topic Re: WMI polling failures in General Topics

WMI polling failures

jasbeck — Mon, 19 Mar 2012 17:59:51 GMT

Is anyone experiencing WMI polling failures? We're using user id agent 3.1 with PAN OS 4.1.3 to support Kerberos and leverage our MS AD group based security rules in the PAN, but WMI polling has been incosistent. All appropriate permissions exist, but I've seen the user id wmi poll fail but when I run a WMI poll by hand using a Perl script we wrote it works and identifies the user appropraitely (same machine, same login, everything).

I’ve seen polling being initiated from the same system with the same account have inconsistent results: sometimes it fails with a “netbios disabled” error in the log and immediately after it works (via a manual WMI polling perl script we made). Any ideas? As mentioned, the account has necessary permissions (domain admin). I was thinking traffic levels, which would fail the manual probe too though I think, but reaching out and seeing if anyone has ever seen something similar.

Re: WMI polling failures

sspringer — Thu, 22 Mar 2012 21:33:13 GMT

Hello Jasbeck,

I have not seen any reports of WMI polling failures that are not related to permissions.

It is possible the WMI probes are getting blocked on the network. Have you confirmed with client packet captures that the workstation is receiving the probes from the user-id agent?

Also have you been able to test with user-id agent 4.1.x to see if issue is still present?

If so, I would recommend opening a support case to further investigate the issue.

- Stefan

Re: WMI polling failures

jasbeck — Thu, 22 Mar 2012 22:01:24 GMT

Hi Stefan,

I thought permissions and network ACLs as well at first, but here's the crux: the user id agent fails the WMI poll, but I can manually run a WMI poll from command line and it polls correctly (using same computer, same account as user id service, etc...). So it's not a permissions nor a networking issue. It's intermittent as well to add to the problem.

We have not installed the new agent as we are leveraging Kerberos instead of LDAP for user to group mappings. We have plans to move to the newer agent and use LDAP instead of Kerberos, but not at this time.

Re: WMI polling failures

sspringer — Fri, 23 Mar 2012 05:23:08 GMT

Hi Jasbeck,

The next steps I would suggest would be to enable 'Verbose' logging on the agent and gather simultaneous packet captures from the client and the machine running the user-id agent.

- Stefan

Re: WMI polling failures

jasbeck — Mon, 26 Mar 2012 17:19:51 GMT

I've opened a ticket but it's been in "reasearch" since 19 March. Hence my open post to here to see what other ideas folks may have.