I'd like to verify an WMI error/value PRTG is reporting with the WMI Tester. Which fields and classes are used by PRTG for the various sensors?
Created on Sep 13, 2010 10:13:28 AM by
Last change on Apr 16, 2019 10:22:00 AM by
1 Reply
Accepted Answer
This article applies to PRTG Network Monitor 19 or later
Monitoring via WMI: WQL queries
This article provides WQL queries for the following WMI sensors, including Windows sensors that use the hybrid approach with WMI as fallback.
- Hyper-V Virtual Network Adapter sensor
- Hyper-V Virtual Storage Device sensor
- Windows CPU Load sensor
- Windows IIS Application sensor
- Windows Network Card sensor
- Windows Pagefile sensor
- Windows Physical Disk I/O sensor
- Windows Process sensor
- Windows System Uptime sensor
- WMI Event Log sensor
- WMI Exchange Server sensor
- WMI File sensor
- WMI Free Disk Space (Multi Disk) sensor
- WMI HDD Health sensor
- WMI Logical Disk I/O sensor
- WMI Memory sensor
- WMI Microsoft SQL Server 2014 sensor (also 2008 and 2012)
- WMI Remote Ping sensor
- WMI Security Center sensor
- WMI Service sensor
- WMI Share sensor
- WMI SharePoint Process sensor
- WMI UTC Time sensor
- WMI Volume sensor
Note: WHERE parameters in chevrons must be replaced with your specific data. For example, instead of WHERE name ='<servicename>', you need to use WHERE name = 'PRTG Server' if you want to inspect the Server service of PRTG.
Note: If not stated otherwise, the namespace used is root\CIMV2.
Note: If you compare strings that contain backslashes, you need to double the backslashes. See the following example:
Select * FROM Win32_Volume WHERE DeviceID LIKE '\\\\?\\Volume{bfffffff-4d8d-11e5-9bc2-806e6ffffffff}\\'
Hyper-V Virtual Network Adapter sensor
Pre-queries
SELECT Name
FROM Win32_PerfRawData_IdePerfProvider_HyperVVirtualIDEControllerEmulated
SELECT Name
FROM Win32_PerfRawData_NvspNicStats_HyperVVirtualNetworkAdapter
Hyper-V Virtual Storage Device sensor
"Add Sensor" pre-queries
SELECT Name
FROM Win32_PerfRawData_IdePerfProvider_HyperVVirtualIDEControllerEmulated
SELECT Name
FROM Win32_PerfRawData_StorageStats_HyperVVirtualStorageDevice
SELECT Name,ElementName,Description
FROM Msvm_ComputerSystem WHERE ProcessID<>NULL
Alternative:
SELECT Name
FROM Win32_PerfRawData_Counters_HyperVVirtualStorageDevice
Monitoring query
SELECT ReadBytesPersec, WriteBytesPersec, ErrorCount
FROM Win32_PerfRawData_StorageStats_HyperVVirtualStorageDevice
Windows CPU Load sensor
Standard query
SELECT Name,Timestamp_Sys100NS, PercentProcessorTime
FROM Win32_PerfRawData_PerfOS_Processor
WHERE Name <> '_Total'
Alternative query
SELECT Name, PercentProcessorTime
FROM Win32_PerfFormattedData_PerfOS_Processor
WHERE Name <> '_Total'
Windows IIS Application sensor
Pre-query
SELECT Name
FROM Win32_PerfFormattedData_W3SVC_WebService
Monitoring query
SELECT TotalBytesReceived, TotalBytesSent, TotalGetRequests, TotalPostRequests,
TotalNotFoundErrors, TotalCGIRequests, TotalAnonymousUsers, TotalNonAnonymousUsers, TotalFilesReceived, TotalFilesSent, ServiceUptime
FROM Win32_PerfFormattedData_W3SVC_WebService
WHERE Name='<instancename>'
Windows Network Card sensor
"Add Sensor" pre-query for the names of the adapters
SELECT Name, BytesTotalPerSec
FROM Win32_PerfRawData_Tcpip_NetworkAdapter
SELECT Name, BytesTotalPerSec
FROM Win32_PerfRawData_Tcpip_NetworkInterface
"Add Sensor" pre-query for IPs/MACs of the adapters
SELECT Description, IPAddress, MACAddress
FROM Win32_NetworkAdapterConfiguration
WHERE Description LIKE '<adaptername>'
AND IPEnabled=true AND MACAddress is not NULL
with <adaptername> being replaced with the name of one of the entries that were found with the name-query.
