Using WBEMTEST to test DCOM and WMI connections to remote Windows systems (4033088)

Determining if WMI (Windows Management Instrumentation) information is retrievable from remote hosts.

Operating System (OS) information is not available from remote Windows systems.

The Agent retrieves OS metrics by using Microsoft WMI queries. In order for the OS collections to succeed, the WMI connection between the Agent Manager (FglAM) host and the monitored host must be valid. If the WMI connection itself will fail - the Agent will not be able to gather OS metrics.

Scripts use root\CIMV2 as the default. The default namespace used by scripts is configurable and is stored in the registry at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Scripting

If OS metrics are missing, the first step is to validate the WMI connection between the FglAM and Monitored host. Microsoft has a native, built-in tool called wbemtest, which can be easily executed and indicate if WMI is valid.

Windows Management Instrumentation (WMI) Tester (WBEMTEST.EXE) is a native Windows tool that is included on every computer that has WMI installed. You can use it to quickly identify whether WMI access is restricted on a remote host.

Running a WMI query from the FglAM host

1. Go to the Windows Start menu  > Run.
2. Enter "wbemtest" and click OK to open the Window Management Instrumentation Tester.
   
3. Click Connect 
4. The Connect property page should appear
   
5. In Namespace, type in the name space you want to connect to.  
   For example:  
   - to connect to remote host IP address or HOSTNAME , type in: \\Remote_Host_IP_Address\root\cimv2 \\HOSTNAME\root\cimv2
   (replace the hostname or IP address with details from the remote server)
   - to test the local machine, type in "root\cimv2"
   
6. In Credentials, leave  this field blank to use the current account.  To use another account,  enter in the username and password.  If it is a domain account, make sure you use the DOMAIN\USERNAME convention.
   NOTE: User credentials must have access to the remote computer and may require enabling RPC protocol on the remote computer. Please refer to KB 102431 for more information.
7. Click Connect.
8. If successful, you should see the following:  (note how the IWbemServices section is nolonger greyed out)
   
9. Click Query and enter a test query (e.g., select * from win32_perfrawdata)
10. Click Apply.
    
11. If the system is responding correctly to WMI queries, results will be returned. If the system is not responding correctly, an Error message will appear.
    
12. Click the Close button

Getting class names

WBEMTEST can also be used to see a list of WMI clases available in a namespace.

1. A list of the classes available on the remote system can be available by clicking the "Enum Classes" button
2. Select the Recursive radio button and leave the superclass name blank, then click the OK button.
   NOTE: Keeping this field blank starts the recursive list at the root of the class hierarchy.
   
3. A list of classes should be displayed. The class names listed all begn with a double underscore. Foglight monitoring uses classes beginning with the Win32_ prefix.
   

WMI scripts use the Distributed COM (DCOM) protocol when accessing remote machines. If Wbemtest issues an error message of any kind, please refer to Knowledgebase article 102431 for additional information on configuing the Windows operating systems for WMI.

Known fixes from Microsoft:

• Most known issues are on Windows 2008/ R2 OS types.
• WMI class leaks memory in Windows Server 2008 R2 and in Windows 7 - click here for the Microsoft article.
• The WMI service and the WMI providers stop responding when you use WMI performance classes to monitor performance on a computer that is running Windows 7 or Windows Server 2008 R2 - click here for the Microsoft article.
• The WMI Diagnosis Utility – Version 2.1 - click here for the Microsoft article.
• Additional information from Microsoft can be found here and here.