I'd like to verify an WMI error/value PRTG is reporting with the WMI Tester. Which fields and classes are used by PRTG for the various sensors?
Created on Sep 13, 2010 10:13:28 AM by
Last change on Jan 5, 2023 8:18:34 AM by
1 Reply
Accepted Answer
This article applies as of PRTG 22
Monitoring via WMI: WQL queries
This article provides WQL queries for the following WMI sensors, including Windows sensors that use the hybrid approach with WMI as fallback.
- Hyper-V Virtual Network Adapter
- Hyper-V Virtual Storage Device
- Windows CPU Load
- Windows IIS Application
- Windows Network Card
- Windows Pagefile
- Windows Physical Disk I/O
- Windows Process
- Windows System Uptime
- WMI Event Log
- WMI Exchange Server
- WMI File
- WMI Free Disk Space (Multi Disk)
- WMI HDD Health
- WMI Logical Disk I/O
- WMI Memory
- WMI Microsoft SQL Server 2014 (also 2008 and 2012)
- WMI Remote Ping
- WMI Security Center
- WMI Service
- WMI Share
- WMI SharePoint Process
- WMI UTC Time
- WMI Volume
Note: WHERE parameters in chevrons must be replaced with your specific data. For example, instead of WHERE name ='<servicename>', you must use WHERE name = 'PRTG Server' if you want to inspect the Server service of PRTG.
Note: If not stated otherwise, the namespace used is root\CIMV2.
Note: If you compare strings that contain backslashes, you need to double the backslashes. See the following example:
Select * FROM Win32_Volume WHERE DeviceID LIKE '\\\\?\\Volume{bfffffff-4d8d-11e5-9bc2-806e6ffffffff}\\'
Hyper-V Virtual Network Adapter
Pre-queries
SELECT Name
FROM Win32_PerfRawData_IdePerfProvider_HyperVVirtualIDEControllerEmulated
SELECT Name
FROM Win32_PerfRawData_NvspNicStats_HyperVVirtualNetworkAdapter
Hyper-V Virtual Storage Device
"Add Sensor" pre-queries
SELECT Name
FROM Win32_PerfRawData_IdePerfProvider_HyperVVirtualIDEControllerEmulated
SELECT Name
FROM Win32_PerfRawData_StorageStats_HyperVVirtualStorageDevice
SELECT Name,ElementName,Description
FROM Msvm_ComputerSystem WHERE ProcessID<>NULL
Alternative:
SELECT Name
FROM Win32_PerfRawData_Counters_HyperVVirtualStorageDevice
Monitoring query
SELECT ReadBytesPersec, WriteBytesPersec, ErrorCount
FROM Win32_PerfRawData_StorageStats_HyperVVirtualStorageDevice
Windows CPU Load
Standard query
SELECT Name,Timestamp_Sys100NS, PercentProcessorTime
FROM Win32_PerfRawData_PerfOS_Processor
WHERE Name <> '_Total'
Alternative query
SELECT Name, PercentProcessorTime
FROM Win32_PerfFormattedData_PerfOS_Processor
WHERE Name <> '_Total'
Windows IIS Application
Pre-query
SELECT Name
FROM Win32_PerfFormattedData_W3SVC_WebService
Monitoring query
SELECT TotalBytesReceived, TotalBytesSent, TotalGetRequests, TotalPostRequests,
TotalNotFoundErrors, TotalCGIRequests, TotalAnonymousUsers, TotalNonAnonymousUsers, TotalFilesReceived, TotalFilesSent, ServiceUptime
FROM Win32_PerfFormattedData_W3SVC_WebService
WHERE Name='<instancename>'
Windows Network Card
"Add Sensor" pre-query for the names of the adapters
SELECT Name, BytesTotalPerSec
FROM Win32_PerfRawData_Tcpip_NetworkAdapter
SELECT Name, BytesTotalPerSec
FROM Win32_PerfRawData_Tcpip_NetworkInterface
"Add Sensor" pre-query for IPs/MACs of the adapters
SELECT Description, IPAddress, MACAddress
FROM Win32_NetworkAdapterConfiguration
WHERE Description LIKE '<adaptername>'
AND IPEnabled=true AND MACAddress is not NULL
with <adaptername> being replaced with the name of one of the entries that were found with the name-query.
