WMI Performance Counters
How would I go about monitoring the CPU% of a process (possibly multiple instances) by name (i.e. foo.exe), and reacting to a condition where the CPU% exceeds a certain threshold? I am looking into the WMI performance counter classes for some insight, as well as the "cooked" counters. Ideally, I'd like to maintain a moving average of CPU% of a process, such that I can react if a process has been exceeding a threshold for N seconds. This would allow me to normalize for "spikes" in CPU%. Once I identify a "overage" I would like to lower that process' priority and quantum until it drops under the threshold.
This requires some kind of advanced WMI scripting skills but it is doable.
Check vol 2 samples:
- Sample 3.79 - PerfMonProv.mof
- Sample 3.80 - PerfMonClasses.Mof
- Sample 3.81 - NTProcesses.wsf
Sample 3.79 registers the WMI provider.
Sample 3.81 just enumerates the NTProcess class created by Sample 3.80.
To get a notification, you can leverage Sample 6.17 - GenericEventAsyncConsumer.wsf (Vol 1 samples) and submit a WQL event query like
Select * FROM __InstanceModificationEvent WITHIN 10 Where TargetInstance isa 'NTProcess' and "TargetInstance.Process = 'Notepad.Exe'
From the process instance you retrieve from the WMI event, you can catch the Process ID.
With that Process ID, you can retrieve the corresponding Win32_Process instance and then invoke theSetPriority Method.
Note that Windows Service Resource Manager (WSRM) from Microsoft should be able to do this as well.
HTH
/Alain
WSRM actually requires W2K3 Enterprise or DC Editions. It is not available for other editions.
An option is Aurema's ARMCenter/ARMTech, also a workload manager. ARMTech sets up perfmon counters for any "Resource Consumer" (group of processes specified by admin). A Resource Consumer can be an app, a user, a group of users, etc... Once you have a perfmon counter, you can set up alerts.
ARMTech is a more full featured product than WSRM and supports more OSs (w2k, w2k3, xp and any version of these). A comparison could be Windows Terminal Services vs. Citrix Presentation server.
Hope this isn't inappropriate to ask here, but speaking of performance monitor, I have a web site on a W2K server that I recently moved to W2K3. I use performance monitor to watch the current anonymous users count. On W2K this works fine, with W2K3 this count shows zero, or at most 1. I know that there are many more users accessing this site than that. The sites are configured the same (as much as possible with the different IIS versions). Am I missing something in how perf mon works in W2K3?
