Not receiving WBEM events HP SIM 7.5

[sjosz]

I've installed HP SIM 7.5 and we want to monitor all the servers via the WBEM protocol.

On all Windows 2008r2 x64 systems that we have I installed the WBEM agents. I can then discover each system via WBEM. After this I'm able to see the Hardware status that is retreived via WBEM. So monitoring these servers via that protocol works fine:

To be able to say this with more confident, I pulled out the plug of the power supply which changed the status of the server from 'normal' to 'critical'. The problem is that HP SIM wont show any related events and therefore I wont receive an e-mail (which is crucial for me :). If I pull the plug of an ESXi 5.5 machine's redunant power supply, an event in HP SIM will show up and I will receive an e-mail.

What I have done:

- Disabled the firewall on HP SIM server and client (Windows 2008r2 x64);

- Subscribed succesfully to WBEM events;

- Reïnstalled agents;

- Rebooted both machines;

- Verified that in the SMH web interface, the data source is WBEM and not SNMP;

- Test events via SMH web interface and WBEM test tool will not show up in HP SIM;

- The option 'Accept unregistered events' is enabled.

To summarize: WBEM events that originate from Windows 2008 r2 x64 servers WONT show up in HP SIM. If the WBEM events originate from a ESXi 5.5 hypvervisor, then an event WILL show up in HP SIM.

Any idea on how to troubleshoot this problem further? 

Thank you

[n0kia]

WBEM/WMi windows events comes in differently ( dcom/random dynamic ports ) than ESXi, ESXi comes in through 5989.

Any windows firewall on in between? I would disable them. Are you able to to see the HP Test WBem Event under your All Programs HP/Hewlett Packard folder? It should be listed there Right click and run as admin to test.

Reinstall/Restart the Pegusus WMIMapper Indication Service, this is what translates the information into SIM. It should be SIM installer zip under the Pegasus folder or Mapper

[sjosz]

Thank you for your response!

There is no firewall inbetween. And yes, I have seen the HP WBEM test tool and I have run it; unfortunally the message will not show up in SIM. Reïnstalling and restarting the services WMI mapper on the SIM doesn't work.

The WBEM test events from a client will show up in Wireshark that I'm running on the SIM server. The WBEM/wmi events are send to port 135 and originate form dynamic ports. The process that is listening to port 135 is SVCHOST.exe which is in use by services RpcSs (Remote Procedure Call (RPC)) and RpcEptMapper (RPC Endpoint mapper), is this correct behaviour?

The WBEM events that originate from a ESXi machine are going via the WMI mapper and are then shown in HP SIM. Am I correct that WBEM test events that originate from Windows are actually WMI events? Shouldn't these event go to the WMI mapper instead of the RPC services? (since the documentation is saying: "Since Windows systems use WMI, the WMI Mapper is used to convert WBEM queries into WMI and WMI responses into WBEM.").

It is really anoying that the documentation is not showing any useful information.

[sjosz]

I hope someone can help me with this :)

Otherwise I will configure the clients to send SMTP traps to the HP SIM. I noticed it works like that also, except I would like this to be my last resort.

[upAndup448768]

I believe that the port that listens for these "test WBEM" alerts is dynamically chosen at boot.  It would make sense that it is actually using WMI under the hood on windows.   If you google "wmi ports" you will find more information.

I ran a wireshark capture on my HP SIM server while sending a successful test WBEM event from a client and noticed an initial connection to port 135 and then a longer connection to port 56831.

I then ran 'netstat -anb' from an elevated command prompt and saw that a program named 'wbemcons.exe' was listening on port 56831.

I would suggest to try (temporarily) turning off the firewall on your HP SIM server, or put in a firewall exception for the "C:\Program Files (x86)\The Open Group\WMI Mapper\bin\wbemcons.exe" program. I would not recommend putting in a firewall rule just for the port because it most likely be different each time you boot your system.