Can you show me some example warning/critical criteria?

by Posted on

The checks shown on this page are generated using the –iexample=2 parameter.
A valid -H HOSTNAME -u USER and -p PASSWORD must also be passed on the command line.
The examples are run against a test machine (which is not very busy) running Windows Server 2008 R2, IIS v7, SQL Express 2008 and Exchange 2010.

The Theory

Check WMI Plus follows the standard Nagios Plugin warning/critical range defintions for checking values. Read the –help output for details. You want to look at the section titled “WARNING AND CRITICAL SPECIFICATION”.
The generalised Nagios format for ranges is [@]start:end.
Check WMI Plus adds the ability to check against many different values at the same time on the command line. This makes the generalised format for ranges FIELD=[@]start:end.

Check WMI Plus also adds the ability to specify “multipliers” to the numbers that define the range. Multipliers such as m (for Mega) and g (for Giga) can be used. The complete list is shown in –help.

The range format generates warnings/criticals if the value is outside the range defined by start:end. If an @ is specified, the warning/critical is generated if the value is inside the range.

Lets Start Easy

Some of the following commands need at least 2 WMI data samples. If the command output shows Collecting first WMI sample because the previous state data file (/tmp/cwpss_somefilename.state) contained no data. Results will be shown the next time the plugin runs. then you need to run the command a second time to see the output.

The plugin output is colour coded as follows:
Plugin display output
Warning/Critical trigger information
Performance Data

Basic SQL Server Service Check with no Criteria
This checks just lists the services and their state. Some are OK and some have problems.
Command: check_wmi_plus.pl -H HOST -u USER -p PASS -m checkservice -a sql
Output : OK - Found 6 Services(s), 2 OK and 4 with problems (0 excluded). 'Microsoft Search (Exchange)' (msftesql-Exchange) is Stopped, 'SQL Server (SQLEXPRESS)' (MSSQL$SQLEXPRESS) is Running, 'SQL Active Directory Helper Service' (MSSQLServerADHelper100) is Stopped, 'SQL Server Agent (SQLEXPRESS)' (SQLAgent$SQLEXPRESS) is Stopped, 'SQL Server Browser' (SQLBrowser) is Running, 'SQL Server VSS Writer' (SQLWriter) is Stopped.|'Total Service Count'=6; 'Service Count OK State'=2; 'Service Count Problem State'=4; 'Excluded Service Count'=0;

Checkservice defines a “good” service as one that is running and a “bad” service and one that is not running.

Lets Add Some Warning Criteria
If you take a look at the –help output for checkservice you can see that the only Valid Warning/Critical Fields are:
_NumBad (Default), _NumGood, _NumExcluded, _Total.

So, if we want to warn if there is any service that is bad then we would use the following:
Command: check_wmi_plus.pl -H HOST -u USER -p PASS -m checkservice -a sql -w 0
Output : WARNING - [Triggered by _NumBad>0] - Found 6 Services(s), 2 OK and 4 with problems (0 excluded). 'Microsoft Search (Exchange)' (msftesql-Exchange) is Stopped, 'SQL Server (SQLEXPRESS)' (MSSQL$SQLEXPRESS) is Running, 'SQL Active Directory Helper Service' (MSSQLServerADHelper100) is Stopped, 'SQL Server Agent (SQLEXPRESS)' (SQLAgent$SQLEXPRESS) is Stopped, 'SQL Server Browser' (SQLBrowser) is Running, 'SQL Server VSS Writer' (SQLWriter) is Stopped.|'Total Service Count'=6; 'Service Count OK State'=2; 'Service Count Problem State'=4;0; 'Excluded Service Count'=0;
-w 0 is a short form of the full range specification 0:0 which defines a range from 0 to 0. If the number of “bad” services are outside this range then we get a warning state. So, if we find even 1 “bad” service we will get a warning.

Since we have not specified _NumBad, _NumGood etc the default of _NumBad is used. So the warning criteria of -w 0 says that the plugin should go to warning state if it finds more than zero services in a “bad” state.

