New Question
 
 
PRTG Network Monitor

Intuitive to Use.
Easy to manage.

200.000 administrators have chosen PRTG to monitor their network. Find out how you can reduce cost, increase QoS and ease planning, as well.

Free PRTG
Download >>

 

What is this?

This knowledgebase contains questions and answers about PRTG Network Monitor and network monitoring in general. You are invited to get involved by asking and answering questions!

Learn more

 

Top Tags


View all Tags


I have tried a lot of things to fix my WMI. What else can I try to avoid reinstalling Windows?

Votes:

0

Your Vote:

Up

Down

My WMI sensors keep returning with errors that should not occur. What can I do? I don't want to reinstall Windows on that computer.

errors fix kaputt last-resort prtg troubleshooting wmi

Created on Apr 12, 2010 12:14:29 PM by  Volker Uffelmann [Paessler Support]

Last change on Jun 10, 2010 1:36:07 PM by  Volker Uffelmann [Paessler Support]



10 Replies

Accepted Answer

Votes:

0

Your Vote:

Up

Down

The Repair List for WMI problems

WMI is a comprehensive and versatile system for monitoring nearly all apects of a Windows computer. However, as it is very complex and based on a complex communications protocol (DCOM) it tends to be more error-prone than everyone would like it to be. Here is what you can do if you keep getting errors that indicate problems with the WMI system itself.


IMPORTANT

As WMI is primarily a Windows function set, the problems described here should be solved by Microsoft - however, we know how frustrating a search for solutions for WMI problems can be so we offer you these suggestions here. Although these procedures are tested and used sucessfully in many cases we by no means take any responsibility for their outcome and/or negative side effects.

USE AT OWN RISK! IF IN DOUBT ASK MICROSOFT!

Please read our General introduction to WMI and PRTG first! This compilation is gathered from many resources, mainly Microsoft web sites.


Understanding PRTG's use of WMI for monitoring Windows computers

First of all you should be aware that PRTG uses high-level Windows-functions for accessing WMI - so very often an error is caused in the Windows parts of WMI and not in PRTG.

Then you should know that basically three parts are involved in the process of monitoring via WMI:

  • the WMI system on the computer with PRTG's probe
  • the WMI system on the target computer (host).
  • the network between them

In order to determine on which side the problems occur and action needs to be taken, check these criteria:

  • if many/all hosts suddenly show inexplicable WMI errors, it is very likely the WMI system on the computer with the PRTG probe has become corrupted.
  • if the WMI sensors of one host suddenly show inexplicable WMI errors, it is very likely the WMI system on the host computer has become corrupted.
  • if you encounter connection/credential based errors, the firewalls/access rights/domain policies/routers/switches/cables in the network between both sides might interfere with the DCOM communication.
  • if the target computer is running Windows 7 or Windows 2008 R2 Microsoft just might have introduced problems for which they fortunately seem to have a hotfix.

This article tries to offer some help for the first two cases, the network problems are discussed in The most common WMI errors, section "WMI Connection based errors", and in PRTG WMI error messages, section "WMI timeout errors".


The reboot option

The easiest way to get WMI back on the track is to reboot the computer, very often this already helps to get the monitoring back up and running again. As PRTG uses the WMI systems on both sides of a connection you have these two options:

Rebooting the PRTG probe computer

If many/all host computers show inexplicable WMI errors, the WMI system on the computer with the PRTG probe might have become corrupted. Reboot the probe computer and see if that helps.

Rebooting the target computer

if the WMI sensors of one host suddenly show inexplicable WMI errors, it is very likely the WMI system on the host computer has become corrupted. Reboot the host computer and see if that helps.


The WMI diag option

A very good start to approaching WMI problems is the use of Microsoft's very own diagnosis tool, WMIDiag, of course. You can find it in Microsoft's download center (or search Microsoft's website for "WMIDiag", should the download ID have been altered in the meantime).


The restart management services option

If you encounter problems with non-existing counters after installing/restarting software products or virtual machines, a restart of the WMI services might help (example service names shown here for problems with HyperV virtual machines):

net stop iphlpsvc
net stop nvspwmi
net stop vhdsvc
net stop vmms
net stop winmgmt

net start winmgmt
net start vmms
net start vhdsvc
net start nvspwmi
net start iphlpsvc

The rebuild Windows system files option

On Windows Vista and above, the sfc /scannow command repairs Windows system files. This might help with WMI problems. http://support.microsoft.com/kb/929833/en


The re-enable performance counters option

Apparently performance counters can be disabled via the Windows registry. Should this happen after a Windows Update or the installation of some software package, search in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services branch for "Disable Performance Counters". If you find one or more entries set to "1", set them to "0".

