What is this?

This knowledgebase contains questions and answers about PRTG Network Monitor and network monitoring in general.

Learn more

PRTG Network Monitor

Intuitive to Use. Easy to manage.
More than 500,000 users rely on Paessler PRTG every day. Find out how you can reduce cost, increase QoS and ease planning, as well.

Free Download

Top Tags

View all Tags

Which WQL queries are used by the PRTG WMI sensors?



I'd like to verify an WMI error/value PRTG is reporting with the WMI Tester. Which fields and classes are used by PRTG for the various sensors?

prtg troubleshooting wmi wql

Created on Sep 13, 2010 10:13:28 AM by  Volker Uffelmann [Paessler Support]

Last change on Jan 5, 2023 8:18:34 AM by  Brandy Greger [Paessler Support]

1 Reply

Accepted Answer



This article applies as of PRTG 22

Monitoring via WMI: WQL queries

This article provides WQL queries for the following WMI sensors, including Windows sensors that use the hybrid approach with WMI as fallback.

Note: WHERE parameters in chevrons must be replaced with your specific data. For example, instead of WHERE name ='<servicename>', you must use WHERE name = 'PRTG Server' if you want to inspect the Server service of PRTG.

Note: If not stated otherwise, the namespace used is root\CIMV2.

Note: If you compare strings that contain backslashes, you need to double the backslashes. See the following example: Select * FROM Win32_Volume WHERE DeviceID LIKE '\\\\?\\Volume{bfffffff-4d8d-11e5-9bc2-806e6ffffffff}\\'

Hyper-V Virtual Network Adapter


SELECT Name FROM Win32_PerfRawData_IdePerfProvider_HyperVVirtualIDEControllerEmulated SELECT Name FROM Win32_PerfRawData_NvspNicStats_HyperVVirtualNetworkAdapter

Hyper-V Virtual Storage Device

"Add Sensor" pre-queries

SELECT Name FROM Win32_PerfRawData_IdePerfProvider_HyperVVirtualIDEControllerEmulated SELECT Name FROM Win32_PerfRawData_StorageStats_HyperVVirtualStorageDevice SELECT Name,ElementName,Description FROM Msvm_ComputerSystem WHERE ProcessID<>NULL

Alternative: SELECT Name FROM Win32_PerfRawData_Counters_HyperVVirtualStorageDevice

Monitoring query

SELECT ReadBytesPersec, WriteBytesPersec, ErrorCount FROM Win32_PerfRawData_StorageStats_HyperVVirtualStorageDevice

Windows CPU Load

Standard query

SELECT Name,Timestamp_Sys100NS, PercentProcessorTime FROM Win32_PerfRawData_PerfOS_Processor WHERE Name <> '_Total'

Alternative query

SELECT Name, PercentProcessorTime FROM Win32_PerfFormattedData_PerfOS_Processor WHERE Name <> '_Total'

Windows IIS Application


SELECT Name FROM Win32_PerfFormattedData_W3SVC_WebService

Monitoring query

SELECT TotalBytesReceived, TotalBytesSent, TotalGetRequests, TotalPostRequests, TotalNotFoundErrors, TotalCGIRequests, TotalAnonymousUsers, TotalNonAnonymousUsers, TotalFilesReceived, TotalFilesSent, ServiceUptime FROM Win32_PerfFormattedData_W3SVC_WebService WHERE Name='<instancename>'

Windows Network Card

"Add Sensor" pre-query for the names of the adapters

SELECT Name, BytesTotalPerSec FROM Win32_PerfRawData_Tcpip_NetworkAdapter SELECT Name, BytesTotalPerSec FROM Win32_PerfRawData_Tcpip_NetworkInterface

"Add Sensor" pre-query for IPs/MACs of the adapters

SELECT Description, IPAddress, MACAddress FROM Win32_NetworkAdapterConfiguration WHERE Description LIKE '<adaptername>' AND IPEnabled=true AND MACAddress is not NULL with <adaptername> being replaced with the name of one of the entries that were found with the name-query.

