WMI Probes

The WMI probes use the Windows Management Instrumentation (WMI) to query a Windows system to monitor the status of various subsystems.

Notes:

Available WMI Probes

 

WMI CPU Utilization

This probe uses WMI to retrieve the percentage of time that the processor is executing a non-idle thread on the target host. Specifically, it queries the PercentProcessorTime property of the Win32_PerfFormattedData_PerfOS_Processor class and compares it against the Warning and Critical parameters you set.

The User parameter be a local user on the target host, or may take the form of "domain\user" for a domain login. Set it to "None" if authentication is not required, such as when the target is the localhost.

InterMapper invokes the cpu_util.vbs VB script which must reside in the Tools sub-directory of the InterMapper Settings directory. It uses the exit value to set the condition of the device and the performance data returned by the script to create a nice display of chartable data.

WMI Disk Available

This probe uses WMI to retrieve the disk space available on a drive on the target host. Specifically, it queries the Size and FreeSpace properties of the Win32_LogicalDisk class, computes percentage free space, and compares it against the Warning and Critical parameters you set.

The Drive parameter may be set to "All" to enumerate all Local hard drives on the host. It may also be set to a list of comma-separated drive names (including the colon), which will be listed whether or not they are local hard drives. Zero-sized drives (i.e. an empty cd-rom) will not be listed. The first drive failing the warning or critical criteria will be the one cited in the reason.

The User parameter may be a local user on the target host, or may take the form of "domain\user" for a domain login. Set it to "None" if authentication is not required, such as when the target is the localhost.

InterMapper invokes the disk_avail.vbs VB script which must reside in the Tools sub-directory of the InterMapper Settings directory. It uses the exit value to set the condition of the device and the performance data returned by the script to create a nice display of chartable data.

WMI Disk Defragmentation

This probe uses WMI to analyze disk fragmentation on a drive on the target host. Specifically, it calls the DefragAnalysis method of the Win32_Volume class and reports pertinent statistics from the analysis. If the drive needs to be defragmented, warning status is set for the device.

The Drive parameter is the drive letter assigned to the local disk to be analyzed, including the colon but without backslashes.

The User parameter may be a local user on the target host, or may take the form of "domain\user" for a domain login. Set it to "None" if authentication is not required, such as when the target is the localhost.

InterMapper invokes the defrag_analysis.vbs VB script which must reside in the Tools sub-directory of the InterMapper Settings directory. It uses the exit value to set the condition of the device and the performance data returned by the script to create a nice display of chartable data.

WMI Event Log

This probe uses WMI to retrieve entries from the Event Logs on the target host. Specifically, it queries the Win32_NTLogEvent class, limiting the search with the parameters you set. If matching events are found, a critical status is returned.

The Log File parameter contains a comma-separated list of the logs which are to be searched. At least one Log File is required.

The Event Codes parameter is a comma-separated list of event codes for which to search. Leave it blank to select all codes.

The Event Types parameter is a comma-separated list of either event type names or the corresponding numerical values. Names ans values can be intermixed. This limits the selection to events of these types.

The Hours, Minutes and Seconds parameters combine to define how far back in the event log to search. These parameters are subtracted from the current time and used to select events based on when they were written to the log.

The User parameter may be a local user on the target host, or may take the form of "domain\user" for a domain login. Set it to "None" if authentication is not required, such as when the target is the localhost.

InterMapper invokes the event_log.vbs VB script which must reside in the Tools sub-directory of the InterMapper Settings directory. It lists the files which meet you criteria and uses the exit value to set the condition of the device.

WMI File Check

This probe uses WMI to retrieve information about files on the target host. Specifically, it queries the CIM_DataFile class, limiting the search with the parameters you set.

The Path parameter specifies the location of the files you wish to check. It should include the drive and be enclosed in double-quotes if it contains spaces.

The File parameter contains the filename and extension of the file you wish to check. The path will be prepended to it during the final query. If it is blank, all files in the folder specified by the Path that meet the Size or time criteria will be listed. File may also be set to a list of comma-separated filenames which will each be prepended by the Path and used as query criteria.

Wildcards (* ?) may be used in the filename. If wildcards are used, be sure to specify the Path parameter or the query might take an inordinate amount of time. At least one of the File or Path parameters must be set.

The Size parameter defines the minimum file size criteria in bytes. Any files larger than this value will be listed. The Hours, Minutes and Seconds parameters combine to define how recently the file had to be changed to be listed. These parameters are subtracted from the current time and used to select files based on their LastModified value. At least one of these parameters must be set.

The User parameter may be a local user on the target host, or may take the form of "domain\user" for a domain login. Set it to "None" if authentication is not required, such as when the target is the localhost.

InterMapper invokes the file_chk.vbs VB script which must reside in the Tools sub-directory of the InterMapper Settings directory. It lists the files which meet you criteria and uses the exit value to set the condition of the device.

WMI Folder Check

This probe uses WMI to retrieve information about a folder on the target host. Specifically, it queries the Win32_Directory and CIM_DataFile classes to walk the directory tree and accumulate file and folder counts and the total of file sizes. It also notes the most recently modified file in the tree.

