Running external commands from a threshold

[mrossTTX]

hey.. from what i understand, you can use thold and syslog to POSSIBLY invoke an external command? is that correct? if so, any tips on setting it up?
what im really after right now is having cacti detect a service has stopped on a client, and then restart it, and alert us... is that at all possible?
im running cacti 1.2.22 on a windows server

[TheWitness]

Thold supports a Warning Command, Alert Command, and Restoral Command. You simply pass in an executable path, and then in the script, you can read all the alert details in variables labeled "THOLD*" in the environment of the script. It's pretty strait forward once you get the hang of it.

[mrossTTX]

thanks.. in thold, i dont see a place to put in an executable should the thold be breached.

[Osiris]

You may be running an old version.

[mrossTTX]

currently running v 1.6

[TheWitness]

Look at the Threshold Template...

[mrossTTX]

thanks for that.. do the commands\script i want to run have to live in the thold directory on the cacti server, or somewhere on the target system?

[TheWitness]

Everything path in that page is Cacti centric, if you want to run a command on a foreign host, SSH is your best option using a private key or whatever.

[mrossTTX]

Everything path in that page is Cacti centric, if you want to run a command on a foreign host, SSH is your best option using a private key or whatever.

when you say cacti centric.. do you mean the commands and\or batch files and\or scripts need to reside somewhere on the cacti server for me to fire them off?
for example.. i have a server that im monitoring a service.. i get an alert when its not running, i want to fire off some type of command to remotely restart that service. can this be done?

[Osiris]

Through ssh, yes.

[mrossTTX]

hmm.. gonna have to figure that part out.

[mrossTTX]

im still trying to get this working.
i have a server, and im monitoring the spooler service.
when its down, i want it to email me(it does)
then fire off this command
sc \\servername start spooler

ive verified i can run that command by hand, and via a batch file OUTSIDE of cacti so the command and syntax is good.
on my threshold for the low trigger warning i have this is that box
./service.bat

i have that bat file in both the thold plug in dir and the cacti root dir.
my cacti server is running on windows. i know im doing something wrong but I need a guide here if possible.

[TheWitness]

Windows "may" be a problem. First make sure that the account that Cacti scheduled task is running as can also run these commands. Second, if your binary includes a path with spaces, make sure you quote it. Lastly, you can add some additional tracing into where the command is being executed in thold.

[mrossTTX]

ok i just changed my bat file to be
C:\Windows\System32\sc.exe \\<HOSTNAME> start spooler
im currently waiting to see if this works.

[mrossTTX]

so far .. no joy on the burn.
i killed the service i was monitoring.. cacti did email me.. so i know the threshold is working.. but the command didnt fire.
i have it set on that threshold, for the low trigger to run
./service.bat im HOPING thats correct.
i put that file in the scripts folder on cacti
in that bat file is
C:\Windows\System32\sc.exe \\<HOSTNAME> start spooler ( as spooler is the service im monitoring)
ran outside of cacti, that works, but you substitute <HOSTNAME> with the name of the actual server.
Again, I may be doing this totally wrong, which is why I am asking for some education on the subject. getting this going will go a LONG way in cacti adoption at my employer..