What is this?

This knowledgebase contains questions and answers about PRTG Network Monitor and network monitoring in general. You are invited to get involved by asking and answering questions!

Learn more

PRTG Network Monitor

Intuitive to Use. Easy to manage.
300.000 administrators have chosen PRTG to monitor their network. Find out how you can reduce cost, increase QoS and ease planning, as well.

Free Download

Top Tags

View all Tags

Which WQL queries are used by the PRTG WMI sensors?



Your Vote:



I'd like to verify an WMI error/value PRTG is reporting with the WMI Tester. Which fields and classes are used by PRTG for the various sensors?

prtg troubleshooting wmi wql

Created on Sep 13, 2010 10:13:28 AM by  Volker Uffelmann [Paessler Support]

Last change on Apr 16, 2019 10:22:00 AM by  Maike Guba [Paessler Support]

1 Reply

Accepted Answer



Your Vote:



This article applies to PRTG Network Monitor 19 or later

Monitoring via WMI: WQL queries

This article provides WQL queries for the following WMI sensors, including Windows sensors that use the hybrid approach with WMI as fallback.

Note: WHERE parameters in chevrons must be replaced with your specific data. For example, instead of WHERE name ='<servicename>', you need to use WHERE name = 'PRTG Server' if you want to inspect the Server service of PRTG.

Note: If not stated otherwise, the namespace used is root\CIMV2.

Note: If you compare strings that contain backslashes, you need to double the backslashes. See the following example: Select * FROM Win32_Volume WHERE DeviceID LIKE '\\\\?\\Volume{bfffffff-4d8d-11e5-9bc2-806e6ffffffff}\\'

Hyper-V Virtual Network Adapter sensor


SELECT Name FROM Win32_PerfRawData_IdePerfProvider_HyperVVirtualIDEControllerEmulated SELECT Name FROM Win32_PerfRawData_NvspNicStats_HyperVVirtualNetworkAdapter

Hyper-V Virtual Storage Device sensor

"Add Sensor" pre-queries

SELECT Name FROM Win32_PerfRawData_IdePerfProvider_HyperVVirtualIDEControllerEmulated SELECT Name FROM Win32_PerfRawData_StorageStats_HyperVVirtualStorageDevice SELECT Name,ElementName,Description FROM Msvm_ComputerSystem WHERE ProcessID<>NULL

Alternative: SELECT Name FROM Win32_PerfRawData_Counters_HyperVVirtualStorageDevice

Monitoring query

SELECT ReadBytesPersec, WriteBytesPersec, ErrorCount FROM Win32_PerfRawData_StorageStats_HyperVVirtualStorageDevice

Windows CPU Load sensor

Standard query

SELECT Name,Timestamp_Sys100NS, PercentProcessorTime FROM Win32_PerfRawData_PerfOS_Processor WHERE Name <> '_Total'

Alternative query

SELECT Name, PercentProcessorTime FROM Win32_PerfFormattedData_PerfOS_Processor WHERE Name <> '_Total'

Windows IIS Application sensor


SELECT Name FROM Win32_PerfFormattedData_W3SVC_WebService

Monitoring query

SELECT TotalBytesReceived, TotalBytesSent, TotalGetRequests, TotalPostRequests, TotalNotFoundErrors, TotalCGIRequests, TotalAnonymousUsers, TotalNonAnonymousUsers, TotalFilesReceived, TotalFilesSent, ServiceUptime FROM Win32_PerfFormattedData_W3SVC_WebService WHERE Name='<instancename>'

Windows Network Card sensor

"Add Sensor" pre-query for the names of the adapters

SELECT Name, BytesTotalPerSec FROM Win32_PerfRawData_Tcpip_NetworkAdapter SELECT Name, BytesTotalPerSec FROM Win32_PerfRawData_Tcpip_NetworkInterface

"Add Sensor" pre-query for IPs/MACs of the adapters

SELECT Description, IPAddress, MACAddress FROM Win32_NetworkAdapterConfiguration WHERE Description LIKE '<adaptername>' AND IPEnabled=true AND MACAddress is not NULL with <adaptername> being replaced with the name of one of the entries that were found with the name-query.

