WMI Query Failures monitoring Windows hosts (4228286)

Foglight may encounter WMI query failures when collecting performance data from monitored Windows hosts. These failures typically manifest as errors in the agent logs from collections and performance counters such as 

• DBSS_TempDB → Win32_PerfRawData_MSSQLFOGLIGHTP_MSSQLFOGLIGHTPTransactions
• DBSS_Logical_Disks → Win32_PerfRawData_PerfDisk_LogicalDisk
• DBSS_Host_Group → Win32_PerfRawData_PerfOS_Processor
• DBSS_Host_Group - Win32_PerfRawData_PerfOS_Memory
• DBSS_Host_Grouo - Win32_PerfRawData_PerfProc_Process
• DBSS_SQL_Server_Services - Win32_PerfRawData_PerfProc_Process
• DBSS_DTC_Information - Win32_PerfFormattedData_MSDTC_DistributedTransactionCoordinator

Each error includes the following message and are associated with missing or corrupted WMI performance counter classes.

QueryFailedException: Invalid query (0x80041017)

These errors are caused by missing or corrupted WMI performance counter classes on the monitored Windows host. This is a known issue in environments where:

• WMI classes are missing or not registered properly
• Performance counters are broken or corrupted
• The WMI repository is corrupted
• SQL Server instance names are misconfigured in Foglight
• The agent lacks sufficient permissions to access WMI
• Performance counters are disabled in the registry
• The WMI query syntax is malformed due to incorrect quotation marks when running the query directly using Powershell or wbemtest outside of Foglight
• The WMI class returns null or incomplete data due to OS-level issues

This is not a Foglight bug, but a system-level issue on the monitored host.

1. Verify WMI Class Availability:
   Use PowerShell to confirm the required WMI classes exist:
   Get-CimInstance -Namespace "root\cimv2" -ClassName "Win32_PerfRawData_PerfOS_Processor"

2. Rebuild Performance Counters:
   Run the following in an elevated Command Prompt:
   lodctr /R
   net stop pla
   net start pla

3. Repair WMI Repository:
   winmgmt /verifyrepository
   winmgmt /salvagerepository

4. Run wmiadap to Refresh Performance Classes:
   %windir%\system32\wbem\wmiadap.exe /f

5. Check Registry Settings:
   Ensure 'Disable Performance Counters' is set to 0 under:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PerfProc\Performance
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\PerfDisk\Performance

6. Replace Quotation Marks in Queries run using Wbemtest or Powershell outside of Foglight
   If copying queries from formatted documents, paste into Notepad first to remove smart quotes.

7. Ensure Agent Permissions:
   The Foglight agent must run under a user account with local administrator rights or membership in the Performance Monitor Users group.

8. Contact Microsoft:
   If WMI classes are still missing or corrupted, contact Microsoft support to recreate them.

A system reboot may be required after rebuilding performance counters or repairing the WMI repository.

Always back up the registry before making changes. Improper modification of the registry can cause system instability.