Windows Monitoring

A New Hope Approach

Issues with Zenoss/WinRM

  • Zenoss implementation with WinRM is unstable
  • Debugging is painful
  • Documented cases where monitoring just isn't working
  • By default lots of overhead for unused metrics (AD,IIS, etc)

Introducing NSClient++

  • monitoring agent sitting on each host to monitor
    • much like WinRM, in this case the "agent" is shipped with windows
  • open source (GPL)
  • mature (10 year old codebase)
  • maintained (latest commit 17h ago)
  • Support for Linux, Windows and more

Push and pull protocols

  • NRPE Nagios Remote plugin Executor (pull)
  • NSCA Nagios Service Check Acceptor (push)
  • NRDP is a replacement for NSCA. (push)
  • check_mk is a protocol utilized by the check_mk monitoring system. (pull)
  • Syslog is a protocol primarily designed for submitting log records. (push)
  • Graphite's carbon (push)

Overview

Zenoss

New Windows ZenPack

  • Device Organizer /Server/Windows
  • 5 Command Datasources
    • ​cpu, memory, pagefile, disk, services
  • 4 Graphs
    • cpu, memory, pagefile, disk
  • ​Alerts for pagefile, disk and services
  • Planned: Modeler for Disks

Command Datasource

/usr/lib64/nagios/plugins/check_nrpe -H ${here/manageIp} -c check_cpu

/usr/lib64/nagios/plugins/check_nrpe -H ${here/manageIp} -c check_service "filter=start_type = 'auto'"

Encryption & Authentication

  • Authentication is based on source IP
  • Encryption is enabled with TLS

DEMO

Windows Monitoring

By Simon Josi

Windows Monitoring

  • 725