Monitor WMI

The Monitor WMI object will trigger a Policy when a WMI event is received as a result of the WMI event query that you specify.

This object uses a satellite license. See Objects that Require Satellite Licenses for more information.

How it is used

The Monitor WMI object can be used to check for changes in devices that are attached to the server and trigger Policies that take corrective action when errors occur.

Configuration

To configure the Monitor WMI object you will need to know the computer that you are monitoring as well as the WMI event query that you want to execute. A WMI event query is different than a standard WMI query, see the Microsoft WMI documentation for information about building WMI queries.

Details Tab

 

Computer	Type the name of the computer that you are monitoring for new WMI events. You can also browse for the computer using the ellipsis (...) button.
Namespace	Type the name of the WMI namespace that you want to query.
WMI Query	Type the WMI event query that will be used to query the computer that you specified in the Computer field. For more information on WMI queries, see the Microsoft WMI documentation.

Syntax

Here is the syntax of a simple notification query:

SELECT * FROM [EventClass] WITHIN [interval] WHERE

TargetInstance ISA [object]

When you submit this WMI query, you are submitting a request to be notified of all occurrences of the event represented by [EventClass]. The WITHIN clause denotes how the test is performed, which is at an interval of seconds denoted by [interval]. The WHERE clause is used to narrow down your query and can include objects, properties of embedded objects and condition statements.

Examples

Monitor for the Addition of a Modem

The following query submits a notification request to monitor for the addition of a modem and will cause the WMI event to trigger if a modem is added. The test is performed at an interval of every 10 seconds:

SELECT * FROM __InstanceCreationEvent WITHIN 10 WHERE

TargetInstance ISA "Win32_POTSModem"

Monitor for the Deletion of a Modem

The following query submits a notification request to monitor for the deletion of a modem and will cause the WMI event to trigger if a modem is deleted. The test is performed at an interval of every 50 seconds:

SELECT * FROM __InstanceDeletionEvent WITHIN 50 WHERE

TargetInstance ISA "Win32_POTSModem"

Monitor for the Modification of a Display Configuration

The following query submits a notification request to monitor for the modification of a display configuration and will cause the WMI event to trigger if the display frequency is greater than 70. The test is performed at an interval of every 20 seconds:

SELECT * FROM __InstanceModificationEvent WITHIN 20 WHERE

TargetInstance ISA "Win32_DisplayConfiguration" AND

TargetInstance.DisplayFrequency > 70

Monitor for a Modification in a Processor value

The following query submits a notification request to monitor for a modification in a Processor value and will cause the WMI event to trigger if the CPU utilization is greater than 50. The test is performed at an interval of every 5 seconds:

SELECT * FROM __InstanceModificationEvent WITHIN 5 WHERE

TargetInstance ISA "Win32_Processor" AND

TargetInstance.LoadPercentage > 50

Hints and Tips

•	A query can be rejected by WMI if it is too complex or becomes resource-intensive for evaluation.

Available Published Data

 

Name	Description
Computer where the WMI query is performed	The name of the computer where the WMI query was executed.
WMI Query	The WMI query that was sent to the computer.
WMI Query Result as a string	The result of the WMI query.
WMI Namespace	The WMI namespace that you queried.

Common Published Data