Monitoring query (Windows 2012 or later)

SELECT BytesReceivedPersec,BytesSentPerSec,PacketsPerSec FROM Win32_PerfRawData_Tcpip_NetworkAdapter WHERE Name = '<adaptername>'

Monitoring query (previous to Windows 2012)

SELECT BytesReceivedPersec,BytesSentPerSec,PacketsPerSec FROM Win32_PerfRawData_Tcpip_NetworkInterface WHERE Name = '<adaptername>' with <adaptername> being replaced with the name of one of the entries that were found with the name-query.

Windows Pagefile

SELECT percentusage FROM Win32_PerfFormattedData_PerfOS_PagingFile WHERE Name='_Total'

Windows Physical Disk I/O

SELECT Name FROM Win32_PerfRawData_PerfDisk_PhysicalDisk

Windows Process

SELECT ThreadCount,HandleCount,PrivateBytes, WorkingSet,PercentProcessorTime, PageFaultsPerSec,Timestamp_Sys100NS,IDProcess FROM Win32_PerfRawData_PerfProc_Process WHERE Name ='<executablename>' OR Name LIKE '<executablename>'

Windows System Uptime

SELECT LastBootUpTime,LocalDateTime FROM Win32_OperatingSystem

WMI Event Log


SELECT Name, LogFilename, Filename, NumberOfRecords FROM Win32_NTEventlogFile

Monitoring query

Note: The WMI Event Log sensor has a rather complex WHERE statement that is assembled according to the various filter inputs. For clarity, we leave out this WHERE statement here. But keep in mind that querying the eventlog class unfiltered can take up considerable amounts of time. SELECT TimeGenerated,Message FROM Win32_NTLogEvent

WMI Exchange Server


SELECT MessagesDeliveredPersec,MessagesSentPersec,MessagesSubmittedPersec, MessagesQueuedForSubmission, AverageDeliveryTime FROM Win32_PerfRawData_MSExchangeIS_MSExchangeISMailbox SELECT RPCRequests,RPCAveragedLatency,RPCOperationsPersec,RPCNumofSlowPackets FROM Win32_PerfRawData_MSExchangeIS_MSExchangeIS SELECT DatabasePageFaultsPersec,LogRecordStallsPersec,LogThreadsWaiting, DatabaseCacheSizeMB, DatabaseCachePercentHit FROM Win32_PerfRawData_ESE_MSExchangeDatabase SELECT RPCLatencyaveragemsec,RPCRequestsoutstanding,ROPRequestsoutstanding, RPCRequestsfailed, RPCRequestssentPersec,RPCSlowrequests,RPCSlowrequestslatencyaveragemsec FROM Win32_PerfRawData_MSExchangeStoreInterface_MSExchangeStoreInterface

WMI File

SELECT Lastmodified,Filesize FROM CIM_LogicalFilFree Disk Space e WHERE Drive ='<driveletter>:' AND Path='<path>' AND Filename = '<filename>' AND Extension = '<ext>'

WMI Free Disk Space (Multi Disk)

All drives

SELECT DriveType,DeviceID,FreeSpace,Size,VolumeName FROM Win32_LogicalDisk WHERE DriveType=3

Specific drive

SELECT DriveType,DeviceID,FreeSpace,Size,VolumeName FROM Win32_LogicalDisk WHERE DeviceID='<driveletter>:'

WMI HDD Health


namespace = 'root\WMI' SELECT InstanceName, VendorSpecific FROM MSStorageDriver_ATAPISmartData

namespace = 'root\cimV2' SELECT Size, PNPDeviceID, SerialNumber, Name FROM Win32_DiskDrive SELECT Size, PNPDeviceID, Name FROM Win32_DiskDrive

Monitoring query

namespace = 'root\WMI'; SELECT InstanceName, VendorSpecific FROM MSStorageDriver_ATAPISmartData

