Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Using WMI Process Monitor to Query 'svchost.exe' processes

I'm trying to get WMI to obtain the status of various services, eg RPC and DCOM Server Process Launcher. These and other services run from the executable 'svchost.exe -k XXXX' where 'XXXX' is the process identifier.

I've set up a WMI Process monitor using 'svchost.exe' as the process name. When tested by itself, this shows an 'up' status. However, when I add '-k RPCSS' (for instance) as a command line filter, I obtain 'test failed with unkown status'.

Is there any way to query these processes? Quite a few seem to use 'svchost' as their executable....

Find more posts tagged with

Accepted answers

All comments

mharvey

I'd recommend using a WMI Windows service monitor. This will get you the same information, but you can use the Service Name from the Windows Service Monitor rather than the process. So for RPC you would monitor the RpcSs service. This way you aren't having to chase down the appended process and PID. Just go to services, go into the properties and find the service name.

Regards,

Matthew Harvey

Loop1 Systems

http://www.loop1systems.com

yankeeexpat

Thanks, Matthew. I can use a WMI Windows service monitor if I place the local WMI account into the administrators group, but not otherwise. I'm guessing that the WMI account needs admin level permissions to a particular folder, but am not sure which (I've granted it full access to WMI Root and CIMV2). I don't want to leave the account with admin privileges, so I'll look into what additional rights it needs, and where, to use the WMI Windows service monitor without actually needing to be part of the admin group.

Thanks again!

rfletcher

I recently made a monitor to monitor a printing service that showed up as svchost, we used a service account in this case svcengineer to set the appropriate permissions to access the information.

EDIT: Here is the information from edit application menu:

Description	LPD Service	Override Template
Component Type:	Service Status - SNMP
Enable Component:	True	Override Template
Net Service Display Name:		Inherit from Template
Statistic Warning Threshold:	1.00	Override Template
Statistic Critical Threshold:	1.00	Override Template
User Notes		Override Template

aLTeReGo

I tested the command line filter using both WMI and RPC and both worked for me without issue. You may want to ensure the user account assigned to these component monitors has adequite permissions. If you need to use a non-admin account for monitoring with SAM we have a KB article that should help -> SolarWinds Knowledge Base :: How to create a non-administrator user for APM polling.

process commandline filter.png

yankeeexpat

aLTeReGo,

I examined the issue more closely by placing our WMI account into the local 'admin' group--sure enough, I could then poll for these processes. So I think you're right; this is a permissions issue, and I'll look at the article you referred to for guidance on configuring a non-admin WMI user to poll these processes.