Now if we want to warn if we find more than zero “good” services we would have to tell the warning criteria that it should apply to the _NumGood value like this:
Command: check_wmi_plus.pl -H HOST -u USER -p PASS -m checkservice -a sql -w _NumGood=0
Output : WARNING - [Triggered by _NumGood>0] - Found 6 Services(s), 2 OK and 4 with problems (0 excluded). 'Microsoft Search (Exchange)' (msftesql-Exchange) is Stopped, 'SQL Server (SQLEXPRESS)' (MSSQL$SQLEXPRESS) is Running, 'SQL Active Directory Helper Service' (MSSQLServerADHelper100) is Stopped, 'SQL Server Agent (SQLEXPRESS)' (SQLAgent$SQLEXPRESS) is Stopped, 'SQL Server Browser' (SQLBrowser) is Running, 'SQL Server VSS Writer' (SQLWriter) is Stopped.|'Total Service Count'=6; 'Service Count OK State'=2;0; 'Service Count Problem State'=4; 'Excluded Service Count'=0;

Given the above states, if we wanted to warn if there were less than 4 “good” services we have use a slightly different form of the range definition. We want to define a range that is from 4 to infinity, so that if we are outside this we get a warning. 4: defines a range like this.
Command: check_wmi_plus.pl -H HOST -u USER -p PASS -m checkservice -a sql -w _NumGood=4:
Output : WARNING - [Triggered by _NumGood<4] - Found 6 Services(s), 2 OK and 4 with problems (0 excluded). 'Microsoft Search (Exchange)' (msftesql-Exchange) is Stopped, 'SQL Server (SQLEXPRESS)' (MSSQL$SQLEXPRESS) is Running, 'SQL Active Directory Helper Service' (MSSQLServerADHelper100) is Stopped, 'SQL Server Agent (SQLEXPRESS)' (SQLAgent$SQLEXPRESS) is Stopped, 'SQL Server Browser' (SQLBrowser) is Running, 'SQL Server VSS Writer' (SQLWriter) is Stopped.|'Total Service Count'=6; 'Service Count OK State'=2;4; 'Service Count Problem State'=4; 'Excluded Service Count'=0;

If we wanted to warn when we found less than 2 “good” services OR more than 4 “good” services we need to define a range of 2 to 4. This is done like 2:4. The command is:
Command: check_wmi_plus.pl -H HOST -u USER -p PASS -m checkservice -a sql -w _NumGood=2:4
Output : OK - Found 6 Services(s), 2 OK and 4 with problems (0 excluded). 'Microsoft Search (Exchange)' (msftesql-Exchange) is Stopped, 'SQL Server (SQLEXPRESS)' (MSSQL$SQLEXPRESS) is Running, 'SQL Active Directory Helper Service' (MSSQLServerADHelper100) is Stopped, 'SQL Server Agent (SQLEXPRESS)' (SQLAgent$SQLEXPRESS) is Stopped, 'SQL Server Browser' (SQLBrowser) is Running, 'SQL Server VSS Writer' (SQLWriter) is Stopped.|'Total Service Count'=6; 'Service Count OK State'=2;4; 'Service Count Problem State'=4; 'Excluded Service Count'=0;

If we just wanted to warn if we find more than 10 services matching “sql” then we need to use the _Total field:
Command: check_wmi_plus.pl -H HOST -u USER -p PASS -m checkservice -a sql -w _Total=10
Output : OK - Found 6 Services(s), 2 OK and 4 with problems (0 excluded). 'Microsoft Search (Exchange)' (msftesql-Exchange) is Stopped, 'SQL Server (SQLEXPRESS)' (MSSQL$SQLEXPRESS) is Running, 'SQL Active Directory Helper Service' (MSSQLServerADHelper100) is Stopped, 'SQL Server Agent (SQLEXPRESS)' (SQLAgent$SQLEXPRESS) is Stopped, 'SQL Server Browser' (SQLBrowser) is Running, 'SQL Server VSS Writer' (SQLWriter) is Stopped.|'Total Service Count'=6;10; 'Service Count OK State'=2; 'Service Count Problem State'=4; 'Excluded Service Count'=0;

