🥇Easy DFS Replication Monitoring in Zabbix

Introduction

In a sufficiently large and distributed infrastructure using DFS as a single point of access to data and DFSR for replicating data between data centers and branch servers, the question of monitoring the status of this replication arises.
Coincidentally, shortly after we began using DFSR, we started implementing Zabbix to replace the existing array of various tools and to bring infrastructure monitoring to a more informative, comprehensive, and logical format. The purpose of this article is to discuss using Zabbix to monitor DFS replication.

First, we need to determine what DFS replication data should be collected to monitor its status. The most relevant indicator is the backlog. This includes files that have not been synchronized with other members of the replication group. You can check its size using the utility dfsrdiag, which is installed along with the DFSR role. Under normal replication conditions, the size of the backlog should approach zero. Thus, large values of files in the backlog indicate problems with replication.

Now, let’s discuss the practical side of the issue.

To monitor the size of the backlog via Zabbix Agent, we will need:

A script that will parse the output dfsrdiag to provide final backlog size values to Zabbix,
A script that will determine how many replication groups exist on the server, which folders they replicate, and which other servers are included (we don’t want to manually enter this into Zabbix for each server, do we?),
Incorporating these scripts as UserParameter in the Zabbix agent configuration for subsequent calls from the monitoring server,
Running the Zabbix agent service under a user account that has permission to read the backlog,
A template for Zabbix that will configure group discovery, process the received data, and issue alerts based on it.

Parser Script

For writing the parser, I chose VBS as the most universal language present in all versions of Windows Server. The logic of the script is simple: it receives the name of the replication group, the replicating folder, and the names of the sending and receiving servers via the command line. Then, these parameters are passed to dfsrdiag, and depending on its output, it provides:
The number of files — if a message indicates that there are files in the backlog,
0 — if a message about missing files in the backlog (‘No Backlog’) is received,
-1 — if an error message is received dfsrdiag while executing the request ("[ERROR]").

get-Backlog.vbs

strReplicationGroup=WScript.Arguments.Item(0)
strReplicatedFolder=WScript.Arguments.Item(1)
strSending=WScript.Arguments.Item(2)
strReceiving=WScript.Arguments.Item(3)

Set WshShell = CreateObject ("Wscript.shell")
Set objExec = WSHshell.Exec("dfsrdiag.exe Backlog /RGName:""" & strReplicationGroup & """ /RFName:""" & strReplicatedFolder & """ /SendingMember:" & strSending & " /ReceivingMember:" & strReceiving)
strResult = ""
Do While Not objExec.StdOut.AtEndOfStream
	strResult = strResult & objExec.StdOut.ReadLine() & "\"
Loop

If InStr(strResult, "No Backlog") > 0 then
	intBackLog = 0
ElseIf  InStr(strResult, "[ERROR]") > 0 Then
    intBackLog = -1
Else
	arrLines = Split(strResult, "\")
	arrResult = Split(arrLines(1), ":")
	intBackLog = arrResult(1)
End If

WScript.echo intBackLog

Discovery script

In order for Zabbix to automatically detect all replication groups present on the server and determine all the required parameters for the request (folder name, names of neighboring servers), we need to first obtain this information and then present it in a format understandable to Zabbix. The format that the discovery tool understands looks like this:

        "data":[
                {
                        "{#GROUP}":"Share1",
                        "{#FOLDER}":"Folder1",
                        "{#SENDING}":"Server1",
                        "{#RECEIVING}":"Server2"}

...

                        "{#GROUP}":"ShareN",
                        "{#FOLDER}":"FolderN",
                        "{#SENDING}":"Server1",
                        "{#RECEIVING}":"ServerN"}]}

The information we are interested in can be easily obtained via WMI by extracting it from the relevant sections of DfsrReplicationGroupConfig. As a result, a script was created that forms a request to WMI and outputs a list of groups, their folders, and servers in the required format.

