Recently had a client request to monitor for WMI leaks and receive alerts when the WMI process starts to consume resources.
Obviously there are other methods for monitoring and/or reporting on this, but in environments without access to these tools or the freedom to apply hotfixes (Yes, I have a client s with these types of restrictions), this method is suitable to their needs.
I’ve blogged a performance rule here but if you want to receive an alert, below will achieve this for you.
1. New Unit Monitor:
2. Select Windows Performance Counters > Static Thresholds > Single Threshold > Simple Threshold
Choose your target management pack
3. Specify the monitors general properties.
As a rule, I try to keep the monitor target as narrow as possible.
For this particular monitor I choose the Performance Parent Monitor
4. Specify the performance counter:
I prefer to use the ‘Select’ option rather than manually defining.
5. Set your threshold.
For this monitor, we’re counting the WmiPrvSE executable usage of Private Bytes.. So set the threshold that you want to be alerted on in bytes
For the purpose of demonstration, I am setting to 20971520 (20MB).
6. Review health states and set accordingly.
For my purpose the defaults are fine.
7. Enable Alert and name it.
Adjust the settings here that suit your requirements and triage process.
Create!
Here’s what it looks like (I set my monitor to target server 2012 for the purpose of this demo)
Enjoy your new alerts!
Cheers’
Dan