Invoke-IcingaCheckMemory - permission problems are not reflected in plugin output

[K0nne]

Hello,

I'm about to test the powershell plugins via powershell remoting against a test system. My user has currently no access to read perf counters on the target host.

When I tested Invoke-IcingaCheckMemory and Invoke-IcingaCheckCPU and stumbled upon this problem I was surprised that both checks showed a different plugin result:

Invoke-IcingaCheckMemory
returns OK but shows internal errors

invoke-command -computername FQDN -ScriptBlock { Use-Icinga; Invoke-IcingaCheckMemory; } -credential $cred -authentication negotiate

Get-CimInstance: Access denied
RuntimeException: Attempted to divide by zero.
MethodInvocationException: Exception calling "Format" with "2" argument(s): "Value cannot be null.
Parameter name: args"
[OK] Check package "Memory Usage"
| 'memory_percent_used'=%;;;0;100 'used_bytes'=0B;;;0
0

Invoke-IcingaCheckCPU returns UNKNOWN and an helpful advice about the problem

invoke-command -computername FQDN -ScriptBlock { Use-Icinga; Invoke-IcingaCheckCPU; } -credential $cred -authentication negotiate

[UNKNOWN]: Icinga Permission Error was thrown: PerformanceCounter

A Plugin failed to fetch Performance Counter information. This may be caused when the used Service User is not permitted to access these information. To fix this, please add the User the Icinga Agent is running on into the "Performance Log Users" group and restart the service.

I think Invoke-IcingaCheckMemory should behave like Invoke-IcingaCheckCPU and also point to the permission problem. Those hints are very helpful, btw 👍

Thank you!

PS: I tested all available checks in this repo against this "access denied" scenario. Half of them return UNKOWN, but the other half returns OK.

[LordHepipud]

Thank you very much for the feedback. I honestly never expected WMI/CIM instances to be used without a default permission set to be honest 😛

But you are right, this should be addressed and fixed. I will have a look on this on how to make this work properly.

Thank you a lot !

[K0nne]

My company is very security-aware. I have to go step by step in sense of access rights until it works 😅

During my journey so far I also found out, that the automatic unit detection in this check does not work, if there's no access to the CIM class Win32_LocalMemory. I think I'm the only one ever with this problem 😂

But when I think about it, maybe it whould be good to return the not accessible class(es) in the plug-in output to give a hint where to search.

[LordHepipud]

Yeah, I fully agree on this. Just have to figure out a way to do this the most easiest way 😄

[LordHepipud]

I'm currently about to have a look on this issue and would require one additional input: When you run

try {
    Get-CimInstance -ClassName Win32_PhysicalMemory -ErrorAction Stop;
} catch {
    $_.Exception.StatusCode;
    $_.Exception.NativeErrorCode;
}

what do you get as output in PowerShell? With this I can add a proper error handling for this. In addition, what happens if you run the same command as WMI:

try {
    Get-WmiObject -Class Win32_PhysicalMemory -ErrorAction Stop;
} catch {
    $_.Exception.HResult;
}

Thank you in advance!

[LordHepipud]

I have updated the Framework master now and created a new branch for the plugins, implementing the new wrapper function for WMI/CIM calls.

I would apprecicate if you could test them if everything still works as expected and if you would provide me with the error id for the permission error. Once this is done I can merge everything into the master.

The plan would be to support this entirely with 1.2.0

[K0nne]

I reproduced it by removing rights:

try {
    Get-CimInstance -ClassName Win32_PhysicalMemory -ErrorAction Stop;
} catch {
    $_.Exception.StatusCode;
    $_.Exception.NativeErrorCode;
}

2  

PSComputerName           RunspaceID              Value
--------------           ----------              -----
fqdn                     id                      AccessDenied

try {
    Get-WmiObject -Class Win32_PhysicalMemory -ErrorAction Stop;
} catch {
    $_.Exception.HResult;
}

-2146233087

The following steps were done to make it work again:

• add the used remote user to the group "Remote Management Users"
• the group needs access to the wmi branch "root/cimv2"
• add the permission "Remote enable"

[LordHepipud]

Thank you very much. Does this step by adding the permissions and the group resolve it for both - CIM and WMI or are different steps required in addition?