DFSRDiscovery.vbs


dim strComputer, strLine, n, k, i

Set wshNetwork = WScript.CreateObject( "WScript.Network" )
strComputer = wshNetwork.ComputerName

Set oWMIService = GetObject("winmgmts:\" & strComputer & "rootMicrosoftDFS")
Set colRGroups = oWMIService.ExecQuery("SELECT * FROM DfsrReplicationGroupConfig")
wscript.echo "{"
wscript.echo "        ""data"":["
n=0
k=0
i=0
For Each oGroup in colRGroups
  n=n+1
  Set colRGFolders = oWMIService.ExecQuery("SELECT * FROM DfsrReplicatedFolderConfig WHERE ReplicationGroupGUID='" & oGroup.ReplicationGroupGUID & "'")
  For Each oFolder in colRGFolders
    k=k+1
    Set colRGConnections = oWMIService.ExecQuery("SELECT * FROM DfsrConnectionConfig WHERE ReplicationGroupGUID='" & oGroup.ReplicationGroupGUID & "'")
    For Each oConnection in colRGConnections
      i=i+1
      binInbound = oConnection.Inbound
      strPartner = oConnection.PartnerName
      strRGName = oGroup.ReplicationGroupName
      strRFName = oFolder.ReplicatedFolderName
      If oConnection.Enabled = True and binInbound = False Then
        strSendingComputer = strComputer
        strReceivingComputer = strPartner
        strLine1="                {"    
        strLine2="                        ""{#GROUP}"":""" & strRGName & """," 
        strLine3="                        ""{#FOLDER}"":""" & strRFName & """," 
        strLine4="                        ""{#SENDING}"":""" & strSendingComputer & ""","                  
        if (n < colRGroups.Count) or (k < colRGFolders.count) or (i < colRGConnections.Count) then
          strLine5="                        ""{#RECEIVING}"":""" & strReceivingComputer & """},"
        else
          strLine5="                        ""{#RECEIVING}"":""" & strReceivingComputer & """}]}"       
        end if		
        wscript.echo strLine1
        wscript.echo strLine2
        wscript.echo strLine3
        wscript.echo strLine4
        wscript.echo strLine5	   
      End If
    Next
  Next
Next

I agree, the script may not shine with code elegance, and there is surely something that can be simplified in it, but it successfully performs its main function — to provide information about the parameters of replication groups in a format understandable by Zabbix.

Inserting scripts into the Zabbix agent configuration

It's quite simple here. At the end of the agent configuration file, we add the following lines:

UserParameter=check_dfsr[*],cscript /nologo "C:Program FilesZabbix Agentget-Backlog.vbs" $1 $2 $3 $4
UserParameter=discovery_dfsr[*],cscript /nologo "C:Program FilesZabbix AgentDFSRDiscovery.vbs"

Of course, we adjust the paths to where our scripts are located. I placed them in the same folder where the agent is installed.

After making changes, we restart the Zabbix agent service.

Changing the user under which the Zabbix Agent service runs

To receive information through dfsrdiag, the utility must be run under the account with administrative rights on both the sending and receiving members of the replication group. The Zabbix agent service, by default running under the system account, will not be able to perform such requests. I created a separate account in the domain, granted it administrative rights on the necessary servers, and configured the service to run under that account on these servers.

There is another approach: since dfsrdiag, it essentially works through the same WMI, we can use the description, on how to grant domain accounts rights to use it without giving administrative rights, but if we have many replication groups, granting rights for each group would be cumbersome. However, if we want to monitor the Domain System Volume replication on domain controllers, this may be the only acceptable option, as granting domain admin rights to the monitoring service account is not the best idea.

Monitoring template

Based on the received data, I created a template that:

Runs automatic discovery of replication groups once an hour,
Checks the backlog size for each group every 5 minutes,
Contains a trigger that issues an alert if the backlog size for any group exceeds 100 for 30 minutes. The trigger is described as a prototype that is automatically added to discovered groups,
Builds graphs of backlog size for each replication group.

You can download the template for Zabbix 2.2 here.

Summary

After importing the template into Zabbix and creating an account with the required rights, we only need to copy the scripts to the file servers we want to monitor for DFSR, add two lines to the agent configuration on them, and restart the Zabbix agent service, configuring it to run under the necessary account. No further manual configurations for monitoring DFSR will be required.

Source: habr.com