Monitoring query (Windows 2012 or later)
SELECT BytesReceivedPersec,BytesSentPerSec,PacketsPerSec
FROM Win32_PerfRawData_Tcpip_NetworkAdapter
WHERE Name = '<adaptername>'
Monitoring query (previous to Windows 2012)
SELECT BytesReceivedPersec,BytesSentPerSec,PacketsPerSec
FROM Win32_PerfRawData_Tcpip_NetworkInterface
WHERE Name = '<adaptername>'
with <adaptername> being replaced with the name of one of the entries that were found with the name-query.
Windows Pagefile sensor
SELECT percentusage
FROM Win32_PerfFormattedData_PerfOS_PagingFile
WHERE Name='_Total'
Windows Physical Disk I/O sensor
SELECT Name
FROM Win32_PerfRawData_PerfDisk_PhysicalDisk
Windows Process sensor
SELECT ThreadCount,HandleCount,PrivateBytes,
WorkingSet,PercentProcessorTime,
PageFaultsPerSec,Timestamp_Sys100NS,IDProcess
FROM Win32_PerfRawData_PerfProc_Process
WHERE Name ='<executablename>'
OR Name LIKE '<executablename>'
Windows System Uptime sensor
SELECT LastBootUpTime,LocalDateTime
FROM Win32_OperatingSystem
WMI Event Log sensor
Pre-query
SELECT Name, LogFilename, Filename, NumberOfRecords
FROM Win32_NTEventlogFile
Monitoring query
Note: The WMI Event Log sensor has a rather complex WHERE statement that is assembled according to the various filter inputs. For clarity we leave out this WHERE statement here. But keep in mind that querying the eventlog class unfiltered can take up considerable amounts of time!
SELECT TimeGenerated,Message
FROM Win32_NTLogEvent
WMI Exchange Server sensor
Pre-queries
SELECT MessagesDeliveredPersec,MessagesSentPersec,MessagesSubmittedPersec,
MessagesQueuedForSubmission, AverageDeliveryTime
FROM Win32_PerfRawData_MSExchangeIS_MSExchangeISMailbox
SELECT RPCRequests,RPCAveragedLatency,RPCOperationsPersec,RPCNumofSlowPackets
FROM Win32_PerfRawData_MSExchangeIS_MSExchangeIS
SELECT DatabasePageFaultsPersec,LogRecordStallsPersec,LogThreadsWaiting,
DatabaseCacheSizeMB, DatabaseCachePercentHit
FROM Win32_PerfRawData_ESE_MSExchangeDatabase
SELECT RPCLatencyaveragemsec,RPCRequestsoutstanding,ROPRequestsoutstanding,
RPCRequestsfailed, RPCRequestssentPersec,RPCSlowrequests,RPCSlowrequestslatencyaveragemsec
FROM Win32_PerfRawData_MSExchangeStoreInterface_MSExchangeStoreInterface
WMI File sensor
SELECT Lastmodified,Filesize
FROM CIM_LogicalFilFree Disk Space e
WHERE Drive ='<driveletter>:'
AND Path='<path>'
AND Filename = '<filename>'
AND Extension = '<ext>'
WMI Free Disk Space (Multi Disk) sensor
All drives
SELECT DriveType,DeviceID,FreeSpace,Size,VolumeName
FROM Win32_LogicalDisk
WHERE DriveType=3
Specific drive
SELECT DriveType,DeviceID,FreeSpace,Size,VolumeName
FROM Win32_LogicalDisk
WHERE DeviceID='<driveletter>:'
WMI HDD Health sensor
Pre-queries
namespace = 'root\WMI'
SELECT InstanceName, VendorSpecific
FROM MSStorageDriver_ATAPISmartData
namespace = 'root\cimV2'
SELECT Size, PNPDeviceID, SerialNumber, Name
FROM Win32_DiskDrive
SELECT Size, PNPDeviceID, Name
FROM Win32_DiskDrive
Monitoring query
namespace = 'root\WMI';
SELECT InstanceName, VendorSpecific
FROM MSStorageDriver_ATAPISmartData
WMI Logical Disk I/O sensor
Pre-query
SELECT Name
FROM Win32_PerfFormattedData_PerfDisk_LogicalDisk
WMI Memory sensor
Standard query
SELECT FreePhysicalMemory,TotalVisibleMemorySize
FROM Win32_OperatingSystem
Alternative query
SELECT AvailableKBytes
