Home
  •  

WMI Memory Usage Monitor

Microsoft.SystemCenter.WMIPrivateBytes.Monitor (UnitMonitor)

This monitor checks WMI memory utilization on the computer.

Knowledge Base article:

Summary

The WMI service on this computer is using too much memory.

This monitor periodically checks the total memory usage of WMI on the computer by checking the Private Bytes counter for all process instances starting with WmiPrv and comparing that with 2 thresholds. By default this monitor will go into a warning state if any WMI related process consumes more than 500MB of memory. It will go into an error state if any WMI related process consumes more than 600MB of memory.

Causes

A possible cause is a WMI memory leak, causing WMI to consume more and more memory over time.

Resolutions

If you see a pattern of WMI memory issues, this monitor has a disabled recovery that will automatically restart WMI when the warning or error threshold is exceeded. If you see that this resolves the issue, you can enable one of those recoveries.

External

For more information on troubleshooting WMI problems, go to http://go.microsoft.com/fwlink/?LinkId=158224.

You can also download the WMI Diagnosis Utility at http://go.microsoft.com/fwlink/?LinkId=158226. The WMI Diagnosis Utility is a VBScript script designed to help you troubleshoot the WMI service on a computer.

Element properties:

TargetMicrosoft.SystemCenter.Agent
Parent MonitorSystem.Health.PerformanceState
CategoryPerformanceHealth
EnabledFalse
Alert GenerateTrue
Alert SeverityWarning
Alert PriorityNormal
Alert Auto ResolveTrue
Monitor TypeMicrosoft.SystemCenter.Performance.FilteredDoubleThreshold.MonitorType
RemotableTrue
AccessibilityPublic
Alert Message
WMI memory usage high

WMI Memory usage is too high
Instance {0}
Object {1}
Counter {2}
Has a value {3}
In Computer {4}
RunAsDefault

Source Code:

<UnitMonitor ID="Microsoft.SystemCenter.WMIPrivateBytes.Monitor" Accessibility="Public" Enabled="false" Target="SCLibrary!Microsoft.SystemCenter.Agent" ParentMonitorID="Health!System.Health.PerformanceState" Remotable="true" Priority="Normal" TypeID="Microsoft.SystemCenter.Performance.FilteredDoubleThreshold.MonitorType" ConfirmDelivery="false">

  <Category>PerformanceHealth</Category>

  <AlertSettings AlertMessage="Microsoft.SystemCenter.WMIPrivateBytes.Monitor.AlertMessage">

    <AlertOnState>Error</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Normal</AlertPriority>

    <AlertSeverity>Warning</AlertSeverity>

    <AlertParameters>

      <AlertParameter1>$Data/Context/InstanceName$</AlertParameter1>

      <AlertParameter2>$Data/Context/ObjectName$</AlertParameter2>

      <AlertParameter3>$Data/Context/CounterName$</AlertParameter3>

      <AlertParameter4>$Data/Context/Value$</AlertParameter4>

      <AlertParameter5>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</AlertParameter5>

    </AlertParameters>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="UnderThreshold1" MonitorTypeStateID="UnderThreshold1" HealthState="Success"/>

    <OperationalState ID="OverThreshold1UnderThreshold2" MonitorTypeStateID="OverThreshold1UnderThreshold2" HealthState="Warning"/>

    <OperationalState ID="OverThreshold2" MonitorTypeStateID="OverThreshold2" HealthState="Error"/>

  </OperationalStates>

  <Configuration>

    <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

    <CounterName>Private Bytes</CounterName>

    <ObjectName>Process</ObjectName>

    <InstanceName/>

    <AllInstances>true</AllInstances>

    <Frequency>300</Frequency>

    <Expression>

      <RegExExpression>

        <ValueExpression>

          <XPathQuery Type="String">InstanceName</XPathQuery>

        </ValueExpression>

        <Operator>ContainsSubstring</Operator>

        <Pattern>WmiPrv</Pattern>

      </RegExExpression>

    </Expression>

    <Threshold1>524288000</Threshold1>

    <Threshold2>629145600</Threshold2>

  </Configuration>

</UnitMonitor>