Don't Use Windows Vista And Windows 2008 for Network Monitoring via WMI!

Our WMI load test tool ran as many WMI requests as possible from the monitoring station to a client and thus measured the "maximum number of consecutive WMI requests per second". Each of the ten systems was used as the monitoring station to monitor all other systems. The results are shattering for Windows Vista and Windows 2008: When it comes to network monitoring via WMI, Windows XP and Windows 2003 are up to 70 times faster than Windows 2008 or Vista. Here are the detailed results of our tests: Regardless of being used as monitoring station or as a client and regardless of virtualization: Windows Vista and Windows 2008 show dramatically reduced WMI performance compared to XP or Windows 2003. With only 3-5 WMI requests per second (=180-300 requests per minute) you can only monitor 50-60 PCs in your network with 5 WMI requests running every minute. Windows 2003 R2 is clearly the operating system of choice if you want to monitor a larger network with WMI. With up to 200 WMI requests per second (=12,000 per minute) you can easily monitor a network of 2,400 PCs (again, when 5 WMI requests are sent to each PC every minute). Windows 2003 R1 and Windows XP are just a little behind. There is hope on the horizon. While Windows 7 Beta (Jan 2009) performed much like Vista, the WMI engine has finally been fixed in the latest Windows 7 Release Candidate (May 2009). Windows 7 RC performs quite similar to XP and Win2k3.

Lessons Learnt

The results of our tests are:

• WMI performance of Windows Vista and Windows 2008 is severely flawed
• Windows 2003R2 is currently the best performing OS for monitoring via WMI, closely followed by XP and Windows 7 RC
• If you are monitoring a network that contains a good portion of PCs running on Windows Vista and Windows 2008 be prepared to use longer monitoring intervals
• System performance (CPU, memory, etc.) does not strongly affect WMI monitoring performance
• Virtualization does not strongly affect WMI monitoring performance

Our Recommendations

If you want to use WMI for network monitoring of more than 20-30 boxes please consider the following rules:

• Don't use Windows Vista or Windows 2008 as monitoring stations for WMI-based network monitoring
• Currently your best option for WMI based network monitoring is Windows 2003 R2 Server
• If you can't run PRTG on XP/Win2k3 consider setting up a remote probe with XP for the WMI monitoring (You still get far better WMI monitoring performance with a remote probe on a virtual machine running Windows XP or Win2k3 than on any bare metal system running Vista/Win2k8)
• Consider switching to SNMP-based monitoring for large networks. Using SNMP you can easily monitor 10 times as many nodes as with WMI (on the same hardware)

Test Notes

The systems we used in our tests were selected servers and PCs in our labs, all of them had different hardware specs. We found that for the scope of this test the actual system performance had only very little influence on the results. In the end the results for Vista and Win2k8 were so far off that it was not necessary to standardize the testing even more. To rule out library or development platform effects we created two different test tools to measure the WMI performance: one was created with Visual Studio, the other one with Delphi. Both used completely different WMI libraries. The .NET based version consistently measured half of the performance of the tool created with Delphi. During our WMI load tests on Vista/Win2k8 we saw the process "lsass.exe" running at 100% cpu load on the monitoring stations. On the Vista/Win2k8 test clients CPU cycles were used by the process "wmiprvse.exe".