Qlikview Nagios Plugin

Here is a very simple but very powerful DOS batch file for use as a Nagios Plugin to monitor Qlikview Tasks.

You will first need to install net-snmp and then a Nagios client like NSClient++. After that, you need to follow the Qlikview instructions on how to enable SNMP.

Once SNMP is enabled, run this script and pass the OID and the Task name. The results should look like:
OK: Job myjob status is Waiting

Refer to the Qlikview Docs for more information. Lastly, Enjoy!

@echo off
@setlocal enableextensions enabledelayedexpansion

REM Author  : Gou 
REM Date    : 08/01/2013
REM Requires: net-snmp,NSClient++ and qlikview SNMP enabled
REM           http://www.net-snmp.org/
REM          
REM USAGE   : This plugin takes 2 arguments
REM           first argument is the OID (1.3.6.1.4.1.30764.1.2.2.1.1.3.n)
REM           second argument is the name of the Qlikview Task
REM           %script% %OID% %TaskName%
REM           Query OID 1.3.6.1.4.1.30764.1.2.2.1.1.2.n to get the Task Name
REM           Replace n with a number >0 to get individual Task Names/Task Status
REM           Query OID 1.3.6.1.4.1.30764.1.2.2.1.1.3.n to get the Task Status
REM           Last...Refer to the Qlikview Server Reference Manual for more details

REM Run snmpget to get the job status
for /f "tokens=4" %%i in ('snmpget -v 1 -c public 127.0.0.1:4721 %1') do set qvstat=%%i

REM If nothing is returned, go to unknown
if "%qvstat%" == "" GOTO unknown

REM Do some parsing here to remove the quotes
set qvstat=%qvstat:~1,-1%

REM If the status matches, do something
if not x%qvstat:Waiting=%==x%qvstat% GOTO ok
if not x%qvstat:Running=%==x%qvstat% GOTO ok
if not x%qvstat:Aborting=%==x%qvstat% GOTO ok
if not x%qvstat:Finished=%==x%qvstat% GOTO ok
if not x%qvstat:Warning=%==x%qvstat% GOTO warn
if not x%qvstat:Failed=%==x%qvstat% GOTO err

REM If nothing matches, run unknown and exit
:unknown
REM Adjust to warning if you like (exit should be 3)
echo CRITICAL: Status of Job %2 is unknown
exit /B 2

:err
echo CRITICAL: Job %2 failed
exit /B 2

:ok
echo OK: Job %2 status is %qvstat%
exit /B 0

:warn
echo warning: Job %2 state is warning
exit /B 1
REM END

Qlikview SNMP

By default, Qlikview provides a simple way of alerting someone if a job fails. You can see this in the web console where it says to enter an e-mail address.

Although, this works, I prefer to use Nagios to check. However, to do that, I need some way of talking to Qlikview. Good thing they provide the job status via SNMP. However, the documentation only states that they have it. The documentation doesn't tell you much more than that.

So, after mucking around with it for a few days and not getting very far with snmpwalk, I logged a ticket with Tech Support. The original response from Tech Support was that they didn't support snmpwalk.

I called them and they claim to have never heard of SNMP. So, I guided Tech Support to the documentation and Tech Support was surprised.

I gave Tech Support a crash course on SNMP and asked her to go check with someone and get back to me.

About 3 to 4 days later, I got a response. I think this may have come from a second tier support. He said he used a GUI snmp tool and it worked. He pointed me to (http://www.manageengine.com/products/mibbrowser-free-tool/). Ok, fine, it works but now I'm still stuck as I'm having trouble with snmpwalk and snmpget. By the way, he said the MIB file provided was DOA and he sent a working copy (so don't be surprised if you try to load the MIB file you have and it fails)

AND IT WORKS!!

Finally, I figured it out.

First, install the net-snmp tools and then install cygwin (or use the dos prompt if you want; for some reason, the dos prompt doesn't require "-L o" but cygwin does)

net-snmp tools
http://www.net-snmp.org/download.html
cygwin
http://www.cygwin.com

From the cygwin window, type:
snmpwalk -v 1 -c public -L o $hostname:4721 1.3.6.1.4.1.30764.1.2.2.1.1.3
(this returns something but it hangs; not sure why)

snmpget -v 1 -c public -L o $hostname:4721 1.3.6.1.4.1.30764.1.2.2.1.1.3.0
Just continue adding the last digit of the OID to get the next job status. I.e.1.3.6.1.4.1.30764.1.2.2.1.1.3.1
1.3.6.1.4.1.30764.1.2.2.1.1.3.2
1.3.6.1.4.1.30764.1.2.2.1.1.3.3
and so on....

