3.8 Performance providers

3.8.1 High-performance providers

High-performance providers are implemented as instance providers. However, without going into the implementation details of High-performance providers, the major difference from standard instance providers is that they run as an in-process component of WMI or an application. (See Table 3.72.) The aim of a High-performance provider is to monitor data sent to the System Monitor of Windows 2000 or later. Having a High-performance provider has the advantage of not having WMI call the Performance Counter provider, which in turn, calls the performance library to collect the data. Basically, High-performance providers remove that layer, which greatly improves performance.

Table 3.72: The High-Performance Providers Capabilities
Provider Name	Provider namespace	Instance Provider	Support Get	Support Enumeration	Windows Server 2003	Windows XP	Windows 2000 Server	Windows 2003 Professional
High Performance Providers
HiperfCooker_v1	Root/WMI	X	X	X	X	X
HiPerfCooker_v1	Root/CIMV2	X	X	X	X	X
NT5_GenericPerfProvider_V1	Root/CIMV2	X	X	X	X	X	X	X

We must distinguish between two different High-performance providers in Windows:

The Performance Counter provider, which provides access to the raw counters data. This provider is only available in Windows 2000 and later. Its name is NT5_GenericPerfProvider_V1. It is available in the Root\CIMv2 namespace. The Performance Counter provider supports a set of classes derived from the Win32_PerfRawData class (see Table 3.73).

