SCOM

SCOM 2012 R2 – Custom Monitor and Alert (WMI Leak)

Recently had a client request to monitor for WMI leaks and receive alerts when the WMI process starts to consume resources.

Obviously there are other methods for monitoring and/or reporting on this, but in environments without access to these tools or the freedom to apply hotfixes (Yes, I have a client s with these types of restrictions), this method is suitable to their needs.

I’ve blogged a performance rule here but if you want to receive an alert, below will achieve this for you.

 

1. New Unit Monitor:

Monitor_new

 

2. Select Windows Performance Counters > Static Thresholds > Single Threshold > Simple Threshold

Choose your target management pack

Monitor_simplethreshold

 

3. Specify the monitors general properties.

As a rule, I try to keep the monitor target as narrow as possible.

For this particular monitor I choose the Performance Parent Monitor

Monitor_generalproperties

 

4. Specify the performance counter:

I prefer to use the ‘Select’ option rather than manually defining.

 

WMILeak_selectcounter

WMILeak_confirmcounter

 

5. Set your threshold.

For this monitor, we’re counting the WmiPrvSE executable usage of Private Bytes.. So set the threshold that you want to be alerted on in bytes

For the purpose of demonstration, I am setting to 20971520 (20MB).

Monitor_threshold

 

6. Review health states and set accordingly.

For my purpose the defaults are fine.

Monitor_states

 

 

7. Enable Alert and name it.

Adjust the settings here that suit your requirements and triage process.

Monitor_enable

Create!

 

Here’s what it looks like (I set my monitor to target server 2012 for the purpose of this demo)

Monitor_alertview

monitor_alertdetails

 

Enjoy your new alerts!

 

Cheers’

Dan