The only caveat is that by default Qlikview decided that SNMP should be off by default so you need to enable it. Example:

enable SNMP for ALL Qlik services in %Program Files%\QlikView\%subdirectories%.

Files to edit are
1.QVManagementService.exe.config
2.QVDistributionService.exe.config
3.QVDirectoryServiceConnector.exe.config

OpenLDAP pwdPolicySubentry and Replication

Over the weekend I decided to create a new policy for system users. The new policy would not enforce password expiration for these special system users.

Everything worked great except the internal aka operational attributes did not replicate over to the consumer.

After reading the man pages, I found that there was an entry in the slapd.conf file. The entry was "attrs=*". This omitted the operational attributes. To correct this, I simply deleted this entry. According to the man pages, the default is "attrs=*,+" which would replicate everything including operational attributes. But wait.... after restarting, it still didn't work. I had to go and modify the affected accounts. The modification must have triggered something and so the modified attribute and all the operational attributes now came over to the consumer.

This is OpenLDAP 2.3.x running on RHEL 5.x using syncrepl.

rmdir: Device or resource busy

I was reconfiguring autofs and when I tried to rmdir one of the directories, I got "Device or resource busy"... ok, so let's just run 'fuser -v /dir'. To my surprise, it returned nothing. Alright, back to good old, lsof and..... nothing.

Strange. Looks like a bug.

So, I had to un-reconfigure autofs and put everything back the way it was. Once I did that, I restarted autofs and fuser -v correctly identified the rogue dir as being held open by autofs.

Now, all I did was, shutdown autofs, removed the rogue dir and reconfigure autofs once again.

taboot except Exception as e

taboot
Traceback (most recent call last):
  File "/usr/bin/taboot", line 19, in ?
    import taboot.cli
  File "/usr/lib/python2.4/site-packages/taboot/cli.py", line 24, in ?
    import taboot.runner
  File "/usr/lib/python2.4/site-packages/taboot/runner.py", line 19, in ?
    from taboot.util import instantiator
  File "/usr/lib/python2.4/site-packages/taboot/util.py", line 25, in ?
    from taboot.log import *
  File "/usr/lib/python2.4/site-packages/taboot/log.py", line 114
    except Exception as e:
                      ^
SyntaxError: invalid syntax

I'm on RHEL 5 and I finally have taboot executing after a lot of effort troubleshooting. It's a terrible show stopper bug. I yum installed it from the EPEL repo and you would think that since you yum installed the command, it would just work right? Well, not with taboot.

The problem was, the syntax in taboot was coded for python v >2.4 but it wants v2.4. So, I had to go replace all of the "as e" errors with ",e".

Apparently, this "as e" vs. ",e" has to do with the version of python.

How to enable LDAP on ajaxplorer

Where is the documentation on how to enable LDAP on ajaxplorer? I couldn't find it. I didn't think they  had any docs. They suggest looking in the forum.

It was very frustrating to say the least because I didn't even know where to start or if what I was doing was the right thing... but hey, it worked.

Alright, anyway... by now, you should have already successfully extract the zip or used the rpm to install your ajaxplorer. If you haven't, you should read their doc on installing it.

Make sure to log in using the admin/admin account and update the password. I'm not sure if this is even required but sounds like a good thing to do.

Go in to the ./conf dir and you will see bootstrap_plugins.php.
Make a backup copy of it in case you want to quickly revert.
Either delete or comment out the section:


"AUTH_DRIVER" => array(
"NAME" => "serial",
"OPTIONS" => array(
"LOGIN_REDIRECT" => false,
"USERS_FILEPATH" => "AJXP_DATA_PATH/plugins/auth.serial/users.ser",
"AUTOCREATE_AJXPUSER" => false,
            "FAST_CHECKS"    => false,
"TRANSMIT_CLEAR_PASS" => false )
),


After that, add a new section like:


"AUTH_DRIVER" => array(
"NAME" => "ldap",
"OPTIONS" => array(
"LDAP_URL" => 'ldap://localhost',
"LDAP_PORT" => '389',
"LDAP_DN" => 'dc=company,dc=com',
"LOGIN_REDIRECT" => false,
"AUTOCREATE_AJXPUSER" => false,
"TRANSMIT_CLEAR_PASS" => true)
),

Now, this is a very simple and basic settings just to get you going. As you can see, there's no bind dn or password, and password is being transferred in the clear. Once you get this working though, you can continue to tweak it to your satisfaction. Just do what they say and check the forums.