WMI Logical Disk I/O


SELECT Name FROM Win32_PerfFormattedData_PerfDisk_LogicalDisk

WMI Memory

Standard query

SELECT FreePhysicalMemory,TotalVisibleMemorySize FROM Win32_OperatingSystem

Alternative query

SELECT AvailableKBytes FROM Win32_PerfFormattedData_PerfOS_Memory and Select TotalPhysicalMemory FROM Win32_LogicalMemoryConfiguration

WMI Microsoft SQL Server 2014 (also 2008 and 2012)


SELECT ServiceName,DisplayName FROM SQLService WHERE SQLServiceType = 1

WMI Remote Ping

SELECT PrimaryAddressResolutionStatus, Statuscode, Responsetime FROM Win32_PingStatus WHERE Address='<targetaddress>' AND BufferSize='<buffersize>' AND Timeout='<timeout+000>'

WMI Security Center


namespace = 'root\SecurityCenter2' SELECT DisplayName, instanceGUID, PathToSignedProductExe FROM AntivirusProduct

SELECT DisplayName, instanceGUID, PathToSignedProductExe FROM AntiSpywareProduct

SELECT DisplayName, instanceGUID, PathToSignedProductExe FROM FirewallProduct

namespace ='root\SecurityCenter' SELECT DisplayName FROM AntivirusProduct

Monitoring queries

SELECT productState FROM '<antivirtype>' Product WHERE DisplayName = '<displayname>'


SELECT OnAccessScanningEnabled, ProductUpToDate FROM '<antivirtype>' Product WHERE DisplayName = '<displayname>'

WMI Service

"Add Sensor" pre-query

SELECT Name,Caption,Description FROM Win32_Service

Monitoring query

SELECT Started,State,Status FROM Win32_Service WHERE Name='<servicename>'

WMI Share

"Add Sensor" pre-query

SELECT Name,Description,Type FROM Win32_Share

Monitoring query

SELECT Status FROM Win32_Share WHERE Name = '<sharename>'

WMI SharePoint Process


SELECT Name FROM Win32_PerfFormattedData_MicrosoftWindowsSharePointMicrosoftSharePointFoundation4_SharePointFoundation SELECT Name FROM Win32_PerfFormattedData_W3SVC_WebService

Monitoring queries

SELECT ActiveThreads,CurrentPageRequests,ExecutingSqlQueries,GlobalHeapSize, ObjectCacheAlwaysLiveSize,TemplateCacheSize,ProcessID FROM Win32_PerfFormattedData_MicrosoftWindowsSharePointMicrosoftSharePointFoundation4_SharePointFoundation WHERE Name='<processname>'

All process IDs (total)

SELECT ProcessID FROM Win32_PerfFormattedData_MicrosoftWindowsSharePointMicrosoftSharePointFoundation4_SharePointFoundation WHERE ProcessID<>0

All needed processes (total)

SELECT IDProcess,PercentProcessorTime FROM Win32_PerfRawData_PerfProc_Process WHERE Name='_Total'

Single process

SELECT PercentProcessorTime FROM Win32_PerfFormattedData_PerfProc_Process WHERE IDProcess ='<processid>'


SELECT Day,Month,Year,Hour, Minute, Second FROM Win32_UTCTime

WMI Volume (previous versions: Free Disk Space (Single Disk))

"Add Sensor" pre-query

SELECT DeviceID, DriveLetter, Name, Label, DriveType, FileSystem FROM Win32_Volume

Monitoring query

SELECT DeviceID, FreeSpace,Capacity FROM Win32_Volume WHERE DeviceID LIKE '<deviceid>'

Alternative query

SELECT Driveletter, FreeSpace,Capacity FROM Win32_Volume WHERE Driveletter LIKE '<driveletter>'


Created on Sep 13, 2010 10:31:47 AM by  Volker Uffelmann [Paessler Support]

Last change on Dec 29, 2022 2:04:34 PM by  Brandy Greger [Paessler Support]

Disclaimer: The information in the Paessler Knowledge Base comes without warranty of any kind. Use at your own risk. Before applying any instructions please exercise proper system administrator housekeeping. You must make sure that a proper backup of all your data is available.