The Path parameter specifies the folder at the top of the tree which you wish to check. It should include the drive and be enclosed in double-quotes if it contains spaces.

Warning and Critical thresholds may be set for the number of folders, the number of files, and the total of the file sizes.

The User parameter may be a local user on the target host, or may take the form of "domain\user" for a domain login. Set it to "None" if authentication is not required, such as when the target is the localhost.

InterMapper invokes the folder_chk.vbs VB script which must reside in the Tools sub-directory of the InterMapper Settings directory. It lists the files which meet you criteria and uses the exit value to set the condition of the device.

WMI Free Memory

This probe uses WMI to retrieve the amount of physical memory available to processes running on the target host, in megabytes. Specifically, it queries the TotalPhysicalMemory property of the Win32_ComputerSystem class. It also queries the FreePhysicalMemory property of the Win32_OperatingSystem class and compares it against the Warning and Critical parameters you set.

The User parameter be a local user on the target host, or may take the form of "domain\user" for a domain login. Set it to "None" if authentication is not required, such as when the target is the localhost.

InterMapper invokes the free_mem.vbs VB script which must reside in the Tools sub-directory of the InterMapper Settings directory. It uses the exit value to set the condition of the device and the performance data returned by the script to create a nice display of chartable data.

System Information

This probe uses WMI to collect a variety of information about the monitored host, including hardware and operating system details. The target host must be running Windows 2000 or later.

The User parameter may be a local user on the target host, or may take the form of "domain\user" for a domain login. Set it to "None" if authentication is not required, such as when the target is the localhost.

InterMapper invokes the system_info.vbs VB script which, must reside in the Tools sub-directory of the InterMapper Settings directory. It uses the exit value to set the condition of the device and the performance data returned by the script to create a nice display of chartable data.

Installed software

This probe uses WMI to retrieve information about software installed on the target host. Specifically, it queries the Win32_Product class for information about products installed using Windows Installer. It also queries Win32_OperatingSystem and displays the operating system name, version and service pack level.

The target host must be running Windows XP, Windows Server 2003 or later.

Note: On Windows Server 2003, the Win32_Product class isn't always installed by default. You can install the "WMI Windows Installer Provider" component under "Management and Monitoring Tools" in "Add/Remove Windows Components".

The User parameter may be a local user on the target host, or may take the form of "domain\\user" for a domain login. Set it to "None" if authentication is not required, such as when the target is the localhost.

InterMapper invokes the installed_sofware.vbs VB script which is embedded in this probe and ultimately resides in the Tools sub-directory of the InterMapper Settings directory. It uses the exit value to set the condition of the device.

Logged-on users

This probe uses WMI to retrieve information about users logged on to the target host. Specifically, it queries the LogonType and StartTime properties of the Win32_LogonSession class, limiting the selection to those in the comma-separated list of numeric Logon Types you set in the Type parameter. It queries instances of the Win32_LoggedOnUser class, matches the LogonID and extracts the user's name and domain from the path of the Win32_Account. The target host must be running Windows XP, Windows Server 2003 or later.

The User parameter may be a local user on the target host, or may take the form of "domain\user" for a domain login. Set it to "None" if authentication is not required, such as when the target is the localhost.

InterMapper invokes the log_users.vbs VB script which is embedded as a companion script in this probe file. It uses the exit value to set the condition of the device and the performance data returned by the script to create a nice display of chartable data.

MSExchange 2007 Hub Transport Server

This probe uses WMI to retrieve performance information about the delivery queues on a MS Exchange 2007 Hub Transport Server. Specifically, it queries the Win32_PerfFormattedData_MSExchangeTransportQueues_MSExchangeTransportQueues class to collect a variety of queue statistics and then compares them to the criteria you set. The default criteria for warning and critical conditions are taken from the Microsoft TechNet article Monitoring Hub Transport Servers.

The User parameter may be a local user on the target host, or may take the form of "domain\\user" for a domain login. Leave it blank if authentication is not required, such as when the target is the localhost.

InterMapper invokes the ex07_transport.vbs VB script which must reside in the Tools sub-directory of the InterMapper Settings directory. It uses the exit value to set the condition of the device.

MSExchange 2007 Mailbox Server 

This probe uses WMI to retrieve performance information about the delivery queues on a MS Exchange 2007 Mailbox Server. Specifically, it queries the Win32_PerfFormattedData_MSExchangeIS_MSExchangeIS, Win32_PerfFormattedData_MSExchangeIS_MSExchangeISMailbox, Win32_PerfFormattedData_MSExchangeIS_MSExchangeISPublic, Win32_PerfFormattedData_MSExchangeSearchIndices_MSExchangeSearchIndices classes to collect a variety of statistics and then compares them to the criteria you set. The default criteria for warning and critical conditions are taken from the Microsoft TechNet article Monitoring Mailbox Servers.

The User parameter may be a local user on the target host, or may take the form of "domain\\user" for a domain login. Leave it blank if authentication is not required, such as when the target is the localhost.