Monitoring query (Windows 2012 or later)
SELECT BytesReceivedPersec,BytesSentPerSec,PacketsPerSec
FROM Win32_PerfRawData_Tcpip_NetworkAdapter
WHERE Name = '<adaptername>'
Monitoring query (previous to Windows 2012)
SELECT BytesReceivedPersec,BytesSentPerSec,PacketsPerSec
FROM Win32_PerfRawData_Tcpip_NetworkInterface
WHERE Name = '<adaptername>'
with <adaptername> being replaced with the name of one of the entries that were found with the name-query.
Windows Pagefile
SELECT percentusage
FROM Win32_PerfFormattedData_PerfOS_PagingFile
WHERE Name='_Total'
Windows Physical Disk I/O
SELECT Name
FROM Win32_PerfRawData_PerfDisk_PhysicalDisk
Windows Process
SELECT ThreadCount,HandleCount,PrivateBytes,
WorkingSet,PercentProcessorTime,
PageFaultsPerSec,Timestamp_Sys100NS,IDProcess
FROM Win32_PerfRawData_PerfProc_Process
WHERE Name ='<executablename>'
OR Name LIKE '<executablename>'
Windows System Uptime
SELECT LastBootUpTime,LocalDateTime
FROM Win32_OperatingSystem
WMI Event Log
Pre-query
SELECT Name, LogFilename, Filename, NumberOfRecords
FROM Win32_NTEventlogFile
Monitoring query
Note: The WMI Event Log sensor has a rather complex WHERE statement that is assembled according to the various filter inputs. For clarity, we leave out this WHERE statement here. But keep in mind that querying the eventlog class unfiltered can take up considerable amounts of time.
SELECT TimeGenerated,Message
FROM Win32_NTLogEvent
WMI Exchange Server
Pre-queries
SELECT MessagesDeliveredPersec,MessagesSentPersec,MessagesSubmittedPersec,
MessagesQueuedForSubmission, AverageDeliveryTime
FROM Win32_PerfRawData_MSExchangeIS_MSExchangeISMailbox
SELECT RPCRequests,RPCAveragedLatency,RPCOperationsPersec,RPCNumofSlowPackets
FROM Win32_PerfRawData_MSExchangeIS_MSExchangeIS
SELECT DatabasePageFaultsPersec,LogRecordStallsPersec,LogThreadsWaiting,
DatabaseCacheSizeMB, DatabaseCachePercentHit
FROM Win32_PerfRawData_ESE_MSExchangeDatabase
SELECT RPCLatencyaveragemsec,RPCRequestsoutstanding,ROPRequestsoutstanding,
RPCRequestsfailed, RPCRequestssentPersec,RPCSlowrequests,RPCSlowrequestslatencyaveragemsec
FROM Win32_PerfRawData_MSExchangeStoreInterface_MSExchangeStoreInterface
WMI File
SELECT Lastmodified,Filesize
FROM CIM_LogicalFilFree Disk Space e
WHERE Drive ='<driveletter>:'
AND Path='<path>'
AND Filename = '<filename>'
AND Extension = '<ext>'
WMI Free Disk Space (Multi Disk)
All drives
SELECT DriveType,DeviceID,FreeSpace,Size,VolumeName
FROM Win32_LogicalDisk
WHERE DriveType=3
Specific drive
SELECT DriveType,DeviceID,FreeSpace,Size,VolumeName
FROM Win32_LogicalDisk
WHERE DeviceID='<driveletter>:'
WMI HDD Health
Pre-queries
namespace = 'root\WMI'
SELECT InstanceName, VendorSpecific
FROM MSStorageDriver_ATAPISmartData
namespace = 'root\cimV2'
SELECT Size, PNPDeviceID, SerialNumber, Name
FROM Win32_DiskDrive
SELECT Size, PNPDeviceID, Name
FROM Win32_DiskDrive
Monitoring query
namespace = 'root\WMI';
SELECT InstanceName, VendorSpecific
FROM MSStorageDriver_ATAPISmartData
WMI Logical Disk I/O
Pre-query
SELECT Name
FROM Win32_PerfFormattedData_PerfDisk_LogicalDisk
WMI Memory
Standard query
SELECT FreePhysicalMemory,TotalVisibleMemorySize
FROM Win32_OperatingSystem
Alternative query
SELECT AvailableKBytes
