Recently had a client request to monitor for WMI leaks and receive alerts when the WMI process starts to consume resources.
Obviously there are other methods for monitoring and/or reporting on this, but in environments without access to these tools or the freedom to apply hotfixes (Yes, I have a client s with these types of restrictions), this method is suitable to their needs.
I’ve blogged a performance rule here but if you want to receive an alert, below will achieve this for you.
Create a rule to view the memory usage of WMI process in Windows 2008/2008 R2 (and 2012/2012 R2) agent managed computers.
As described here by Kevin Holman, there is a known WMI (KB981314) leak in 2008 R2 and Win 7 operating systems.
For those who want a to monitor and alert for this, here is how to do it.
(Note: Obviously there are other methods for reporting on the presence of the hotfix but for those without the luxury, this will be a nice little help)