SNMP vs WMI polling - pros and cons

This is very timely for us.  We are actually putting together this discussion now with Server 2012 stating it will have degraded SNMP and I can only assume after 2012 it will only get worse.

We are really having to dot our i's and cross our t's, because as I have stated in previous posts, our Data Security is run like the TSA and their concept of security is if you tell everyone "no" you have secured the environment.

WMI is much slower than SNMP.  With Server 2012 WMI is even slower than it used to be.  I generally always use SNMP when possible and use WMI as my 2nd option when necessary because of the speed.  Also, WMI tends to be more "buggy", I have never really had problems with SNMP as it's much more reliable.

Nice list though, I look to what others have to say!

This is something I ran into a while back in regards to WMI having an issue.  WMI utilizes reverse lookup for confirmation so an invalid reverse lookup can cause WMI to fail.

http://thwack.solarwinds.com/message/161528#161528

I prefer SNMP and also wouldn't like to lose all of my historical data by converting a node from SNMP to WMI or vice versa.  Since most all of my nodes were setup via SNMP I will stay the course barring any tremendous WMI improvement gains that would peak my interest again.

As a DoD admin SNMPv2 is now prohibited from being used.  We are being forced to use WMI to poll all our Windows servers.  Interface statistics are available via WMI directly.  Why can't NPM pull interface statistics using WMI?  Any hope for the capability to be added in the future?

I’d like to see the option to use both SNMP and WMI methods.

I monitor using SNMP across the board, but I want some of the options that WMI monitoring offers such as an account associated with the node (for service control via Solarwinds etc.)  and Disk Performance stats without needing to install “SNMP Informant Standard” on all my servers, or add  additional monitors manually.

I’m not saying that the same info should be gathered by both methods. I’m sure that the bods at Solarwinds know which data is best pulled from SNMP and which from WMI? If not, they could give the admin the choice of setting one as the primary method.

Hello all,

I'm looking for a definitive answer to just one thing.

Which monitoring protocol, WMI or SNMP, will affect performance of the monitored Windows 2008R2/2012R2 the least? WMI or SNMP? In the context of this question, it is not relevant which reveals any specific metric or health, only which puts more load on the monitored machine(s).

Thank you!!!

Pjc

to reiterate what Rob stated above:

it has has determined that it takes roughly the same amount of resources to complete a single (1) WMI poll as it does to complete five (5) SNMP polls.

adatole There is a missing pro & con of SNMP polling a windows server:

You will see (and can monitor) all of the virtual interfaces, thus causing UX/UI confusion to other users who are doing SNMP walks via "list resources" in Orion and making it harder than it should be to identify actual interfaces. On the plus side, you can monitor traffic across said interfaces. This is a windows server with 1 physical interface highlighted.

rob.hock One thing I always wondered with regards to WMI, how is the polling actually being done? Is it just a RPC using WMI credentials, or is it via powershell?

You are forgetting the native integration with propietary apps from Microsoft, APP Insight from SAM is built around this freature, (SQL, Exchange, IIS)

Great list Leon, glad I stumbled upon it.

Just adding the KB under the same post will help others.

What polling method should I use?

http://knowledgebase.solarwinds.com/kb/questions/3613/What+polling+method+should+I+use%3F

Leon,

Now that NPM 11.5 and SAM 6.2 are out there, I would like to re-visit this thread - but add Agent polling to the PRO/CON discussion. What are the considerations when deciding how to poll a Windows node? How do the various features (in particular some of the new ones) in NPM and SAM impact that decision?

Hi!

We use SNMP as our mainstay. We actually leverage WMI in templates for monitoring our Exchange Mount Points!

The templates use an AD Service Account for Solarwinds to poll the servers. It seems to work fine.

These Exchange Mount Point templates were created by Matthew LaSota of Sentinel Technologies! Leon I know you worked with him!

You were actually here in Chicago, Northwestern Memorial Hospital and helped us construct our current Solarwinds system!

You did a wonderful job!!!

Is there a difference in what information SNMP pulls from devices versus WMI?

At this time, I only see WMI as another method of polling. But will I see a difference in what information I will be able to get from polling WMI than SNMP?

Will I still be able to pull BIOS information, SN, etc.?

We currently have (4) pollers. Using NPM, SAM, NCM, UDT, QoE, IVIM, VNQM.

We will have our WPM on the pollers soon and getting it off of it's own server, so it is integrated with everything.

Soon, we will have a separate web server. Lots of people are using Solarwinds now.

Thanks much!

Cheryl

Hello Everyone!

For people that use snmp (like me),  What are you do about Software Inventory? Because using snmp I cant get all software installed

As I have said elsewhere, I would like to be able to configure nodes to use both SNMP and WMI. Using SNMP for those monitored items that are more efficiently monitored with SNMP (or not available via WMI). Having both WMI credentials and SNMP community strings associated with each node eases administration and makes using some of the GUI features, like service control so much easier.
Unless & until the enhancement request to offer dual monitoring becomes available, our policy is to monitor physical servers using SNMP, virtual Windows servers using WMI. For virtual Windows servers connected via NAT addresses, we plan to use the Agent.   

I want to start off by saying how great this thread is!  Extremely useful information when it comes to resource utilization and objects available for monitoring via snmp vs wmi.  What about from a security stand point?  I have heard many times that WMI is more secure than SNMP, and I assume the people that say that are referring to SNMPv2c. 

Only the WMI Service Account password is encrypted, correct?  Or is the username also encrypted when sent across the wire?

I know for a fact that SNMPv2c sends a plaintext community string, which is not secure at all.  SNMPv3 uses username/pw that is encrypted, but does Windows support SNMPv3?

What are your thoughts from a security stand point?

I wanted to throw another pro/con in. It looks like at least in 12.1, if you go from SNMP to WMI the snmp-location field is no longer used to auto map on the world map and rather the AD Site name is used. The problem is is uses cn= and not location= so you might break your mapping.