stuff, as I'm sure you know.

                                         

                                        2. Isolate the application-specific metrics you want to monitor and measure.

                                         

                                        3. If you want to just expose all the WMI metrics readily presented by a system, the Component Monitor Wizard is going to be your very good friend. Start there and see what's readily extractable.

                                         

                                        4, Repeat, building appropriate SAM templates from the groups of measured components that you deem valuable.

                                         

                                        I've been pleasantly surprised over the years how effective this admittedly basic technique has been for me.

                                        3 of 3 people found this helpful
                                          • Re: General SAM Questions Involving WMI
                                            thwackdude

                                            Rharland2012,

                                             

                                            RE: 1. I get what you are saying but I have a follow up.  If it is imported into NPM does that differ from importing into SAM? Or, a I correct in thinking of the Orion stack as a whole and the modules (SAM, NPM, NQM) are simply different functional add-ons?  NPM is already set up for all network components (Switches, Routers).  As far as I know, the two Windows servers that were imported were done using SAM; however, the way I'm seeing it the network discovery covers every module so I may have been misinformed.

                                             

                                            I will make note of your answer for a simplified process document, thank you.

                                              • Re: General SAM Questions Involving WMI
                                                rharland2012

                                                I view them (NPM vs SAM) as parts of a whole. I look at it this way - I know I want to get the NPM-centric metrics from any Windows box I want to monitor, so I'm going to do that anyway. What that process gives is a ready exposure of the WMI metrics across an entire server once added. I use the method I listed to isolate exactly what I want to look at, and then use filtering abilities inside of the component pieces of custom SAM templates to tune those things to my needs. It's relatively easy and works like a charm for me.

                                              • Re: General SAM Questions Involving WMI
                                                thwackdude

                                                Even though all of the responses are fairly great, I went ahead and marked this as the answer.  I am still curious about the query string building but not all hope is gone doing WMI as I had previously thought and some of my sanity has returned.  I just didn't want to leave this thread open over the weekend.  Thank you all and I will be back.

                                      • Re: General SAM Questions Involving WMI
                                        thwackdude

                                        I think that I may have preemptively posted ahead of poking around a bit more and possibly asking the wrong questions.  I was focused primarily on the following article Create, apply, and alert on a WMI monitor - SolarWinds Worldwide, LLC. Help and Support .  However, what I am finding is WMI as a fetching method can be used for a multitude of component monitors (Windows Service Monitor, Window Performance Counter Monitor), instead of using just WMI with WQL as an assignment.  I still would like to hear from others that have created their own queries.

                                        • Re: General SAM Questions Involving WMI
                                          mikegale

                                          Worry not, we don't have any agents deployed and run all sorts of Powershells against 1000s of servers. Make sure to explore the different components that come with SAM before you start scripting. These SolarWinds guys are on the ball and have already added all kinds of stuff. What kind of tasks are you looking to accomplish with the powershell? I'm always up for a challenge if it's something I can "kind of" replicate.

                                            • Re: General SAM Questions Involving WMI
                                              thwackdude

                                              Mikegale, thank you for your response.

                                               

                                              First of all, it is interesting to find out I should be able to run Powershell scripts, it's something we never go around to in SCOM, hopefully I can get to it in Solarwinds.  Currently, with my original post I ran across an article by Solarwinds on how to create, apply and alert on a WMI monitor which states to enter in a query string and I am having an issue building those.  I've seen few old programs that help with queries.  Having said that, going through other documentation, more hands on, and this post here I built a test template using a Performance Counter Monitor with WMI as a fetching method.

                                               

                                              To sum it up, I haven't gotten to the point of using remote powershell and I'm more trying to understand monitoring with WMI only in regard to templates.  I suppose I was under the impression that most templates were built with the Orion Agent in mind.  Also having to reverse engineer what has been done with SCOM over the years and cut the fat.