PRTG Manual: Monitoring via WMI

You can monitor Windows systems via Windows Management Instrumentation (WMI) and Windows performance counters. WMI is the infrastructure for management of data and operations on Windows-based operating systems. PRTG uses it to access data of various Windows configuration parameters and status values. In addition to WMI-only sensors, there are sensors that can use performance counters to monitor Windows systems.

WMI was built on Component Object Model (COM) technology and was integrated in Windows versions as of Windows Server 2000. Remote access was traditionally handled through Distributed Component Object Model (DCOM) but Web Services Management (WSMan) is now the recommended method.

You can set each local or classic remote probe individually to use either DCOM or WSMan protocol for WMI connections. For more information, see sections PRTG Administration Tool on PRTG Core Server Systems and PRTG Administration Tool on Remote Probe Systems. Note that the WMI sensors on probes that use the DCOM protocol generally have a high impact on system performance.

To monitor via WMI and performance counters, it is usually sufficient to provide credentials for Windows systems in PRTG. However, monitoring via WMI is not always trivial and can cause issues.

If you run into issues with WMI, see the Knowledge Base: My WMI sensors don't work. What can I do?

How WMI Works

WMI allows access to the data of many Windows configuration parameters, as well as system status values. Access can be local or remote via a network connection. PRTG officially supports WMI as of Windows 10, although it can use some WMI sensors on systems that run as of Windows 7.

WoW64 must be installed on target systems that run Windows Server 2016. This allows 32-bit applications to be run on 64-bit systems. This is necessary because the PRTG probe service only runs with 32-bit support. Without it, WMI sensors do not work.

To monitor remote machines, WMI sensors need Active Directory account credentials to have access to the WMI interface. You can enter these credentials in the settings of the parent device or group, or in the root group. The sensor then inherits these settings.

For more information about all WMI sensors, see section Available Sensor Types.

Monitoring Windows Systems: Performance Counters

Besides sensors that can monitor Windows systems only via WMI, PRTG provides sensors capable of a hybrid approach. If you choose the hybrid approach, these sensors first try to query data via Windows performance counters using the Remote Registry service. These Windows sensors use WMI as a fallback if performance counters are not available or cannot be read out. When running in fallback mode, PRTG tries to connect to performance counters again after 24 hours. You can change the Preferred Data Source in the Windows Compatibility Options in the device settings.

You can identify these hybrid sensors by looking at their categories, for example, in the Add Sensor dialog. Search directly for "windows" and select "Performance Counters" as Technology Used. Among them are various sensors with "Windows" in the name, as well as some Hyper-V sensors.

Limitations of WMI

If you set a probe to use WSMan for WMI connections, the performance scales significantly better than DCOM and follows general probe sizing guidelines. See section System Requirements.

If you set a probe to use DCOM for WMI connections, the following limitations apply:

As of Windows Server 2016 or Windows 10, you can run most WMI sensors if you provide optimal conditions, such as running the PRTG core server system within the same LAN segment as the target systems. The actual performance can be significantly lower depending on the network topology and the WMI health of the target systems. Some configurations might not be able to go beyond 500 WMI sensors or fewer, depending on conditions.

On Windows Server 2016, you can run approximately 300 WMI sensors with a 1-minute scanning interval.

System performance (CPU, memory, etc.) of virtualization does not strongly affect WMI monitoring performance.

If you want to use WMI via the DCOM protocol for network monitoring of more than 20 or 30 systems, we recommend that you set up remote probes for WMI monitoring or switch to SNMP-based monitoring.

KNOWLEDGE BASE