InterMapper invokes the ex07_mailbox.vbs VB script which must reside in the Tools sub-directory of the InterMapper Settings directory. It uses the exit value to set the condition of the device.

SQL Server 2008 Service Monitor

This probe uses WMI to retrieve the state of Microsoft SQL Server 2008 services running on the target host by querying the Win32_Service class. Use the checkboxes to select the services which you want this probe to monitor. The states of the selected services are listed, and if any are not running, the status of the device is set to Critical. The target host must be running Windows 2000 or later.

The Instance parameter specifies the SQL Server instance you wish to monitor on the target host. If you wish to monitor the default instace you should leave this blank.

The User parameter may be a local user on the target host, or may take the form of "domain\\user" for a domain login. Leave it blank if authentication is not required, such as when the target is the localhost.

InterMapper invokes the sql2k8_serv_mon.vbs VB script which must reside in the Tools sub-directory of the InterMapper Settings directory. It uses the exit value to set the condition of the device.

WMI Network Utilization

This probe uses WMI to retrieve the network utilization on an interface on the target host. Specifically, it queries the BytesTotalPersec, CurrentBandwidth, OutputQueueLength and PacketsReceivedErrors properties of the Win32_PerfFormattedData_Tcpip_NetworkInterface class. It compares OutputQueueLength against the Warning and Critical parameters you set.

The interface may be selected by IP Address, MAC Address, or Index. You may use colons, hyphens or no separators when specifying a MAC address. The interface name is queried from the Win32_NetworkAdapterConfiguration class and used to query data from the Win32_PerfFormattedData_Tcpip_NetworkInterface class.

The User parameter may be a local user on the target host, or may take the form of "domain\user" for a domain login. Set it to "None" if authentication is not required, such as when the target is the localhost.

InterMapper invokes the net_util.vbs VB script which must reside in the Tools sub-directory of the InterMapper Settings directory. It uses the exit value to set the condition of the device and the performance data returned by the script to create a nice display of chartable data.

WMI Process Monitor

This probe uses WMI to retrieve information about processes running on the target host. Specifically, it queries the PercentProcessorTime properties of the Win32_PerfFormattedData_PerfProc_Process class and compares it against the Warning and Critical parameters you set. Any of the specified processes that are not found are listed and the status is set to Critical

The Process parameter is set to a comma-separated list of process names to check. Extensions are not included in the process names. Names containing spaces or other special characters should be enclosed in quotes. If multiple processes match the name, they will all be listed.

The User parameter may be a local user on the target host, or may take the form of "domain\user" for a domain login. Set it to "None" if authentication is not required, such as when the target is the localhost.

InterMapper invokes the proc_mon.vbs VB script which must reside in the Tools sub-directory of the InterMapper Settings directory. It uses the exit value to set the condition of the device and the performance data returned by the script to create a nice display of chartable data.

WMI Service Monitor

This probe uses WMI to retrieve the state of services running on the target host by querying the Win32_Service class. Any of the specified services that are not found are listed and the status is set to Critical

The Service parameter is set to a comma-separated list of service names to check. Names containing spaces or other special characters should be enclosed in quotes.

The User parameter may be a local user on the target host, or may take the form of "domain\user" for a domain login. Set it to "None" if authentication is not required, such as when the target is the localhost.

InterMapper invokes the serv_mon.vbs VB script which must reside in the Tools sub-directory of the InterMapper Settings directory. It uses the exit value to set the condition of the device.

WMI System Accessibility

This probe uses WMI to test accessibilty of a target device from the monitored host. Specifically, it uses the Win32_PingStatus class to test the connectivity and returns a response time which is chartable. If the target cannot be pinged, the status is set to critical and a discontinuity is inserted in the chart data.

Additional information about the monitored host is queried from the Win32_NetworkAdapterConfiguration and Win32_NTDomain classes and displayed in the status window.

The User parameter may be a local user on the target host, or may take the form of "domain\user" for a domain login. Set it to "None" if authentication is not required, such as when the target is the localhost.

InterMapper invokes the sys_access.vbs VB script which must reside in the Tools sub-directory of the InterMapper Settings directory. It uses the exit value to set the condition of the device and the performance data returned by the script to create a nice display of chartable data.

WMI Top Processes

This probe uses WMI to retrieve information about CPU utilization and processes running on the target host. Specifically, it queries the PercentProcessorTime property of the Win32_PerfFormattedData_PerfOS_Processor class and compares it against the Warning and Critical parameters you set. It queries the PercentProcessorTime properties of the Win32_PerfFormattedData_PerfProc_Process class and lists up to five processes using the most CPU time. Because there is a time lapse between collecting the CPU data and the process data, the reported values will not add up exactly.

The User parameter may be a local user on the target host, or may take the form of "domain\user" for a domain login. Set it to "None" if authentication is not required, such as when the target is the localhost.

InterMapper invokes the top_cpu.vbs VB script which must reside in the Tools sub-directory of the InterMapper Settings directory. It uses the exit value to set the condition of the device and the performance data returned by the script to create a nice display of chartable data.