You can do some fancy things with MASTER/SLAVE auth. It looks like using MASTER/SLAVE will allow you to have multiple authentication. I haven't tried it as I don't need to have more than one auth.

Nagios SNMP check plugin

I was in need of a basic but cool SNMP Nagios plug-in, so I wrote one.

All I wanted to do was send an snmpget and return a numeric value. If the value was >$warn then throw a warning and if it was >$critical, then throw a critical. Pretty simple right?

Well, this one does it and can be extended easily because you can just keep adding more OIDs.

First of all, you need to make sure you install the Perl Net SNMP.

Then, you can use it like this:
command[check_mysnmp.db]=/opt/nrpe/libexec/check_mysnmp.pl localhost db 20 30

This tells the plug-in to connect to the localhost and to use the db option and set the warn threshold to >20 and critical to >30. In my environment, we have a maximum of 40 DB connections in the DB pool. We normally only see anywhere from 5 to 10 DB connections, therefore, I set the warning to 20 and the critical to 30. Once we hit 30, we definitely know there is a connection leak.

You can add as many OIDs as you want. Just keep adding more to the case statement in the plugin and change the OID to yours. Then, set the threshold to what you need.

So for example... Let's say, you have an OID .1.2.3.4.1.12 and this corresponds to the number of errors that has occurred. Let's say that you can tolerate up to 10 errors at any given time but if you start to see 50 to 100 errors, you want to know about it.

You add the following right after case(db):


 case(apperr)  { $apperr_oid=".1.2.3.4.1.12";
              ($apperr_result,$apperr_exit)=&check_snmp($apperr_oid);
              &time2exit($apperr_exit,$apperr_result); }


Then, in your nrpe config, you would add:
command[check_mysnmp.apperr]=/opt/nrpe/libexec/check_mysnmp.pl localhost apperr 20 30

and here is the wonderful plugin....


#!/usr/bin/perl
#AUTHOR: GOU YANG
#PURPOSE: This is a nagios plugin to check snmp
#pass the host, the oid, the warn threshold and the critical threshold
#
#                      if we can't make an snmp connection  =UNKNOWN  (who knows what happened)
#                      if > warn threshold                  =WARNING  (throw a warning)
#                      if > critical threshold              =CRITICAL (throw a critical)
#                      if less than warn & critical         =OK       (must be ok)
#
# set $theoid  = pick from the list of case below
# set $thewarn = value before throwing a warning
# set $thecrit = value before throwing a critical

use Switch;
use Net::SNMP;

$thehost=shift;
$type=shift;
$thewarn=shift;
$thecrit=shift;

switch($type) {

#the number of used db connection; for example
  case(db)  { $db_used_oid=".1.2.3.4.1.11";
              ($db_result,$db_exit)=&check_snmp($db_used_oid);
              &time2exit($db_exit,$db_result); }

  default   { &check_snmp(); }
}

sub check_snmp{

$theoid=shift;

if ( !$thehost || !$theoid || !$thewarn || !$thecrit ) { &time2exit("UNKNOWN","Make sure to specify host,type,warning,critical values"); }

 else {

  ($session,$error) = Net::SNMP->session(
   -hostname => "$thehost",
   -community => community_string,
   -timeout   => 10);

  if (!$session){ &time2exit("UNKNOWN","$error"); }
   else {

  $result = $session->get_request($theoid);

  if (!$result){ $exitstat="UNKNOWN"; $msg="an error occured"; }

  $session->close;

  %result = %$result;
  foreach my $k (keys %result){
    $snmp_result=$result{$k};}

  }
 }

if ($snmp_result > $thewarn){$exitstat="WARNING";  $msg=$snmp_result;}
if ($snmp_result > $thecrit){$exitstat="CRITICAL"; $msg=$snmp_result;}
if ($snmp_result  !~ m/(\d)/g  ){$exitstat="UNKNOWN";  $msg=$snmp_result;}

return ($snmp_result,$exitstat);

}#sub

sub time2exit{

$exitstat=shift;
$msg=shift;

 switch($exitstat) {

   case(UNKNOWN) { print "UNKNOWN - $msg\n";exit 3; }
   case(WARNING) { print "WARNING - $msg\n";exit 1; }
   case(CRITICAL){ print "CRITICAL - $msg\n";exit 2; }

   default       { print "OK - snmp stat is $snmp_result\n";exit 0; }

 }
}