This article applies to PRTG Network Monitor 24


I'd like to verify an WMI error/value PRTG is reporting with the WMI Tester. Which fields and classes are used by PRTG for the various sensors?

Monitoring via WMI: WQL queries

This article provides WQL queries for the following WMI sensors, including Windows sensors that use the hybrid approach with WMI as fallback.

Note: WHERE parameters in chevrons must be replaced with your specific data. For example, instead of WHERE name ='<servicename>', you need to use WHERE name = 'PRTG Server' if you want to inspect the Server service of PRTG.

Note: If not stated otherwise, the namespace used is root\CIMV2.

Note: If you compare strings that contain backslashes, you need to double the backslashes. See the following example:Select * FROM Win32_Volume WHERE DeviceID LIKE '\\\\?\\Volume{bfffffff-4d8d-11e5-9bc2-806e6ffffffff}\\'

Hyper-V Virtual Network Adapter sensor

Pre-queries

SELECT Name FROM Win32_PerfRawData_IdePerfProvider_HyperVVirtualIDEControllerEmulatedSELECT Name FROM Win32_PerfRawData_NvspNicStats_HyperVVirtualNetworkAdapter

Hyper-V Virtual Storage Device sensor

"Add Sensor" pre-queries

SELECT Name FROM Win32_PerfRawData_IdePerfProvider_HyperVVirtualIDEControllerEmulatedSELECT Name FROM Win32_PerfRawData_StorageStats_HyperVVirtualStorageDevice SELECT Name,ElementName,Description FROM Msvm_ComputerSystem WHERE ProcessID<>NULL

Alternative:SELECT Name FROM Win32_PerfRawData_Counters_HyperVVirtualStorageDevice

Monitoring query

SELECT ReadBytesPersec, WriteBytesPersec, ErrorCount FROM Win32_PerfRawData_StorageStats_HyperVVirtualStorageDevice

Windows CPU Load sensor

Standard query

SELECT Name,Timestamp_Sys100NS, PercentProcessorTime FROM Win32_PerfRawData_PerfOS_Processor WHERE Name <> '_Total' 

Alternative query

SELECT Name, PercentProcessorTime FROM Win32_PerfFormattedData_PerfOS_Processor WHERE Name <> '_Total'

Windows IIS Application sensor

Pre-query

SELECT Name FROM Win32_PerfFormattedData_W3SVC_WebService

Monitoring query

SELECT TotalBytesReceived, TotalBytesSent, TotalGetRequests, TotalPostRequests, TotalNotFoundErrors, TotalCGIRequests, TotalAnonymousUsers, TotalNonAnonymousUsers, TotalFilesReceived, TotalFilesSent, ServiceUptime FROM Win32_PerfFormattedData_W3SVC_WebService WHERE Name='<instancename>'

Windows Network Card sensor

"Add Sensor" pre-query for the names of the adapters

SELECT Name, BytesTotalPerSec FROM Win32_PerfRawData_Tcpip_NetworkAdapterSELECT Name, BytesTotalPerSec FROM Win32_PerfRawData_Tcpip_NetworkInterface

"Add Sensor" pre-query for IPs/MACs of the adapters

SELECT Description, IPAddress, MACAddress FROM Win32_NetworkAdapterConfiguration WHERE Description LIKE '<adaptername>' AND IPEnabled=true AND MACAddress is not NULLwith <adaptername> being replaced with the name of one of the entries that were found with the name-query.

Monitoring query (Windows 2012 or later)

SELECT BytesReceivedPersec,BytesSentPerSec,PacketsPerSec FROM Win32_PerfRawData_Tcpip_NetworkAdapter WHERE Name = '<adaptername>'

Monitoring query (previous to Windows 2012)

SELECT BytesReceivedPersec,BytesSentPerSec,PacketsPerSec FROM Win32_PerfRawData_Tcpip_NetworkInterface WHERE Name = '<adaptername>'with <adaptername> being replaced with the name of one of the entries that were found with the name-query.

Windows Pagefile sensor

SELECT percentusage FROM Win32_PerfFormattedData_PerfOS_PagingFile WHERE Name='_Total'

Windows Physical Disk I/O sensor

SELECT Name FROM Win32_PerfRawData_PerfDisk_PhysicalDisk

Windows Process sensor

 SELECT ThreadCount,HandleCount,PrivateBytes, WorkingSet,PercentProcessorTime, PageFaultsPerSec,Timestamp_Sys100NS,IDProcess FROM Win32_PerfRawData_PerfProc_Process WHERE Name ='<executablename>' OR Name LIKE '<executablename>'

Windows System Uptime sensor

SELECT LastBootUpTime,LocalDateTime FROM Win32_OperatingSystem

WMI Event Log sensor

Pre-query

SELECT Name, LogFilename, Filename, NumberOfRecords FROM Win32_NTEventlogFile

Monitoring query

Note: The WMI Event Log sensor has a rather complex WHERE statement that is assembled according to the various filter inputs. For clarity we leave out this WHERE statement here. But keep in mind that querying the eventlog class unfiltered can take up considerable amounts of time!SELECT TimeGenerated,Message FROM Win32_NTLogEvent