Warning If Inside the Range

So far we have specified ranges and warned if we go outside these ranges. Sometimes we need to warn when inside a range. For example, if we only want to warn if there is exactly 1 “bad” service (so less then 1 is ok and more than 1 is ok) then we have to specify a range of 1 to 1 and warn if we are inside this range. To do this we have to invert the range specification using the @.
Command: check_wmi_plus.pl -H HOST -u USER -p PASS -m checkservice -a sql -w @1:1
Output : OK - Found 6 Services(s), 2 OK and 4 with problems (0 excluded). 'Microsoft Search (Exchange)' (msftesql-Exchange) is Stopped, 'SQL Server (SQLEXPRESS)' (MSSQL$SQLEXPRESS) is Running, 'SQL Active Directory Helper Service' (MSSQLServerADHelper100) is Stopped, 'SQL Server Agent (SQLEXPRESS)' (SQLAgent$SQLEXPRESS) is Stopped, 'SQL Server Browser' (SQLBrowser) is Running, 'SQL Server VSS Writer' (SQLWriter) is Stopped.|'Total Service Count'=6; 'Service Count OK State'=2; 'Service Count Problem State'=4;1; 'Excluded Service Count'=0;

Multiple Warning Criteria

You can specify multiple criteria at the same time. For example, if we wanted to go to a warning state if there was more than 1 “bad” service (-w 0), less than 4 “good” services (-w _NumGood=4:) or more than 5 total services (-w _Total=5) we just add them all to the command line at the same time:
Command: check_wmi_plus.pl -H HOST -u USER -p PASS -m checkservice -a sql -w 0 -w _NumGood=4: -w _Total=5
Output : WARNING - [Triggered by _NumBad>0,_NumGood<4,_Total>5] - Found 6 Services(s), 2 OK and 4 with problems (0 excluded). 'Microsoft Search (Exchange)' (msftesql-Exchange) is Stopped, 'SQL Server (SQLEXPRESS)' (MSSQL$SQLEXPRESS) is Running, 'SQL Active Directory Helper Service' (MSSQLServerADHelper100) is Stopped, 'SQL Server Agent (SQLEXPRESS)' (SQLAgent$SQLEXPRESS) is Stopped, 'SQL Server Browser' (SQLBrowser) is Running, 'SQL Server VSS Writer' (SQLWriter) is Stopped.|'Total Service Count'=6;5; 'Service Count OK State'=2;4; 'Service Count Problem State'=4;0; 'Excluded Service Count'=0;

When there are multiple criteria specified, if any one of them is triggered, the plugin will exit with the approriate warning/critical state.

The result of that last command output leads us to the next section –

What Triggered my Warning?

If the check has been defined properly, then it will show which field and which range triggered the warning.
Command: check_wmi_plus.pl -H HOST -u USER -p PASS -m checkservice -a sql -w 0 -w _NumGood=4: -w _Total=5
Output : WARNING - [Triggered by _NumBad>0,_NumGood<4,_Total>5] - Found 6 Services(s), 2 OK and 4 with problems (0 excluded). 'Microsoft Search (Exchange)' (msftesql-Exchange) is Stopped, 'SQL Server (SQLEXPRESS)' (MSSQL$SQLEXPRESS) is Running, 'SQL Active Directory Helper Service' (MSSQLServerADHelper100) is Stopped, 'SQL Server Agent (SQLEXPRESS)' (SQLAgent$SQLEXPRESS) is Stopped, 'SQL Server Browser' (SQLBrowser) is Running, 'SQL Server VSS Writer' (SQLWriter) is Stopped.|'Total Service Count'=6;5; 'Service Count OK State'=2;4; 'Service Count Problem State'=4;0; 'Excluded Service Count'=0;
Notice how the plugin output includes the red text: [Triggered by FIELD~VALUE]
This lists all the warning criteria that were triggered.

