Recently had a client request to monitor for WMI leaks and receive alerts when the WMI process starts to consume resources.
Obviously there are other methods for monitoring and/or reporting on this, but in environments without access to these tools or the freedom to apply hotfixes (Yes, I have a client s with these types of restrictions), this method is suitable to their needs.
I’ve blogged a performance rule here but if you want to receive an alert, below will achieve this for you.