Many times, we would like to collect information for reporting, or measure and alert on something. Normally, we use Windows Performance Monitors to do this. But, what do we use when a perfmon object/counter/instance doesn't exist?
This post is an example of how to collect WMI information, and insert it into OpsMgr as performance data. From there we can use it in reports and create threshold monitors.
For starters... we need to find the location of the data in WMI. We can use wbemtest to locate it and test our query.
Hit "Connect" and connect to root\cimv2.
For this example - I am going to look at the Win32_OperatingSystem class.
Using Enum Classes, Recursive, I find the class. I notice the class has a property of "NumberOfProcesses". That will do well for this example since the output will be an Integer.
I form the query.... select numberofprocesses from win32_operatingsystem
Ok.... we know our WMI query we want.... now lets dive into the console.
We will start by creating a performance collection rule.... for this query output. Authoring pane, Create a New Rule, Collection Rules, Performance Based, WMI Performance.
Give the rule a name (in accordance with your documented custom rule naming standards), then change the Rule Category to "PerformanceCollection", and then choose a target. I am using Windows Server for this example.
Click Next, and on the WMI Namespace page, enter your namespace, query, and interval. The interval in general should be no more than every 15 minutes, unless you really need a large amount of raw data for reporting. I am using every 10 seconds for an example only.... this is not recommended generally because of the large amount of perf data that will flood the database if we targeted all Agents, or Windows Servers.
The last screen, and most confusing.... is the Performance Mapper. This is where we will give the rule the information it needs to populate the data into the database as ordinary performance data.
First - we need to make up custom names for Object, Counter, and Instance. Just like data from collected from perfmon, we need to supply this.... so I will make up a name for each that makes sense. I will use "NULL" for Instance, as I don't have any instance for this type of data in my example.
For the Value field, this is where we will input a variable, which represents our query output. In general, following this example, it will be $Data/Property[@Name='QueryObject']$ where you replace "QueryObject" with the name of your instance name that you queried from the WMI class. So for my example, we will use:
Click "Create" and we are done! How do we know if it is working?
Well, we can create a new Performance view and go look at the data it is collecting:
Create a new Custom Performance View in My Workspace. Scope it to Windows Server (or whatever you targeted your rule to). Then check the box for "collected by specific rules" and choose your rule from the popup box. As long as you chose "PerformanceCollection" as the rule category, it will show up here.
And check out the Performance view - we have a nice snapshot and historical record of number of processes from WMI: Also not the custom performance Object, Counter, and Instance being entered from our rule:
Ok - fun is over. Lets use WMI to monitor for when an agent has more than 40 processes running!
Create a Unit Monitor. WMI Performance Counters, Static Thresholds, Single Thresholds, Simple Threshold. We will fill out the Monitor wizard exactly as we did the Rule above. However, on Interval, since this monitor will only be inspecting the data on an agent, and not collecting the performance data into the database, we can use a more frequent interval. Checking every 1 minute is typically sufficient. Fill out the Performance Mapper exactly as we did above.
Now.... on the threshold value... I want to set a threshold of 40 processes in this example.
Over 40 = Critical, and under = Healthy. Sounds good.
On the Configure Alerts pane, I am going to enable Alerts, and then add Alert Descirption Variables from http://blogs.technet.com/kevinholman/archive/2007/12/12/adding-custom-information-to-alert-descriptions-and-notifications.aspx
Create it - and lets see if we get any alerts:
Yep. Works perfectly:
A quick check of Health Explorer shows it is working as designed:
You should check out WMI Explorer - http://www.ks-soft.net/hostmon.eng/wmi/index.htm - great tool to browse WMI and get your query right
How would one go about monitoring multiple instances returned from a WMI Query? For instance I am trying to monitor memory usage for a specific process which there are multiple instances running at the time. I followed the example but am only getting the first instance of the process returned, is there a way to get all of the instances of the query?
So first I have to ask - if you are monitoring memory use from a specific process - why wouldnt you use the built in performance counter for that?
Well I guess my ignorance got the best of me I did not realize there was one for individual processes... Anyhow I did figure out the whole instance thing and have it working, however if it is easier to do it the other way for future reference what is the counter???
BTW Excellent article I can see where this will be very useful in future applications!!!
Process \ Private Bytes \ ProcessName=Instance
Sweet Thanks Process\Working Set\ProcessName seems to do the trick as well!
Thanks for the information.
Could you please note that the values in the performance mapper is case sensitive. I received the following error because I my parameters did not use the correct case.
"Module was unable to convert parameter to a double value Original".
I need to monitor %processor time for all the instances of dllhost, i.e. dllhost, dllhost#1, dllhost#2, etc. How would you do that here? Thanks!
You dont need to use WMI for that.
A simple perf monitor... Process, % Processor Time, dllhost*
That works beautifully and is what I wanted all along. I have asked this question (i.e. can you use wildcards in the instance name) in a number of places, and you're the first one who answered. I figured no reply meant 'no, you can't'. Thanks!
So i'm guessing you cant' edit this after saving? I haven't found a way
i need to monitor all %processor time for all services on a server. How can i do that? Thanks.
I have a need to replicate the "Total CPU Utilization Percentage" scom monitor because the team would like an email at 3 consecutive samples and a page at 10 consecutive samples. I should have looked more closely, it looks like this can be done with "windows performance counters" but it would be "nice" to learn how to do this in WMI.
I believe this is the query: SELECT PercentProcessorTime FROM Win32_PerfFormattedData_PerfOS_Processor WHERE Name="_Total"
That will return processor %. It would be nice if someone knows how to add processor queue length as well.
I've tried a few things but have been unsucessful in that the value returned always seems to be 0.
Since I select the "_total", should the "Monitor Target" be windows_server or "Windows Server 2003 processor"? I believe this should be windows_server and select "NULL" for the instance.
For the Performance Mapper, I've tried:
Object: WMI Processor Pct Total
Value: $ $Data/Context/Property[@Name='PercentProcessorTime']$%
They all seem to return 0 for $Data/Context/Value$ and $Data/Context/SampleValue$
The performance collection rule is working fine. So, I presume my problem is with what I'm using in the Performance Mapper.