> services. I create a new custom service using one of the NT
> services in the list from the server. I then set the service
> to be monitored. It always
> comes back as down. I have dug through my logs on my firewall
> and I can see that the server is refusing me at port 445.
> Anyone know why this may be happening?
Port 445 is the newer port for direct "SMB over TCP" traffic, which debuted
in Windows 2000. Prior to this, Windows used port 139, which is the
Netbios-over-TCP (or NBT) port, for all SMB traffic.
Is the target server refusing you at 445, or is the firewall refusing it?
If its the firewall, then you might need a new rule to allow 445 traffic
through.
If the target server is refusing you at 445, is it also refusing you at 139?
Newer versions of Windows will try both 139 and 445 simultaneously (for
compatibility with older servers) and use whichever one answers.
A few possibilities relating to the configuration of the target server (as
opposed to the firewall):
(1) Is it running the Windows "Server" service? A.k.a. "File and Printer
Sharing for Microsoft Networks". If not, the NT service monitoring plug-in
won't work because it uses RPC calls that run over SMB (which is provided by
this service).
(2) What user account is the monitoring WUG running under? If a matching
account with the same password does not exist on the target system, the
connection will be refused with an authentication error.
Running a sniffer when you poll the target box could help narrow this down.
TIP: turn the poll off in WUG, turn on your sniffer, and then right-click
the affected host in your map and pick "Check Now". Then you'll just get
the traffic going to that system.
Also the debug log could be helpful here. Open it up (from Logs | Debug
Log... on the main WUG menu) before you do a Check Now, and look for
messages like this:
The check of the NT Service SERVICENAME on 1.2.3.4 succeeded/failed.
Failed to open the NT Service SERVICENAME on 1.2.3.4. Reason: ERRORMSGHERE
You can clip those out of the Debug Log window and send them in an email to
help us diagnose whats going on, if need be.
Hope that helps.
--Tim Farley
IPSWITCH
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/whatsup_forum%40list.ipswitch.com/
