Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

General SAM Questions Involving WMI

Greetings Thwack,

I hope this is the correct place to post these "new guy" questions. I've recently been handed SAM to replace SCOM with the caveat of WMI only (I already attempted the Orion Agent pitch to no avail). I keep easily getting lost in the training videos and documentation and I believe I've searched the right areas. I will continue digging and I am not trying to "cop out," I've just found product forums to be more direct. I do apologize for my "newness" and thank you for your time.

Current Requirements:

WMI only, single / very limited port range, and non-administrator WMI. All of which I have documentation on.

Generic (Drive%, up/down, certificate lifespan, services down).

Anyway, concerning WMI:

1. There are some community templates that have "WMI - Only" in the title, am I correct in assuming these are the ones I should be seeking out as per my requirements?

2. Assuming I cannot find pre-made templates that fit my requirements, should I start researching strings and build my own? Are there good programs for this or is MSDN (seems incredibly vast) the place to be?

Find more posts tagged with

Accepted answers

rharland2012

Okay, that simplifies your life. Here's what I do when building SAM templates.

1. Make sure the node is imported into NPM already via WMI. That gets a plethora of basic network/compute/disk stuff, as I'm sure you know.

2. Isolate the application-specific metrics you want to monitor and measure.

3. If you want to just expose all the WMI metrics readily presented by a system, the Component Monitor Wizard is going to be your very good friend. Start there and see what's readily extractable.

4, Repeat, building appropriate SAM templates from the groups of measured components that you deem valuable.

I've been pleasantly surprised over the years how effective this admittedly basic technique has been for me.

All comments

jdumke

So you aren't allowed to do SNMP at all? Or you can't install anything special/extra to monitor?

I often troll for the templates, assign them and test to see if I can get what I want. If not, I just unassign them.

thwackdude

Jdumke, thank you for your reply.

As far as "agentless" is concerned, I don't think SNMP is off the table but it was my understanding (limited understanding) that when using WMI, there are more capture points available. The only thing that is off the table as of today is the Orion Agent. The goal is to start with a generalized "All Windows Servers" and move into things like SQL, IIS, Sharepoint, Exchange, etc.

bobmarley

You should be able to do everything you outlined (Generic (Drive%, up/down, certificate lifespan, services down) using WMI with no problem. I use it -vs- snmp in my environment.

If the SAM templates you need don't already exist its very easy to create custom ones on you own once you get the hang of using SAM.

I find it much easier to use than SCOM even though we still use both tools.

jm_sysadmin

We replaced SCOM 4 years with Solarwinds. Assuming you are only gathering information from Windows devices WMI will not be a limitation, although somethings (like the application insight templates for Exchange, SQL and IIS) also use scripts.

As far as your requirements for "WMI only, single / very limited port range, and non-administrator WMI" you can do it, but that is not a Solarwinds thing, that will be how your monitoring servers talk to the monitored nodes. Solarwinds will just use the OS functions to make the WMI calls, so if or when it breaks they won't have a lot of advice. As you likely know from you post the best way to do what you want is to use the agent, and this is exactly what my company does for the DMZ servers. (And soon maybe all windows clients). We wanted to reduce the ports and limit the access, and the agent helps with both issues.

As for finding things you need, what types of applications are you concerned about? I can say that most of our applications aren't widely used, and most of my templates are made by me, but its never really been an issue. If you run into problems, Thwack is a great first stop, go ahead an ask.

thwackdude

Bobmarley, thank you also for your reply.

Also, thank you for reassuring me my assumptions are correct. I get the basic structure of a WMI query, however, I suppose I'm looking for an easier way to get the strings I need to build my own template. I've gone through a few of the templates that are already in the SAM system but they don't seem to fit exactly what I am looking for. Essentially, I am learning by doing, definitely a learning curve.

Logically, the example WMI query makes sense: Select AvailableMBytes From Win32_PerfRawData_PerfOS_Memory but I am not entirely sure where look other than the vast MSDN site.

Just making sure I'm "barking up the right tree."

bobmarley

Some of the metrics you wanted are available as soon as you add a node like CPU, Memory, Disk, Hardware, and Interfaces. The rest like services can be added as SAM templates.

Try opening up a node and using the 'real time process explorer' and it will make templates pretty easily.

There are a bunch already included with SAM and a bunch more you can download here on Thwack.

thwackdude

JM_Sysadmin, thank you as well for your reply.

Good to know you were in the same boat I am currently. Windows come first since that is our majority and Linux will have to use (assuming) SNMP. Blanket system monitoring will come first and specialized (IIS, Exhcnage, SQL) ones will be built later. I believe I can still accomplish the specialized ones just different templates via WMI or SNMP (for Linux). I have relayed the support limitations of limited port range combine with non-administrative WMI access and it is understood.

Currently, I am concerned about what, as hinted in the previous sentence, I can apply to all Windows servers that indicate server health. Things like mounted disk space, downed services, certificate expiration, down/reboot, CPU over utilization, memory over utilization. Again, I do understand that specialized applications will required extra care in template creation but I just haven't gotten there yet, baby steps.

thwackdude

So, I haven't quite made it to the Alerting section yet for in-depth analysis but would I be accurate in guessing that those default parameters, absent of template, can be alerted on threshold? Very helpful, thus far, thank you. I'm still wading through templates and making notes about the ones that may work.

rharland2012

Can I assume that you're running SAM standalone with no NPM present or integrated?

thwackdude

Rharland2012,

Arg, sorry, I should have clarified. Running NPM, NQM, SAM, and VNQM; however, the SAM piece is what I was assigned since I currently administrate SCOM. Additional Polling Engine license approval should be coming soon.

Just getting my hands dirty with what we have currently.

thwackdude

I think that I may have preemptively posted ahead of poking around a bit more and possibly asking the wrong questions. I was focused primarily on the following article Create, apply, and alert on a WMI monitor - SolarWinds Worldwide, LLC. Help and Support . However, what I am finding is WMI as a fetching method can be used for a multitude of component monitors (Windows Service Monitor, Window Performance Counter Monitor), instead of using just WMI with WQL as an assignment. I still would like to hear from others that have created their own queries.

mikegale

Worry not, we don't have any agents deployed and run all sorts of Powershells against 1000s of servers. Make sure to explore the different components that come with SAM before you start scripting. These SolarWinds guys are on the ball and have already added all kinds of stuff. What kind of tasks are you looking to accomplish with the powershell? I'm always up for a challenge if it's something I can "kind of" replicate.

thwackdude

Mikegale, thank you for your response.

First of all, it is interesting to find out I should be able to run Powershell scripts, it's something we never go around to in SCOM, hopefully I can get to it in Solarwinds. Currently, with my original post I ran across an article by Solarwinds on how to create, apply and alert on a WMI monitor which states to enter in a query string and I am having an issue building those. I've seen few old programs that help with queries. Having said that, going through other documentation, more hands on, and this post here I built a test template using a Performance Counter Monitor with WMI as a fetching method.

To sum it up, I haven't gotten to the point of using remote powershell and I'm more trying to understand monitoring with WMI only in regard to templates. I suppose I was under the impression that most templates were built with the Orion Agent in mind. Also having to reverse engineer what has been done with SCOM over the years and cut the fat.

mikegale

I think you'll find that if you are adding your Windows nodes using WMI for the "Polling Method", you will probably have most of the metrics you're looking for out of the box. Don't hesitate to post questions here if you need help with custom Powershells later on.

thwackdude

Thank you again and I will!