FROM Win32_PerfFormattedData_PerfOS_Memory
and
Select TotalPhysicalMemory
FROM Win32_LogicalMemoryConfiguration
WMI Microsoft SQL Server 2014 sensor (also 2008 and 2012)
Pre-query
SELECT ServiceName,DisplayName
FROM SQLService
WHERE SQLServiceType = 1
WMI Remote Ping sensor
SELECT PrimaryAddressResolutionStatus, Statuscode, Responsetime
FROM Win32_PingStatus
WHERE Address='<targetaddress>'
AND BufferSize='<buffersize>'
AND Timeout='<timeout+000>'
WMI Security Center sensor
Pre-queries
namespace = 'root\SecurityCenter2'
SELECT DisplayName, instanceGUID, PathToSignedProductExe
FROM AntivirusProduct
SELECT DisplayName, instanceGUID, PathToSignedProductExe
FROM AntiSpywareProduct
SELECT DisplayName, instanceGUID, PathToSignedProductExe
FROM FirewallProduct
namespace ='root\SecurityCenter'
SELECT DisplayName
FROM AntivirusProduct
Monitoring queries
SELECT productState
FROM '<antivirtype>' Product
WHERE DisplayName = '<displayname>'
Old
SELECT OnAccessScanningEnabled, ProductUpToDate
FROM '<antivirtype>' Product
WHERE DisplayName = '<displayname>'
WMI Service sensor
"Add Sensor" pre-query
SELECT Name,Caption,Description
FROM Win32_Service
Monitoring query
SELECT Started,State,Status
FROM Win32_Service
WHERE Name='<servicename>'
WMI Share sensor
"Add Sensor" pre-query
SELECT Name,Description,Type
FROM Win32_Share
Monitoring query
SELECT Status
FROM Win32_Share
WHERE Name = '<sharename>'
WMI SharePoint Process sensor
Pre-queries
SELECT Name
FROM Win32_PerfFormattedData_MicrosoftWindowsSharePointMicrosoftSharePointFoundation4_SharePointFoundation
SELECT Name
FROM Win32_PerfFormattedData_W3SVC_WebService
Monitoring queries
SELECT ActiveThreads,CurrentPageRequests,ExecutingSqlQueries,GlobalHeapSize,
ObjectCacheAlwaysLiveSize,TemplateCacheSize,ProcessID
FROM Win32_PerfFormattedData_MicrosoftWindowsSharePointMicrosoftSharePointFoundation4_SharePointFoundation
WHERE Name='<processname>'
All process IDs (total)
SELECT ProcessID
FROM Win32_PerfFormattedData_MicrosoftWindowsSharePointMicrosoftSharePointFoundation4_SharePointFoundation
WHERE ProcessID<>0
All needed processes (total)
SELECT IDProcess,PercentProcessorTime
FROM Win32_PerfRawData_PerfProc_Process
WHERE Name='_Total'
Single process
SELECT PercentProcessorTime
FROM Win32_PerfFormattedData_PerfProc_Process
WHERE IDProcess ='<processid>'
WMI UTC Time sensor
SELECT Day,Month,Year,Hour, Minute, Second FROM Win32_UTCTime
WMI Volume sensor (previous versions: Free Disk Space (Single Disk))
"Add Sensor" pre-query
SELECT DeviceID, DriveLetter, Name, Label, DriveType, FileSystem
FROM Win32_Volume
Monitoring query
SELECT DeviceID, FreeSpace,Capacity
FROM Win32_Volume
WHERE DeviceID LIKE '<deviceid>'
Alternative query
SELECT Driveletter, FreeSpace,Capacity
FROM Win32_Volume
WHERE Driveletter LIKE '<driveletter>'
More about WQL
Find more information on Microsoft's Developer Network: WQL (SQL for WMI).
Created on Sep 13, 2010 10:31:47 AM by
Last change on Dec 4, 2020 12:30:33 PM by
Please log in or register to enter your reply.
Disclaimer: The information in the Paessler Knowledge Base comes without warranty of any kind. Use at your own risk. Before applying any instructions please exercise proper system administrator housekeeping. You must make sure that a proper backup of all your data is available.
Add comment