What is this?

This knowledgebase contains questions and answers about PRTG Network Monitor and network monitoring in general.

Learn more

PRTG Network Monitor

Intuitive to Use. Easy to manage.
More than 500,000 users rely on Paessler PRTG every day. Find out how you can reduce cost, increase QoS and ease planning, as well.

Free Download

Top Tags


View all Tags

How to create a WMI Custom sensor to retrieve data from Win32_Process

Votes:

0

Trying to retrieve VirtualSize from Win32_Process for httpd.exe:

1. SELECT VirtualSize FROM Win32_Process WHERE Name = 'httpd.exe'

The above query resulted in an error: "Query returned more than one record"

SELECT VirtualSize FROM Win32_Process WHERE ExecutablePath = 'C:\Program Files (x86)\Apache Software Foundation\Apache2.2\bin\httpd.exe'

the above query resulted in an error: "80041017: The query was not syntactically valid"

Any thoughts?

Thank you

-Ed

prtg wmi wmi-custom-sensor wmi-process-sensor

Created on Mar 1, 2010 9:59:37 PM

Last change on Mar 2, 2010 11:46:52 AM by Volker Uffelmann [Paessler Support]



2 Replies

Accepted Answer

Votes:

0

Ed,

first of all we recommend to write your WMI custom queries using our WMI Tester. This way you have a much more direct approach to testing the outcome of your queries.

Start with

SELECT * FROM Win32_MyDesiredWMIClass

and work your way down to the specific constraints you want to use.

As for your question:

  • The first query fails because there is more than one httpd service at work, apparently. PRTG can only process one value for both field and row count. Please execute SELECT * FROM Win32_Process Where Name='httpd.exe' in WMI Tester and see how many results are returned. If there is more than one row with the same executable path you're not able to distinguish these processes (and neither is PRTG and that's the reason why only one result value is accepted by PRTG).
  • The second query fails because backslashes are to be doubled in path strings: SELECT VirtualSize FROM Win32_Process WHERE ExecutablePath = 'C:\\Program Files (x86)\\Apache Software Foundation\\Apache2.2\\bin\\httpd.exe' However, this query is only going to work in PRTG if you have only one httpd.exe process running from this directory.

- Volker

Created on Mar 2, 2010 11:44:32 AM by Volker Uffelmann [Paessler Support]

Last change on Mar 2, 2010 11:48:25 AM by Volker Uffelmann [Paessler Support]



Votes:

0

Thank you, this pointed me in the right direction. Here is the modified query:

SELECT VirtualSize FROM Win32_Process WHERE Name = 'httpd.exe' and ThreadCount > 150

For reference to anyone wanting to monitor Apache processes with WMI:

httpd.exe belongs to Apache and it spawns two separate processes (parent and child) by that name when it starts on Windows. I was able to differentiate between the two by checking that the ThreadCount value on a process is above 150, which would be the case for the child process because that is the way we set it up in Apache config for the web server to accept client requests. The parent, on the other hand, runs with only a few threads.

Created on Mar 2, 2010 6:48:27 PM

Last change on Mar 2, 2010 6:57:32 PM by Torsten Lindner [Paessler Support]




Disclaimer: The information in the Paessler Knowledge Base comes without warranty of any kind. Use at your own risk. Before applying any instructions please exercise proper system administrator housekeeping. You must make sure that a proper backup of all your data is available.