Leon (@adatole) has done lots of papers in the past on WMI vs SNMP, but I have a more technical question.
When I poll using WMI, I get much more detailed statistics than I get when I poll using SNMP. I mean, literally, in a 30 minute window, WMI will reveal that CPU has been all over the map - from 10% up to 95%. If I look at the same time period with SNMP, I get a very sedate report of "Steady 20%, no problems here". Why does WMI report not agree with SNMP?
Also, a lot of people have stated that there is no impact in moving from SNMP to WMI or vice versa (or, that is to say, the impact is minimal). We run both in our organization, along with the Agent on our Domain Controllers. Do we get any benefit by comparing them? Chinese Proverb: "Man who own three clocks, never sure what time it is." Comparing them is an exercise in futility. Even when we set up a single workstation to poll using WMI and SNMP simultaneously, the stats don't agree.
Oh, and one more thing...in this new age of close examination of Event Logs, we've noticed that a server being polled from Orion generates massive numbers of Login/Logoff events. A machine which is running WMI and ONLY collecting stats every ten minutes will generate 4-8 events on a minute-by-minute basis. (Our Storage team noticed this on one of their servers.) For a machine which is monitoring a few Windows Services or a couple of Application monitors, the minute-by-minute count goes up to 15-20 per minute.
Does anyone know how the SNMP agent reports statistics back to Orion? Because our customers are getting sick of being told that CPU usage is at 95%, logging in and seeing that it's not...then they point at SNMP and say, "It was only at 20% the whole time!" Getting harder to be an Orion admin...