Monitoring query (Windows 2012 or later)

SELECT BytesReceivedPersec,BytesSentPerSec,PacketsPerSec FROM Win32_PerfRawData_Tcpip_NetworkAdapter WHERE Name = '<adaptername>'

Monitoring query (previous to Windows 2012)

SELECT BytesReceivedPersec,BytesSentPerSec,PacketsPerSec FROM Win32_PerfRawData_Tcpip_NetworkInterface WHERE Name = '<adaptername>' with <adaptername> being replaced with the name of one of the entries that were found with the name-query.

Windows Pagefile sensor

SELECT percentusage FROM Win32_PerfFormattedData_PerfOS_PagingFile WHERE Name='_Total'

Windows Physical Disk I/O sensor

SELECT Name FROM Win32_PerfRawData_PerfDisk_PhysicalDisk

Windows Process sensor

SELECT ThreadCount,HandleCount,PrivateBytes, WorkingSet,PercentProcessorTime, PageFaultsPerSec,Timestamp_Sys100NS,IDProcess FROM Win32_PerfRawData_PerfProc_Process WHERE Name ='<executablename>' OR Name LIKE '<executablename>'

Windows System Uptime sensor

SELECT LastBootUpTime,LocalDateTime FROM Win32_OperatingSystem

WMI Event Log sensor


SELECT Name, LogFilename, Filename, NumberOfRecords FROM Win32_NTEventlogFile

Monitoring query

Note: The WMI Event Log sensor has a rather complex WHERE statement that is assembled according to the various filter inputs. For clarity we leave out this WHERE statement here. But keep in mind that querying the eventlog class unfiltered can take up considerable amounts of time! SELECT TimeGenerated,Message FROM Win32_NTLogEvent

WMI Exchange Server sensor


SELECT MessagesDeliveredPersec,MessagesSentPersec,MessagesSubmittedPersec, MessagesQueuedForSubmission, AverageDeliveryTime FROM Win32_PerfRawData_MSExchangeIS_MSExchangeISMailbox SELECT RPCRequests,RPCAveragedLatency,RPCOperationsPersec,RPCNumofSlowPackets FROM Win32_PerfRawData_MSExchangeIS_MSExchangeIS SELECT DatabasePageFaultsPersec,LogRecordStallsPersec,LogThreadsWaiting, DatabaseCacheSizeMB, DatabaseCachePercentHit FROM Win32_PerfRawData_ESE_MSExchangeDatabase SELECT RPCLatencyaveragemsec,RPCRequestsoutstanding,ROPRequestsoutstanding, RPCRequestsfailed, RPCRequestssentPersec,RPCSlowrequests,RPCSlowrequestslatencyaveragemsec FROM Win32_PerfRawData_MSExchangeStoreInterface_MSExchangeStoreInterface

WMI File sensor

SELECT Lastmodified,Filesize FROM CIM_LogicalFilFree Disk Space e WHERE Drive ='<driveletter>:' AND Path='<path>' AND Filename = '<filename>' AND Extension = '<ext>'

WMI Free Disk Space (Multi Disk) sensor

All drives

SELECT DriveType,DeviceID,FreeSpace,Size,VolumeName FROM Win32_LogicalDisk WHERE DriveType=3

Specific drive

SELECT DriveType,DeviceID,FreeSpace,Size,VolumeName FROM Win32_LogicalDisk WHERE DeviceID='<driveletter>:'

WMI HDD Health sensor


namespace = 'root\WMI' SELECT InstanceName, VendorSpecific FROM MSStorageDriver_ATAPISmartData

namespace = 'root\cimV2' SELECT Size, PNPDeviceID, SerialNumber, Name FROM Win32_DiskDrive SELECT Size, PNPDeviceID, Name FROM Win32_DiskDrive

Monitoring query

namespace = 'root\WMI'; SELECT InstanceName, VendorSpecific FROM MSStorageDriver_ATAPISmartData

WMI Logical Disk I/O sensor


SELECT Name FROM Win32_PerfFormattedData_PerfDisk_LogicalDisk

WMI Memory sensor

Standard query

SELECT FreePhysicalMemory,TotalVisibleMemorySize FROM Win32_OperatingSystem

Alternative query

SELECT AvailableKBytes FROM Win32_PerfFormattedData_PerfOS_Memory and Select TotalPhysicalMemory FROM Win32_LogicalMemoryConfiguration