[K0nne]

I made a mistake before. Instead of Get-WmiObject -Class Win32_PhysicalMemory -ErrorAction Stop; I had executed Get-CimInstance -Class Win32_PhysicalMemory -ErrorAction Stop; I corrected the errorcode accordingly.

Yes, by adding the permissions both are working. Its reproduceable. WMI & CIM seems to be connected.

I will test both packages in the next few days.

[LordHepipud]

Allright - thank you a lot! Would it be possible for you to test the new Framework Master and the Plugin test-branch Icinga Plugins WMI/CIM Wrapper?

[LordHepipud]

In addition: Could you please test this part as well?

try {
    Get-WmiObject -Class Win32_PhysicalMemory -ErrorAction Stop;
} catch {
    $_.CategoryInfo.Category;
}

The error id seems to be not unique, so I might have to take to error category for identification

[K0nne]

try {
    Get-WmiObject -Class Win32_PhysicalMemory -ErrorAction Stop;
} catch {
    $_.CategoryInfo.Category;
}

The returned value is InvalidOperation

[LordHepipud]

Thank you very much! The master of the Framework is up-to-date with the latest code part and the plugins within the dev branch should also cover the occured issue. I also updated the developer guide for the new functionality.

Would you be able to test the Framework and the Plugin Test-Branch on your machines without having permissions to execute CIM/WMI calls and report back if this works properly now with the new exception handling? Plugin Test-Branch

Thank you in advance!

[K0nne]

Its looking way better now 👍

[UNKNOWN]: Icinga Permission Error was thrown: CimInstance: Win32_ComputerSystem
The user you are running this command as does not have permission to access the requested Cim-Object. To fix this, please add the user the Agent is running with to the "Remote Management Users" groups and grant access to the WMI branch "root/cimv2" and add the permission "Remote enable".

[K0nne]

On a sidenote:

Yesterday in the evening I stumbled upon a new permission problem, which affects all of my perfcounter checks, which I wanted to rollout today for MSSQL :~ I don't know where its coming from, because the confguration worked before. Something has changed.

I placed the new packages here and the output is as following:

Service: Disk Avg. sec/Read

Exception calling "SourceExists" with "1" argument(s): "The source was not found, but some or all event logs could not
be searched.  Inaccessible logs: Security."

At C:\Program 

Files\WindowsPowerShell\Modules\icinga-powershell-framework\lib\core\logging\Register-IcingaEventLog.psm1:3 char:5

+     $Registered = [System.Diagnostics.EventLog]::SourceExists(

+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException

    + FullyQualifiedErrorId : SecurityException

New-EventLog : Access is denied. Try running the command again in a session that has been opened with elevated user 

rights (that is, Run as Administrator).

At C:\Program 

Files\WindowsPowerShell\Modules\icinga-powershell-framework\lib\core\logging\Register-IcingaEventLog.psm1:11 char:5

+     New-EventLog -LogName Application -Source 'Icinga for Windows';

+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    + CategoryInfo          : InvalidOperation: (:) [New-EventLog], Exception

    + FullyQualifiedErrorId : AccessIsDenied,​Microsoft.PowerShell.Commands.NewEventLogCommand

[OK] Check package "Performance Counter""

Its the same with the check package "CPU Load".

The strange thing is: the checks are working. I'm getting graphs and perfdata. I'm not sure what's up with the eventlog here, because I want to monitor perfcounter. Should I open a new issue for this?

[K0nne]

When I change the packages back to the versions when I first configured the checks (framework: 1.0.2, plugins: 1.0.0), the permission errors are gone.

[LordHepipud]

This could occur because the EventLog Writer was enabled with 1.1.0. Could you please open a new issue for this error? I will look into it right away.

Thank you a lot !

[LordHepipud]

Thank you for all the support!