Photo by PatCastaldo
This is a continuation of my last post about WMI and Linux. See the previous article here
I’ll provide a bit of a lesson on wmi before getting into the details and information about it as there seems to be a very large lack of information about it overall, outside of the people who seem to code for it.
WMI is in essence WBEM without the actual W in it since it doesn’t actually export it to a web accessible based interface. To actually have the Web Based interface you have to install something that takes WMI and presents it as such. Thank you once again for following standards Microsoft. That something for my case is called WMIMapper provided by the good folks over at http://www.openpegasus.org/. This allows you to actually do http or https requests to the wbem server and get information returned. Without that as far as I’m aware under linux, you’re without hope of getting any information. After you WMIMapper installed you need to either do a configuration change or add an option to the wbemcli program in linux to support the default install. Which for security is https, in my case I’m just doing testing and trying to get information so I’ll be using http.
In the program files/The Open Group/WMI Mapper/ folder you will have two config files cimserver_planned.conf and cimserver_current.conf. In this file is where you set up http or https support. I set http to true and https to false. Restart WMI Mapper at this point and its all ready to go.
On the linux side you want to download and install sblim-wbemcli with your package manager. This will give you wbemcli which is the main tool you’ll be using on the linux side to query the WMI Mapper.
Now you need to have an idea of what you want to look for, but its not that simple as there are many many Namespaces on your servers. All fall under one top tier though which is root. Under that you have such things as aspnet, cimv2 (a main area), cli, default, directory, microsoft, microsoftactivedirectory, microsoftexchangev2(a main spot for exchange?),microsoftiisv2, microsoftnlb, mscluster, perfmon, policy, rsop, security, snmp, subscription, and wmi.
In my case I am going to be looking at exchange data so the first thing we want to do is find out what is under our exchange class (note I’ve found exchange info in two different spots..not sure if both are useful).
To give an idea of the complexity of what you’re about to partake in, this is one section of the much larger exchange options menu.
.internal:5988/root/MicrosoftExchangeV2:Exchange_Logon
-AdapterSpeed
-Caption
-ClientIP
-ClientMode
-ClientName
-ClientVersion
-CodePageID
-Description
-FolderOperationRate
-HostAddress
-InstallDate
-LastOperationTime
-Latency
-LocaleID
-LoggedOnUserAccount
-LoggedOnUsersMailboxLegacyDN
-LogonTime
-MacAddress
-MailboxDisplayName
-MailboxLegacyDN
-MessagingOperationRate
-Name
-OpenAttachmentCount
-OpenFolderCount
-OpenMessageCount
-OtherOperationRate
-ProgressOperationRate
-RowID
-RPCSucceeded
-ServerName
-Status
-StorageGroupName
-StoreName
-StoreType
-StreamOperationRate
-TableOperationRate
-TotalOperationRate
-TransferOperationRate
Next lesson I talk about how to actually go out and find those tables and how to get information from them.
