SolarWinds support is recommending agents over WMI. Thoughts?

I recently opened a ticket where a Windows node would report 90%+ CPU utilization in Solarwinds and be below 20% if we verified manually. We determined that it is Solarwinds polling that would cause this server to jump from around 15 to 20% CPU to high 90s or 100%. I can trigger polls and watch this behavior reliably. The technician has made the following statements and I am unsure of the accuracy:

"Using agent would give us more accurate data"
When I asked if the intent would ultimately be to swap all Windows servers to agents, he replied "This is recommended while monitoring servers"
When I replied that I had never heard that before and to please point out where that is in SolarWinds documentation: "I cannot find any article confirming the recommendation to use Agent vs WMI.
But I was able to confirm from a Seasoned Engineer that when we use Agent to poll the data from the server it will also use WMI to poll it while passing thru agent port."

So...for those of you that monitor oodles of Windows servers, what is your take?

Do you use the agent over WMI?
Have you experienced inaccurate data on CPU (in particular) or other components?

Find more posts tagged with

high cpu

support

Windows

Comments

antonis.athanasiou

We are using a mixed case of polling methods and there are several Windows servers polled via Agent. I have too seen issues with WMI and with the utilisation of PerfStack it was clear that WMI polling was the culprit. This was occurring every 10 minutes (on the regular node polling interval) but also in SAM where the polling was set to 5 minutes in the specific application monitor.

This of course was causing false data gathering, with CPU constantly showing between 80% and 100% but the actual server was idling in between polling cycles. Switching to Agent-based polling resolved the issue but it is still a mystery to me why this occurs on a (small) subset on servers and what would be the actual solution for WMI polling.

I doubt that the agent is polling using the same WMI queries as WMI polling as this would cause CPU spikes as well - I could be wrong as the inner mechanism of agent polling are not known to me.

I would challenge the engineer to go one step further, assign the case to an application engineer and investigate further, maybe a KB article (or a fix) will be released based on this.

mesverrum

I've seen this problem once in a while, usually on servers with only a single cpu, but your questions made me curious. This article talks about reviewing the WMI operational logs to see what's happening there. I noticed it shows the queries so I wonder if you run into another machine with the problem if you would take a look to compare the queries being used, as well as seeing what kinds of event logs are being generated on the problem servers?

windowsreport.com/.../

adam.beedell

Bit of a weird line by the support guy imo

"Using agent would give us more accurate data"
- Probably most of the metrics are the same, and just being collected. Agents can have an issue with ping stats when the aent breaks, and WMI can have issues with TCP port count maxing out, etc, pick your poison
When I asked if the intent would ultimately be to swap all Windows servers to agents, he replied "This is recommended while monitoring servers"
- Definately worth more thought than that imo. There are hard and soft limits with agents you'll hit at scale earlier than with WMI, and depending what settings you go for
- If you do mass agents, have a deployment and redeployment method under your belt
When I replied that I had never heard that before and to please point out where that is in SolarWinds documentation: "I cannot find any article confirming the recommendation to use Agent vs WMI.
But I was able to confirm from a Seasoned Engineer that when we use Agent to poll the data from the server it will also use WMI to poll it while passing thru agent port."
- Kinda what I was saying above, in that there'll be some counters in windows, and ultimately that's much of the potential data to be polled. Stuff like the accounts and internal vs external access is relevant though#

"Inaccurate CPU" in my experience usually comes down to a issue with terms being used, someone's thinking of a chat where something's being counted one way, and you're thinking of a chart being counted a different way

If it's actuallyi inaccurate and it's a windows device, it's probably the windows device's issue

If it's actually inaccurate and it's a some-random-vendor it's more likely there's a different SNMP MIB for it

marcrobinson

On to the questions:

"Using agent would give us more accurate data"
- Not necessarily. It is basically the same data. The agents do things a little differently, but the agents are still querying WMI at some point. The other comments also discuss this.
When I asked if the intent would ultimately be to swap all Windows servers to agents, he replied "This is recommended while monitoring servers"
- WMI vs Agents is still largely a matter of preference. SolarWinds does like you to use them, but there is not absolute reason to do so. It depends on your use case. There are some limitations to either method.
When I replied that I had never heard that before and to please point out where that is in SolarWinds documentation: "I cannot find any article confirming the recommendation to use Agent vs WMI. But I was able to confirm from a Seasoned Engineer that when we use Agent to poll the data from the server it will also use WMI to poll it while passing thru agent port."
- Yes the agents do send via a single port, but you can force wmi to do the same.

The agents behave differently from the WMI queries. The main way difference that I recall is that agents tend to send traffic in batches vs a stream from wmi. There are some variations with memory and cpu usage on the host, but it should be pretty small. Not 90% spikes for example.

There are lots of discussions on agents v agentless or agent versus wmi in thwack. I did a quick search on the agent as there was an article on technical aspects of the agent versus wmi (cpu usage etc.) and I could not find it this time. The short version - if everything on the server is normal / happy / well behaved - then it either polling method should be fine and give similar results.

designerfx

as the wise old monitoring Shakespeare says I would posit: to agent, or not to agent, is the question. Whether 'tis nobler in the mind to suffer The polls and queries of WMI, Or to take agents against a sea of troubles and by opposing end them?

The answer is that everything about having the option means you should understand there is no one-size fits all solution. With enough time for technologies, needs will always change, and so must we be prepared to accommodate the need of a business.

Some specific situations that can arise that identify use cases:

is a company okay with wmi polling and wmi random high ports?
is a company okay with an agent that is software and may or may not have it's own issues?
is a company wishing to use netpath
are there nodes in a dmz
do you prefer smaller port utilization
do you have nodes at remote sites that occasionally go offline for a time
do you need monitoring to be initiated locally or remotely?
do you need monitoring data to be pushed or pulled?

All of these define specific scenarios where agents are or are not needed. Multiple scenarios can apply in the same company.

ENTIRELY separate from this it is extremely important to note things that aren't considered nodes in Orion, such as cloud devices and vm's monitored solely through vman/vim and are not monitored directly.

chad.every

@jcrowe , can you post your support case number or DM it to me directly? Thanks.

vinay.by

Polling Using WMI versus the new Agent

Very Old Post, but then still has some great points.

__PRESENT__PRESENT

NVSteven

Our security team likes agents better. Just be sure to add the nodes via the SolarWinds Discovery process and not by local install to get the best results. You also don't have to worry about credentials changing or expiring using the agent.

bucweat

I'm assuming by "SolarWinds Discovery process" you are including remotely installing the agent executable from the web console. I know the Discovery process can be bit of a challenge (vs local install of agent), but I think you are right...once you figure it out the results are better. It does require access to \\[hostname]\admin$\temp for example. Would you, or anyone else here, have any good references for "SolarWinds Discovery process" and remote agent install?

NVSteven

Yes, installing from the web console. I currently going through developing our secure process with SolarWinds support and Internal resources. There isn't a great process or documentation around discovery of more than a handful of nodes.