This becomes more important when there are multiple fields of data in the output and/or multiple warning/critical criteria.

Multipliers

Checkservices is not the best example to use here (since the numbers are so low), but we will do it anyway, so that we keep the example checks consistently using checkservice and “sql”.

Lets say we wanted to check if we had more than 1000 “bad” services. We could use -w 1000 or we could use the “k” multiplier -w 1k. In order to ensure that “k” means 1000 we use the command line parameter --bytefactor=1000.
Command: check_wmi_plus.pl -H HOST -u USER -p PASS -m checkservice -a sql -w 1k --bytefactor=1000
Output : OK - Found 6 Services(s), 2 OK and 4 with problems (0 excluded). 'Microsoft Search (Exchange)' (msftesql-Exchange) is Stopped, 'SQL Server (SQLEXPRESS)' (MSSQL$SQLEXPRESS) is Running, 'SQL Active Directory Helper Service' (MSSQLServerADHelper100) is Stopped, 'SQL Server Agent (SQLEXPRESS)' (SQLAgent$SQLEXPRESS) is Stopped, 'SQL Server Browser' (SQLBrowser) is Running, 'SQL Server VSS Writer' (SQLWriter) is Stopped.|'Total Service Count'=6; 'Service Count OK State'=2; 'Service Count Problem State'=4;1000; 'Excluded Service Count'=0;

If we wanted “k” to mean 1024 then we use the command line parameter --bytefactor=1024 or leave it out since that is the default setting.

This one generates if warning if there are less than 1024 “good” services:
Command: check_wmi_plus.pl -H HOST -u USER -p PASS -m checkservice -a sql -w 1k:
Output : WARNING - [Triggered by _NumBad<1k] - Found 6 Services(s), 2 OK and 4 with problems (0 excluded). 'Microsoft Search (Exchange)' (msftesql-Exchange) is Stopped, 'SQL Server (SQLEXPRESS)' (MSSQL$SQLEXPRESS) is Running, 'SQL Active Directory Helper Service' (MSSQLServerADHelper100) is Stopped, 'SQL Server Agent (SQLEXPRESS)' (SQLAgent$SQLEXPRESS) is Stopped, 'SQL Server Browser' (SQLBrowser) is Running, 'SQL Server VSS Writer' (SQLWriter) is Stopped.|'Total Service Count'=6; 'Service Count OK State'=2; 'Service Count Problem State'=4;1024; 'Excluded Service Count'=0;

What About Critical?

So far we have only generated warning states. That’s because we have only used -w. If you want to specify critical criteria use -c. If you have both -w and -c on the same command line and if the critical criteria and the warning criteria are both triggered the plugin will exit with a critical state.

For example, if we wanted to go to a critical state if there was more than 1 “bad” service (-c 0), but only a warning state if there was less than 4 “good” services (-w _NumGood=4:) or more than 5 total services (-w _Total=5) we do:
Command: check_wmi_plus.pl -H HOST -u USER -p PASS -m checkservice -a sql -c 0 -w _NumGood=4: -w _Total=5
Output : CRITICAL - [Triggered by _NumBad>0] - Found 6 Services(s), 2 OK and 4 with problems (0 excluded). 'Microsoft Search (Exchange)' (msftesql-Exchange) is Stopped, 'SQL Server (SQLEXPRESS)' (MSSQL$SQLEXPRESS) is Running, 'SQL Active Directory Helper Service' (MSSQLServerADHelper100) is Stopped, 'SQL Server Agent (SQLEXPRESS)' (SQLAgent$SQLEXPRESS) is Stopped, 'SQL Server Browser' (SQLBrowser) is Running, 'SQL Server VSS Writer' (SQLWriter) is Stopped.|'Total Service Count'=6;5; 'Service Count OK State'=2;4; 'Service Count Problem State'=4;0; 'Excluded Service Count'=0;
In this case only the critical triggers are listed.

Published by admin