What can I do when my WMI sensors in PRTG are showing errors? Can you provide trouble shooting steps?
6 Replies
General introduction to WMI and PRTG
Every so often customers using our monitoring tools (e.g. PRTG Network Monitor) report issues when trying to monitor their systems using WMI (Windows Management Instrumentation) sensors. In most cases, these issues stem from a malfunctioning WMI configuration/installation. For example, we have noticed that many times when WMI issues arise one (or multiple) WMI components crucial for proper WMI monitoring are missing or have not been implemented properly.
Getting started
Important! Before going any deeper into troubleshooting, a good knowledge of the principles and functions of WMI is necessary. Please refer to the following Microsoft article for frequently asked questions about WMI:
Basic requirements
Please ensure the following:
- DCOM needs to be enabled on probe and target computer. Check the respective registry entry.
- The user whose credentials are specified for monitoring WMI is a member of the Domain Administrators group in the same Active Directory as the target computer. In case of a target computer outside of a domain the user has to be a member of the local Administrators group and of the DCOM group and of the Performance Monitoring group on this machine.
- The monitoring user’s access rights on COM and WMI include remote access rights for the target computer. Read about Securing a Remote WMI Connection on MSDN.
- The target computer's Windows Firewall is set to allow WMI. MSDN features an article on this topic for XP and W2k3: Connecting Through Windows Firewall. For computers with Vista and above read this article on MSDN: Connecting to WMI Remotely Starting with Windows Vista.
- If the firewall is enabled by group policies you have to enable the "Allow Remote Administration Exception" as outlined in this article at Addicted to IT: Group Policy: Windows Firewall setting to allow your WMI scripts to run
- The RPC server used for WMI on the target computer is running on the port specified in PRTG (135 by default).
- DCOM needs open UDP ports in the 1024-5000 range. If you want to narrow this down to a more specific range, have a look at this MSDN Blog: How to configure DCOM to listen to a specific ports range
- Security Software: It's always a good idea to double-check that no local security software (anti-spy, anti-virus, etc.) on either side is blocking WMI connections.
Troubleshooting in detail
Please refer to the following articles for further information:
- WMI Tools Overview
- The most common WMI errors
- PRTG WMI error messages (PE code)
- Which WQL queries are used by PRTG's WMI sensors?
A very good external article for troubleshooting WMI is found here:
Tips against slowness on Vista and Windows 2008 are found here:
If you are monitoring a massive number of hosts with one probe, this here might help:
- Memory and Handle Quotas in the WMI Provider Service (but bear in mind it is always a good idea to distribute WMI queries over one or more Remote Probes)
PRTG settings for WMI
PRTG offers a few settings for dealing with WMI issues:
Tips and Tricks
The following articles provide guidelines for special scenarios:
How to repair WMI
If all else fails we've gathered some procedures which might fix the WMI system on affected computers:
Further Reading
Another good article about all things regarding WMI can be found under:
http://msdn.microsoft.com/en-us/library/aa394572.aspx
This reference provides a list of WMI providers, information on the COM API for WMI, WMI queries, WMI log files, WMI security, WMI tools and WMI infrastructure objects and values.
Further articles of interest (providing more detail than the troubleshooting articles above), relating to particular aspects of WMI configuration can be found under :
Created on Feb 19, 2010 9:37:49 AM by
Volker Uffelmann [Paessler Support]
(1,547)
●2
●3
Last change on Mar 9, 2012 12:27:44 PM by
Volker Uffelmann [Paessler Support]
(1,547)
●2
●3
Maybe a little addition.
If you query your WMI from within a powershell on Windows 2008R2, you maybe get a Class not Found error. Remember that PRTG uses the 32-bit powershell as default.
Execute your powershell script in powershell 32-bit, receive the same error? Execute your powershell script in powershell 64-bit, error resolved? Than execute your script in a 64-bit powershell by calling it from a commandline in your 32-bit script.
start.ps1 <- the 32-bit, notice the sysnative folder.... c:\windows\sysnative\windowspowershell\v1.0\powershell.exe -file "C:\Program Files (x86)\PRTG Network Monitor\Custom Sensors\EXE\<script>.ps1"
main.ps1 your working 64-bit WMI script.....
Nice thing to know is that you still can use arguments...
Bye, Peter
Created on May 25, 2011 11:13:08 AM by
PeterStamBam
(50)
●1
●1
Last change on May 25, 2011 3:00:54 PM by
Torsten Lindner [Paessler Support]
(15,450)
●3
●1
People, hello.
I can't really understand what prevented you from developing something like "WMI proxy" which will run as a service on remote machine and execute all the WMI queries - there won't be any overloads, permission issues, flickering issues and so on...
@Vadim Doroginin: Actually we did develop such a service. It's called "Remote Probe" and can be installed on one, or a few, or all your machines in your network. But it's a lot of work to install a software on all machines in a network and in most cases it is not necessary.
A huge majority of PRTG users is using WMI just fine to monitor their networks with hundreds or even thousands of Windows PCs.
And for those who do have problems with WMI there is the option to install Remote Probes.
Windows Server 2008 & 2008 R2 WMI Defects
Paessler: please consider making the relevant information below part of the body of your KB article. I hope it helps someone else.
A while back I started closely monitoring the WMI service on the various servers that often false alarm during WMI overload. Most often, the free space check would fail returning a null or zero value instead of the correct value for free disk space. To troubleshoot, I added the PRTG WMI service monitor for the WMI Service itself with a 60 second interval. I also monitored the system and application event logs with 15 minute intervals. It helped to get more specific errors about what was going on with WMI. Most often I'd get one of these errors in succession:
- WMI Free Disk Space [Multi Drive]: 0 % (Free Space C:) is below the error limit of 10 %
- Windows Management Instrumentation (WMI Service) Warning: 80041006: There was not enough memory for the operation.
- Event Log (Windows API) Value changed: Faulting application wmiprvse.exe, version 6.1.7600.16385, faulting module 4a5bc794, version ole32.dll, fault address 0x6.1.7600.16624
Armed with this new information, I was able to find two Microsoft KB articles that seemed to match the symptoms:
- 958124 A wmiprvse.exe process may leak memory when a WMI notification query is used heavily on a Windows Server 2008-based or Windows Vista-based computer
- 954563 Memory corruption may occur with the Windows Management Instrumentation (WMI) service on a computer that is running Windows Server 2008 or Windows Vista Service Pack 1
Applying these two hotfixes stopped the false alarms on my Windows 2008 and 2008 R2 servers.
Dear Ismael,
great finding, thanks a lot for this!
I've added your solution to our Most common WMI errors article.
Best regards,
- Volker
Please log in or register to enter your reply.
Add comment