WMI Exchange Server sensor

Pre-queries

SELECT MessagesDeliveredPersec,MessagesSentPersec,MessagesSubmittedPersec, MessagesQueuedForSubmission, AverageDeliveryTime FROM Win32_PerfRawData_MSExchangeIS_MSExchangeISMailboxSELECT RPCRequests,RPCAveragedLatency,RPCOperationsPersec,RPCNumofSlowPackets FROM Win32_PerfRawData_MSExchangeIS_MSExchangeISSELECT DatabasePageFaultsPersec,LogRecordStallsPersec,LogThreadsWaiting, DatabaseCacheSizeMB, DatabaseCachePercentHit FROM Win32_PerfRawData_ESE_MSExchangeDatabaseSELECT RPCLatencyaveragemsec,RPCRequestsoutstanding,ROPRequestsoutstanding, RPCRequestsfailed, RPCRequestssentPersec,RPCSlowrequests,RPCSlowrequestslatencyaveragemsec FROM Win32_PerfRawData_MSExchangeStoreInterface_MSExchangeStoreInterface

WMI File sensor

SELECT Lastmodified,Filesize FROM CIM_LogicalFilFree Disk Space e WHERE Drive ='<driveletter>:' AND Path='<path>' AND Filename = '<filename>' AND Extension = '<ext>'

WMI Free Disk Space (Multi Disk) sensor

All drives

SELECT DriveType,DeviceID,FreeSpace,Size,VolumeName FROM Win32_LogicalDisk WHERE DriveType=3

Specific drive

SELECT DriveType,DeviceID,FreeSpace,Size,VolumeName FROM Win32_LogicalDisk WHERE DeviceID='<driveletter>:'

WMI HDD Health sensor

Pre-queries

namespace = 'root\WMI'SELECT InstanceName, VendorSpecific FROM MSStorageDriver_ATAPISmartData

namespace = 'root\cimV2'SELECT Size, PNPDeviceID, SerialNumber, Name FROM Win32_DiskDriveSELECT Size, PNPDeviceID, Name FROM Win32_DiskDrive

Monitoring query

namespace = 'root\WMI';SELECT InstanceName, VendorSpecific FROM MSStorageDriver_ATAPISmartData

WMI Logical Disk I/O sensor

Pre-query

SELECT Name FROM Win32_PerfFormattedData_PerfDisk_LogicalDisk

WMI Memory sensor

Standard query

SELECT FreePhysicalMemory,TotalVisibleMemorySize FROM Win32_OperatingSystem

Alternative query

SELECT AvailableKBytes FROM Win32_PerfFormattedData_PerfOS_MemoryandSelect TotalPhysicalMemory FROM Win32_LogicalMemoryConfiguration

WMI Microsoft SQL Server 2014 sensor (also 2008 and 2012)

Pre-query

SELECT ServiceName,DisplayName FROM SQLService WHERE SQLServiceType = 1

WMI Remote Ping sensor

 SELECT PrimaryAddressResolutionStatus, Statuscode, Responsetime FROM Win32_PingStatus WHERE Address='<targetaddress>' AND BufferSize='<buffersize>' AND Timeout='<timeout+000>'

WMI Security Center sensor

Pre-queries

namespace = 'root\SecurityCenter2'SELECT DisplayName, instanceGUID, PathToSignedProductExe FROM AntivirusProduct

SELECT DisplayName, instanceGUID, PathToSignedProductExe FROM AntiSpywareProduct

SELECT DisplayName, instanceGUID, PathToSignedProductExe FROM FirewallProduct

namespace ='root\SecurityCenter'SELECT DisplayName FROM AntivirusProduct

Monitoring queries

SELECT productState FROM '<antivirtype>' Product WHERE DisplayName = '<displayname>'

Old

SELECT OnAccessScanningEnabled, ProductUpToDate FROM '<antivirtype>' Product WHERE DisplayName = '<displayname>'

WMI Service sensor

"Add Sensor" pre-query

SELECT Name,Caption,Description FROM Win32_Service

Monitoring query

SELECT Started,State,Status FROM Win32_Service WHERE Name='<servicename>'

WMI Share sensor

"Add Sensor" pre-query

SELECT Name,Description,Type FROM Win32_Share

Monitoring query

SELECT Status FROM Win32_Share WHERE Name = '<sharename>'

WMI SharePoint Process sensor

Pre-queries

SELECT Name FROM Win32_PerfFormattedData_MicrosoftWindowsSharePointMicrosoftSharePointFoundation4_SharePointFoundationSELECT Name FROM Win32_PerfFormattedData_W3SVC_WebService

Monitoring queries

SELECT ActiveThreads,CurrentPageRequests,ExecutingSqlQueries,GlobalHeapSize, ObjectCacheAlwaysLiveSize,TemplateCacheSize,ProcessID FROM Win32_PerfFormattedData_MicrosoftWindowsSharePointMicrosoftSharePointFoundation4_SharePointFoundation WHERE Name='<processname>'

All process IDs (total)

SELECT ProcessID FROM Win32_PerfFormattedData_MicrosoftWindowsSharePointMicrosoftSharePointFoundation4_SharePointFoundation WHERE ProcessID<>0

All needed processes (total)

SELECT IDProcess,PercentProcessorTime FROM Win32_PerfRawData_PerfProc_Process WHERE Name='_Total'

Single process

SELECT PercentProcessorTime FROM Win32_PerfFormattedData_PerfProc_Process WHERE IDProcess ='<processid>'

WMI UTC Time sensor

SELECT Day,Month,Year,Hour, Minute, Second FROM Win32_UTCTime

WMI Volume sensor (previous versions: Free Disk Space (Single Disk))

"Add Sensor" pre-query

SELECT DeviceID, DriveLetter, Name, Label, DriveType, FileSystem FROM Win32_Volume

Monitoring query

SELECT DeviceID, FreeSpace,Capacity FROM Win32_Volume WHERE DeviceID LIKE '<deviceid>'

Alternative query

SELECT Driveletter, FreeSpace,Capacity FROM Win32_Volume WHERE Driveletter LIKE '<driveletter>'

More about WQL

Find more information on Microsoft's Developer Network: WQL (SQL for WMI)