One case where this has helped is the WMI Process sensor, where setting this key in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfProc\Performance branch brought red sensors back online.

NOTE: Working with the registry is for advanced users only.


The refresh performance counters option

This will probably fix many problems concerning performance data and is much less intrusive than almost every other suggested method.

Full details about the WMIADAP command here :

http://msdn.microsoft.com/en-us/library/aa394528(VS.85).aspx

Usage :

wmiadap /f

The /f switch still forces an update of the WMI classes from the performance libraries.

wmiadap /r

The /r switch to parse the Windows Driver Model drivers to create performance objects.


The resync performance counters option

The winmgmt console program offers another way of getting corrupted performance counters back on track.

1. Open a command prompt window (Run as Administrator) and enter the following lines.

2. On older Windows systems up to 2003 you have to clear earlier resnyc attempts (on newer systems this will not work): winmgmt /clearadap

3. Then do the resynchronization: winmgmt /resyncperf


The reload performance counters option

As pointed out in this technet article, you can reload the performance counters if you run the folowing command in a administrator-run command line: lodctr /r


The rebuild performance counters option

One customer whose WMI sensors failed even on the local probe device with a 8002802B: Element not found error successfully got WMI working after he executed the following script:

net stop winmgmt
c:
cd %systemroot%\system32\wbem
rd /S /Q repository
 

regsvr32 /s %systemroot%\system32\scecli.dll
regsvr32 /s %systemroot%\system32\userenv.dll
 

mofcomp cimwin32.mof
mofcomp cimwin32.mfl
mofcomp rsop.mof
mofcomp rsop.mfl
for /f %%s in ('dir /b /s *.dll') do regsvr32 /s %%s
for /f %%s in ('dir /b *.mof') do mofcomp %%s
for /f %%s in ('dir /b *.mfl') do mofcomp %%s

The re-register WMI components option

  1. Open a command prompt window (Run as Administrator) and change directory (cd) to %windir%\System32\wbem on 32bit Windows or %windir%\SysWOW64\wbem on 64bit Windows
  2. Enter the following commands:
    for %i in (*.dll) do RegSvr32 -s %i
    for %i in (*.exe) do %i /RegServer

The reinstall the latest service pack option

There's no guarantee it helps, but it's worth a try anyway: install the latest service pack again.


The recompile MOFs option

All WMI counters are defined in text files, the so called MOFs. If rebooting the respective computer didn't help, you could try to rebuild the counters by compiling the MOFs anew. This can be done with standard Windows means:

  1. Open a command prompt window (Run as Administrator) and change directory (cd) to %windir%\System32\wbem on 32bit Windows or %windir%\SysWOW64\wbem on 64bit Windows
  2. Enter the following commands: FOR /f %s in ('dir /b /s *.dll') do regsvr32 /s %s Net stop /y winmgmt FOR /f %s in ('dir /b *.mof *.mfl') do mofcomp %s Net start winmgmt

The rebuild repository option

This should be the very last resort. If your probe computer's WMI is behaving badly and you have the possibility of moving the PRTG probe to a different computer, you should try that first!

  1. Open a command prompt window (Run as Administrator)
  2. Enter the following command: net stop winmgmt
  3. With a Windows Explorer rename the directory %windir%\System32\wbem\repository on a 32bit Windows to %windir%\System32\wbem\repository_old (or %windir%\SysWOW64\wbem\repostiory respectively).
  4. Enter at the command prompt: net start winmgmt
  5. repair the repository depending on your Windows version with the following commands at the command prompt:
    • Windows XP: rundll32 wbemupgd, UpgradeRepository
    • Windows Server 2003: rundll32 wbemupgd, RepairWMISetup
    • Windows Vista and above: winmgmt /salvagerepository

The rebuild Performance Counter Library values option

A pretty lengthy procedure is found in Microsoft's Knowledgebase: How to manually rebuild Performance Counter Library values. Please be sure to read and understand the Important section in that article before you start doing things.


The re-install specific software option

As software that features its own cool WMI performance counters, adds these counters dynamically during its setup process to the WMI system, some of these counters may get lost. So one possible solution might be to re-install this specific software.

Again, there is no guarantee that this will work, and you should ensure that you have backupped your system properly so that none of your settings are in danger by this re-installation of our software.

USE AT YOUR OWN RISK!


The rebuild everything option

We haven't tested this yet, so we can't say if this works with your specific system. Please remember:
USE AT YOUR OWN RISK!
If your probe computer's WMI is behaving badly and you have the possibility of moving the PRTG probe to a different computer, you should try that first! Basically this option reinstalls everything that is needed for WMI, so you very probably need the installation discs / folders of your Windows version. Or a slipstreamed disc, if a service pack has been installed.