WMI Microsoft SQL Server 2014 sensor (also 2008 and 2012)


SELECT ServiceName,DisplayName FROM SQLService WHERE SQLServiceType = 1

WMI Remote Ping sensor

SELECT PrimaryAddressResolutionStatus, Statuscode, Responsetime FROM Win32_PingStatus WHERE Address='<targetaddress>' AND BufferSize='<buffersize>' AND Timeout='<timeout+000>'

WMI Security Center sensor


namespace = 'root\SecurityCenter2' SELECT DisplayName, instanceGUID, PathToSignedProductExe FROM AntivirusProduct

SELECT DisplayName, instanceGUID, PathToSignedProductExe FROM AntiSpywareProduct

SELECT DisplayName, instanceGUID, PathToSignedProductExe FROM FirewallProduct

namespace ='root\SecurityCenter' SELECT DisplayName FROM AntivirusProduct

Monitoring queries

SELECT productState FROM '<antivirtype>' Product WHERE DisplayName = '<displayname>'


SELECT OnAccessScanningEnabled, ProductUpToDate FROM '<antivirtype>' Product WHERE DisplayName = '<displayname>'

WMI Service sensor

"Add Sensor" pre-query

SELECT Name,Caption,Description FROM Win32_Service

Monitoring query

SELECT Started,State,Status FROM Win32_Service WHERE Name='<servicename>'

WMI Share sensor

"Add Sensor" pre-query

SELECT Name,Description,Type FROM Win32_Share

Monitoring query

SELECT Status FROM Win32_Share WHERE Name = '<sharename>'

WMI SharePoint Process sensor


SELECT Name FROM Win32_PerfFormattedData_MicrosoftWindowsSharePointMicrosoftSharePointFoundation4_SharePointFoundation SELECT Name FROM Win32_PerfFormattedData_W3SVC_WebService

Monitoring queries

SELECT ActiveThreads,CurrentPageRequests,ExecutingSqlQueries,GlobalHeapSize, ObjectCacheAlwaysLiveSize,TemplateCacheSize,ProcessID FROM Win32_PerfFormattedData_MicrosoftWindowsSharePointMicrosoftSharePointFoundation4_SharePointFoundation WHERE Name='<processname>'

All process IDs (total)

SELECT ProcessID FROM Win32_PerfFormattedData_MicrosoftWindowsSharePointMicrosoftSharePointFoundation4_SharePointFoundation WHERE ProcessID<>0

All needed processes (total)

SELECT IDProcess,PercentProcessorTime FROM Win32_PerfRawData_PerfProc_Process WHERE Name='_Total'

Single process

SELECT PercentProcessorTime FROM Win32_PerfFormattedData_PerfProc_Process WHERE IDProcess ='<processid>'

WMI UTC Time sensor

SELECT Day,Month,Year,Hour, Minute, Second FROM Win32_UTCTime

WMI Volume sensor (previous versions: Free Disk Space (Single Disk))

"Add Sensor" pre-query

SELECT DeviceID, DriveLetter, Name, Label, DriveType, FileSystem FROM Win32_Volume

Monitoring query

SELECT DeviceID, FreeSpace,Capacity FROM Win32_Volume WHERE DeviceID LIKE '<deviceid>'

Alternative query

SELECT Driveletter, FreeSpace,Capacity FROM Win32_Volume WHERE Driveletter LIKE '<driveletter>'

More about WQL

Find more information on Microsoft's Developer Network: WQL (SQL for WMI).

Created on Sep 13, 2010 10:31:47 AM by  Volker Uffelmann [Paessler Support]

Last change on Dec 4, 2020 12:30:33 PM by  Brandy Greger [Paessler Support]

Please log in or register to enter your reply.

Disclaimer: The information in the Paessler Knowledge Base comes without warranty of any kind. Use at your own risk. Before applying any instructions please exercise proper system administrator housekeeping. You must make sure that a proper backup of all your data is available.