FROM Win32_PerfFormattedData_PerfOS_Memory
and
Select TotalPhysicalMemory
FROM Win32_LogicalMemoryConfiguration
WMI Microsoft SQL Server 2014 (also 2008 and 2012)
Pre-query
SELECT ServiceName,DisplayName
FROM SQLService
WHERE SQLServiceType = 1
WMI Remote Ping
SELECT PrimaryAddressResolutionStatus, Statuscode, Responsetime
FROM Win32_PingStatus
WHERE Address='<targetaddress>'
AND BufferSize='<buffersize>'
AND Timeout='<timeout+000>'
WMI Security Center
Pre-queries
namespace = 'root\SecurityCenter2'
SELECT DisplayName, instanceGUID, PathToSignedProductExe
FROM AntivirusProduct
SELECT DisplayName, instanceGUID, PathToSignedProductExe
FROM AntiSpywareProduct
SELECT DisplayName, instanceGUID, PathToSignedProductExe
FROM FirewallProduct
namespace ='root\SecurityCenter'
SELECT DisplayName
FROM AntivirusProduct
Monitoring queries
SELECT productState
FROM '<antivirtype>' Product
WHERE DisplayName = '<displayname>'
Old
SELECT OnAccessScanningEnabled, ProductUpToDate
FROM '<antivirtype>' Product
WHERE DisplayName = '<displayname>'
WMI Service
"Add Sensor" pre-query
SELECT Name,Caption,Description
FROM Win32_Service
Monitoring query
SELECT Started,State,Status
FROM Win32_Service
WHERE Name='<servicename>'
WMI Share
"Add Sensor" pre-query
SELECT Name,Description,Type
FROM Win32_Share
Monitoring query
SELECT Status
FROM Win32_Share
WHERE Name = '<sharename>'
WMI SharePoint Process
Pre-queries
SELECT Name
FROM Win32_PerfFormattedData_MicrosoftWindowsSharePointMicrosoftSharePointFoundation4_SharePointFoundation
SELECT Name
FROM Win32_PerfFormattedData_W3SVC_WebService
Monitoring queries
SELECT ActiveThreads,CurrentPageRequests,ExecutingSqlQueries,GlobalHeapSize,
ObjectCacheAlwaysLiveSize,TemplateCacheSize,ProcessID
FROM Win32_PerfFormattedData_MicrosoftWindowsSharePointMicrosoftSharePointFoundation4_SharePointFoundation
WHERE Name='<processname>'
All process IDs (total)
SELECT ProcessID
FROM Win32_PerfFormattedData_MicrosoftWindowsSharePointMicrosoftSharePointFoundation4_SharePointFoundation
WHERE ProcessID<>0
All needed processes (total)
SELECT IDProcess,PercentProcessorTime
FROM Win32_PerfRawData_PerfProc_Process
WHERE Name='_Total'
Single process
SELECT PercentProcessorTime
FROM Win32_PerfFormattedData_PerfProc_Process
WHERE IDProcess ='<processid>'
WMI UTC Time
SELECT Day,Month,Year,Hour, Minute, Second FROM Win32_UTCTime
WMI Volume (previous versions: Free Disk Space (Single Disk))
"Add Sensor" pre-query
SELECT DeviceID, DriveLetter, Name, Label, DriveType, FileSystem
FROM Win32_Volume
Monitoring query
SELECT DeviceID, FreeSpace,Capacity
FROM Win32_Volume
WHERE DeviceID LIKE '<deviceid>'
Alternative query
SELECT Driveletter, FreeSpace,Capacity
FROM Win32_Volume
WHERE Driveletter LIKE '<driveletter>'
More
- Find more information on Microsoft's Developer Network: WQL (SQL for WMI).
Created on Sep 13, 2010 10:31:47 AM by
Last change on Dec 29, 2022 2:04:34 PM by
Please log in or register to enter your reply.
Disclaimer: The information in the Paessler Knowledge Base comes without warranty of any kind. Use at your own risk. Before applying any instructions please exercise proper system administrator housekeeping. You must make sure that a proper backup of all your data is available.
Add comment