  1. Open a command prompt window (Run as Administrator)
  2. Enter the following command: rundll32.exe setupapi,InstallHinfSection WBEM 132 %windir%\inf\wbemoc.inf

The WMI Re-Configuration Option

If you encounter the error message WMI: Generic failure., the WMI repository might be corrupted, or some other system files are corrupted. Try to restore a previous backup first if possible and see if this helps. Otherwise, configure WMI on the target device anew:

  1. Open a command line tool.
  2. Disable and stop the WMI service: sc config winmgmt start= disabled net stop winmgmt
  3. Run the following commands: Winmgmt /salvagerepository %windir%\System32\wbem Winmgmt /resetrepository %windir%\System32\wbem
  4. Re-enable the WMI service: sc config winmgmt start= auto
  5. Reboot the server.
  6. Restart the PRTG core server and try adding WMI sensors anew.

For details, please see this thread on Microsoft TechNet.

Created on Apr 12, 2010 5:01:27 PM by  Volker Uffelmann [Paessler Support]

Last change on Jan 30, 2014 1:22:24 PM by  Gerald Schoch [Paessler Support]



Votes:

1

Your Vote:

Up

Down

I have had very good luck with using 'wmiadap /f' to fix problems with IIS performance counters being inaccessible via WMI after first installing IIS on a new server.

This will probably fix many other problems with WMI gets of performance data and is much less intrusive than almost every other suggested method.

Full details about the WMIADAP command here :

http://msdn.microsoft.com/en-us/library/aa394528(VS.85).aspx

Usage :

wmiadap /f

The /f switch still forces an update of the WMI classes from the performance libraries.

wmiadap /r

The /r switch to parse the Windows Driver Model drivers to create performance objects.

Created on Jun 17, 2010 3:06:18 AM by  Major Weber (10)



Votes:

0

Your Vote:

Up

Down

Thanks for this information, we've added it to the main article above.

Kind regards, - Volker

Created on Jun 17, 2010 10:22:32 AM by  Volker Uffelmann [Paessler Support]



Votes:

0

Your Vote:

Up

Down

None of the above worked for me. Then I found this, and it worked!

winmgmt /clearadap
winmgmt /resyncperf

Created on Dec 7, 2010 11:01:45 PM by  John Bowen (0)

Last change on Dec 8, 2010 9:46:11 AM by  Daniel Zobel [Paessler Support]



Votes:

0

Your Vote:

Up

Down

Thanks, we've added this as well!

Kind regards, - Volker

Created on Dec 8, 2010 11:56:20 AM by  Volker Uffelmann [Paessler Support]



Votes:

0

Your Vote:

Up

Down

Hi,

the following hotfix resolved our WMI problems (WMI stops working after a few days): http://support.microsoft.com/kb/2547244

Created on Sep 26, 2012 7:01:50 AM by  Marcel Wiechmann (0) 1 1



Votes:

0

Your Vote:

Up

Down

Thanks, that's added too! :)

Kind regards, - Volker

Created on Sep 26, 2012 2:59:19 PM by  Volker Uffelmann [Paessler Support]



Votes:

0

Your Vote:

Up

Down

Hint: The hotfix doesn't fix a already "broken" WMI instance. You have to wipe the wbem\Repositroy directory.

Created on Oct 1, 2012 2:53:43 PM by  Marcel Wiechmann (0) 1 1



Votes:

0

Your Vote:

Up

Down

Having worked through a few of the suggested fixes above, I could turn up no errors with WMI on the host in question.

Yet, a sensor created by my colleague to monitor free disk space was still reporting that invalid data was being returned by WMI.

The fix in my case was to simply remove the sensor and recreate it. It is now reporting correct disk space utilization.

Created on Dec 2, 2014 7:28:49 PM by  dbreit (0)



Votes:

0

Your Vote:

Up

Down

Check the following Registry Key and ensure the value is set to 0 and not 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfProc\Performance] "Disable Performance Counters"=dword:00000000

Also just check that there is no empty line in the following location [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM] "Autorecover MOFs"

As this can cause the Counters to not work. This has been tested on Windows Server 2012 R2

Created on Jan 10, 2017 3:38:24 PM by  rakheshraoSH (0)



Please log in or register to enter your reply.


Disclaimer: The information in the Paessler Knowledge Base comes without warranty of any kind. Use at your own risk. Before applying any instructions please exercise proper system administrator housekeeping. You must make sure that a proper backup of all your data is available.