What is this?

This knowledgebase contains questions and answers about PRTG Network Monitor and network monitoring in general.

Learn more

PRTG Network Monitor

Intuitive to Use. Easy to manage.
More than 500,000 users rely on Paessler PRTG every day. Find out how you can reduce cost, increase QoS and ease planning, as well.

Free Download

Top Tags

View all Tags

Issues with the WMI Event Log Sensor



we have some scripts that write event log entries during the execution. Since we want to monitor whether or not those scripts are running, a WMI Event Log Sensor seems like a perfect solution. I set up about 10 sensors for 10 scripts so far, and set the lower error threshold to 0,001#/s, since if a script is running, the number should be above that value and if it isn't running, there will be no (0#/s) entries. I also set the decimal point to "all". Works mostly fine so far, but unfortunately, there seem to be some issues.

I noticed that after a sensor was paused, it will return 0 upon the first query, even if there are entries created between its last execution, followed by pausing, and the current query. This sets the sensor to the down state, since according to the WMI Event Log Sensor manual page:

"If you define error limits for a sensor's channels, the sensor immediately shows the Down status. None of the interval options apply. If a channel uses lookup values, the sensor immediately shows the Down status. None of the interval options apply."

My question is, how does the WMI Event Log Sensor query the new entries and what is the reason for it showing 0 on the first query? Is there a workaround? At this point, it seems pretty useless for this scenario, since it would trigger notifications and show up red in system every time the sensor is unpaused/the script starts running, which means everyday.

Another issue I had is that I've seen sensors with the configuration described above triggering "down" status twice, both times because the query was executed about 1:30 minutes before it was supposed to according to the interval. Since the sensor interval is set to the same value as the script interval, it obviously found no entries, because there couldn't hav been any. What could be a reason for this kind of behavior and how, if at all, can it be prevented in the future?

We're running PRTG Version on a Windows Server 2016. The sensors in question are running on both a remote and a local probe.

eventlog eventlog-wmi windows windows-event-log wmi

Created on Feb 12, 2021 9:19:07 AM

1 Reply



Hello, when a sensor is paused, it will not gather any monitoring data. When it is resumed it will begin from 0 the first scanning interval. You can set the Notification trigger to notify only when two or more scanning intervals have passed. That way it will not notify when it is down for the first scanning interval. The second issue sounds like the sensor is scanning before the interval? It should not happen that way. In order to take a better look you can send us more information and screenshots at [email protected]

Created on Feb 18, 2021 5:42:52 AM by  Jonathan Mena [Paessler Technical Support]

Disclaimer: The information in the Paessler Knowledge Base comes without warranty of any kind. Use at your own risk. Before applying any instructions please exercise proper system administrator housekeeping. You must make sure that a proper backup of all your data is available.