Windows Pagefile monitoring with Nagios

WMI

You can access WMI parameters directly with WMI client installed on Linux machine:

Compile and install wmi-client package manually or use compiled packages from www.orvant.com it seem to work with newer versions of Ubuntu as well (14.04 64bit).

Here is an example of wmic usage from command line:

wmic -Uuser%pass //192.168.0.2 "SELECT FileSize FROM Win32_PageFile WHERE Path=c:\"

Now create Nagios Plugin. Examples of using wmic is here. Here is the guide how to create your own Nagios plugin, change it for work with wmic. You'll have something like this:

if [ "$1" = "-w" ] && [ "$2" -gt "0" ] && \
[ "$3" = "-c" ] && [ "$4" -gt "0" ] && [ "$5" = "-h" ] && [ "$6" != "" ] && [ "$7" = "-u" ] && [ "$8" != "" ] && [ "$9" = "-p" ]; then

memPfSize=`wmic -U$8%$10 //$6 "SELECT FileSize FROM Win32_PageFile WHERE Path=c:\" | grep AllocatedBaseSize | awk -F'=' '{print $2}'`

if [ "$memPfSize" -ge "$4" ]; then
  echo "Memory: CRITICAL Pagefile: $memPfSize MB - RES: $memPfSize= MB used!|VIRT=$(($memPfSize*1024*1024));;;; RES=$(($memPfSize=*1024*1024));;;;"
$(exit 2)
elif [ "$memPfSize" -ge "$2" ]; then
  echo "Memory: WARNING Pagefile: $memPfSize MB - RES: $memPfSize= MB used!|VIRT=$(($memPfSize*1024*1024));;;; RES=$(($memPfSize=*1024*1024));;;;"
$(exit 1)
else
  echo "Memory: OK Pagefile: $memPfSize MB - RES: $memPfSize= MB used!|VIRT=$(($memPfSize*1024*1024));;;; RES=$(($memPfSize=*1024*1024));;;;"
$(exit 0)
fi
else
  echo "check_memPfSize v1.0"
  echo "check_memPfSize -w Warning -c Critical -h Host -u Win-User -p Password"
  echo "example of usage:"
  echo "check_memPfSize -w 1024 -c 2048 -h 192.168.0.2 -u Administrator -p adminpassword"
exit
fi

You can access WMI via Python from Linux.

SNMP

If you prefer SNMP you need to install WMI-to-SNMP gateway like SNMP Informant - Advanced on your Windows machine to be able to collect system information including memory and swap. Essentially, this tool provides SNMP MIBs for the system-level WMI instrumentation, which in turn allows the WMI data to be queried by any SNMP management station. It is supported on Windows XP/Vista/2000/2003 and 2008 Servers and allows you to access data from all (over 2000) of the counters.

NSClient

Use NSClient++ on Windows to monitor pagefile.sys size. You need to install NSClient++ as a service. With this plugin for Windows machines you can monitor all other parameters as well. For example you can monitor free memory. There is no need for mayor adaptations in the NSC.ini config file on Windows machine.

Check the size of the pagefile.sys and make sure it stays above 1 gigabyte. Sample Command:

CheckFileSize ShowAll MinWarn=1G  MinCrit=512M File=c:/pagefile.sys

Nagios Configuration:

define command {
  command_name <<CheckFileSize>>
  command_line check_nrpe -H $HOSTADDRESS$ -p 5666 -c CheckFileSize -a ShowAll MinWarn=$ARG2$  MinCrit=$ARG1$ File=c:/pagefile.sys
}

From Commandline (with NRPE):

check_nrpe -H IP -p 5666 -c CheckFileSize -a ShowAll MinWarn=1G  MinCrit=512M File=c:/pagefile.sys

Or with check_paging_file plugin on host side with NSClient++.

Yeah, sadly, I think you're going to end up installing nsclient++.

My first thought was to just write a vbscript or powershell script to check the size of the page file, but my first attempts returned null results because Windows is managing my pagefile. Apparently, this is a common thing.

However, this plugin appears to work. It's also a lot more comprehensive than the quick scribble I attempted. Perhaps this will solve your problem.

You don't state which plugin you're using, but there's no reason you can't use SNMP to check the "Virtual Memory" usage. For example, when you walk this tree (1.3.6.1.2.1.25.2) against a Windows 2008 server with SNMP, you'll see output that includes something like this:

HOST-RESOURCES-MIB::hrStorageDescr.4 = STRING: Virtual Memory
HOST-RESOURCES-MIB::hrStorageDescr.5 = STRING: Physical Memory
<snip>
HOST-RESOURCES-MIB::hrStorageSize.4 = INTEGER: 449485
HOST-RESOURCES-MIB::hrStorageSize.5 = INTEGER: 392141
<snip>
HOST-RESOURCES-MIB::hrStorageUsed.4 = INTEGER: 85263
HOST-RESOURCES-MIB::hrStorageUsed.5 = INTEGER: 104233

It seems that perhaps the plugin you're using is combining both the physical memory and the virtual memory value into a single check?

Maybe you just need a different SNMP plugin. There's an entire Memory category on Nagios Exchange, including some that explicitly list Windows usage. Shop around.

If you can't find an SNMP plugin that does what you want, there are other options...

Since you state that using a Nagios agent (nsclient++) isn't possible, a better method would be to use WMI. Microsoft only implements the bare minimum of SNMP support, but you can check literally everything about a Windows server via WMI. They have an entire WMI object for pagefile usage, for example.

There are lots of WMI checks available on Nagios Exchange (or Monitoring Exchange), like checkwmiplus, check_wmic, or (if you're dealing with many Windows boxes) perhaps nagios-wsc.

And here is some information about setting up WMI correctly for remote access.

You might want to give this question a read; it seems that the numbers you get from SNMP might not be accurate in this case.

Is this okay for you?

Command:

define command{
    command_name    check_win_memusage
    command_line    $USER1$/check_nrpe -H $HOSTADDRESS$ -p 5666 -c checkMem -a MaxWarn=$ARG1$ MaxCrit=$ARG2$ ShowAll type=$ARG3$
    }

Service:

check_win_memusage!90%!95%!paged

NSClient++ 0.4.3 has a built in check_pagefile which can be used to monitors page file utilization.