Table 3.73: The Win32_PerfRawData Classes
Name	Comments
Win32_PerfRawData_PerfProc_JobObjectDetails	% Job object Details shows detailed performance information about the active processes that make up a Job object.
Win32_PerfRawData_ASPNET_ASPNETApplications	ASP.NET Application performance counters
Win32_PerfRawData_ASPNET_ASPNET	ASP.NET global performance counters
Win32_PerfRawData_ASPNET_10321514_ASPNETAppsv10321514	ASP.NET v1.0.3215.14 application performance counters
Win32_PerfRawData_ASPNET_10321514_ASPNETv10321514	ASP.NET v1.0.3215.14 global performance counters
Win32_PerfRawData_NTDS_NTDS	CIM_StatisticalInformation is a root class for any arbitrary collection of statistical data and/or metrics applicable to one or more managed system elements.
Win32_PerfRawData_ESE_Database	Database provides performance statistics for each process using the ESE high-performance embedded database management system.
Win32_PerfRawData_Spooler_PrintQueue	Displays performance statistics about a Print Queue.
Win32_PerfRawData_FileReplicaConn_FileReplicaConn	Displays Performance statistics of the REPLICACONN Object.
Win32_PetfRawData_MSExchangeMTA_MSExchangeMTAConnections	Each instance describes a single known entity.
Win32_PerfRawData_ESE_DatabaseInstances	Instances in this process
Win32_PerfRawData_MSDTC_DistributedTransactionCoordinator	Microsoft Distributed Transaction Coordinator performance counters
Win32_PerfRawData_MSExchangeAL_MSExchangeAL	Microsoft Exchange Address List Service
Win32_PerfRawData_MSExchangeIS_MSExchangeIS	Microsoft Exchange Information Store performance data
Win32_PerfRawData_MSExchangeIS_MSExchangeISMailbox	Microsoft Exchange Mailbox Store performance data
Win32_PerfRawData_MSExchangeIS_MSExchangeISPublic	Microsoft Exchange Public Folder Store performance data
Win32_PerfRawData_MSExchangeSA_MSExchangeSANSPIProxy	NSPI Proxy used by Microsoft Exchange System Attendant
Win32_PerfRawCQta_MSExchangeMTA_MSExchangeMTA	Only one instance : global MTA performance data.
Win32_PerfRawCQta_PerfProc_JobObject	Reports the accounting and processor usage data collected by each active named Job object
Win32_PerfRawData_RSVP_RSVPInterfaces	RSVP Interfaces performance counters.
Win32_PerfRawData_RSVP_RSVPService	RSVP service performance counters.
Win32_PerfRawData_TermService_TerminalServicesSession	Terminal Services per-session resource monitoring.
Win32_PerfRawData_TermService_TerminalServices	Terminal Services summary information.
Win32_PerfRawData_ASP_ActiveServerPages	The Active Server Pages Object Type handles the Active Server Pages device on your system.
Win32_PerfRawData_PerfNet_Browser	The Browser performance object consists of counters that measure the rates of announcements, enumerations, and other Browser transmissions.
Win32_PerfRawData_PerfOS_Cache	The Cache performance object consists of counters that monitor the file system cache, an area of physical memory that stores recently used data as long as possible to permit access to the data without having to read from the disk. Because applications typically use the cache, the cache is monitored as an indicator of application I/O operations. When memory is plentiful, the cache can grow, but when memory is scarce, the cache can become too small to be effective.
Win32_PerfRawData_SMTPSVC_SMTPServer	The counters specific to the SMTP Server.
Win32_PerfRawData_PerfProc_FullImage_Costly	The Full Image performance object consists of counters that monitor the virtual address usage of images executed by processes on the computer. Full Image counters are the same counters as contained in Image object with the only difference being the instance name. In the Full Image object, the instance name includes the full file path name of the loaded modules, while in the Image object only the filename is displayed.
Win32_PerfRawData_Tcpip_ICMP	The ICMP performance object consists of counters that measure the rates at which messages are sent and received by using ICMP protocols. It also includes counters that monitor ICMP protocol errors.
Win32_PerfRawData_PerfProc_Image_Costly	The Image performance object consists of counters that monitor the virtual address usage of images executed by processes on the computer.
Win32_PerfRawData_InetInfo_InternetInformationServiceGlobal	The Internet Information Services Global object includes counters that monitor Internet Information Services (the Web service and the FTP service) as a whole.
Win32_PerfRawData_Tcpip_IP	The IP performance object consists of counters that measure the rates at which IP datagrams are sent and received by using IP protocols. It also includes counters that monitor IP protocol errors.
Win32_PerfRawData_PerfDisk_LogicalDisk	The Logical Disk performance object consists of counters that monitor logical partitions of a hard or fixed disk drives. Performance Monitor identifies logical disks by their a drive letter, such as C.
Win32_PerfRawData_PerfOS_Memory	The Memory performance object consists of counters that describe the behavior of physical and virtual memory on the computer. Physical memory is the amount of random access memory on the computer. Virtual memory consists of the space in physical memory and on disk. Many of the memory counters monitor paging, which is the movement of pages of code and data between disk and physical memory. Excessive paging, a symptom of a memory shortage, can cause delays which interfere with all system processes.
Win32_PerfRawData_MSExchangeSRS_MSExchangesSRS	The MSExchangeSRS Object Type handles the Microsoft Exchange Site Replication service on your system.
Win32_PerfRawData_Tcpip_NBTConnection	The NBT Connection performance object consists of counters that measure the rates at which bytes are sent and received over the NBT connection between the local computer and a remote computer. The connection is identified by the name of the remote computer.
Win32_PerfRawData_Tcpip_NetworkInterface	The Network Interface performance object consists of counters that measure the rates at which bytes and packets are sent and received over a TCP/IP network connection. It includes counters that monitor connection errors.
Win32_PerfRawData_NntpSvc_NNTPCommands	The NNTP Commands object includes counters for all NNTP commands processed by the NNTP service.
Win32_PerfRawData_NntpSvc_NNTPServer	The NNTP Server object type includes counters specific to the NNTP Server service.
Win32_PerfRawData_PerfOS_Objects	The Object performance object consists of counters that monitor logical objects in the system, such as processes, threads, mutexes, and semaphores. This information can be used to detect the unnecessary consumption of computer resources. Each object requires memory to store basic information about the object
Win32_PerfRawData_PerfOS_PagingFile	The Paging File performance object consists of counters that monitor the paging file(s) on the computer. The paging file is a reserved space on disk that backs up committed physical memory on the computer.
Win32_PerRawData_PerfDisk_PhysicalDisk	The Physical Disk performance object consists of counters that monitor hard or fixed disk drive on a computer. Disks are used to store file, program, and paging data and are read to retrieve these items, and written to record changes to them. The values of physical disk counters are sums of the values of the logical disks (or partitions) into which they are divided.
Win32_PerfRawData_PerfProc_ProoesAddressSpace_Costly	The Process Address Space performance object consists of counters that monitor memory allocation and use for a selected process.
Win32_PerfRawData_PerfProc_Process	The Process performance object consists of counters that monitor running application program and system processes. All the threads in a process share the same address space and have access to the same data.
Win32_PerfRawData_PerfOS_Processor	The Processor performance object consists of counters that measure aspects of processor activity. The processor is the part of the computer that performs arithmetic and logical computations, initiates operations on peripherals, and runs the threads of processes. A computer can have multiple processors. The processor object represents each processor as an instance of the object.
Win32_PerfRawData_RemoteAccess_RASTotal	The RAS performance object consists of counters that combine values for all ports of the Remote Access Service (RAS) device on the computer.
Win32_PerfRawData_RemoteAccess_RASPort	The RAS performance object consists of counters that monitor individual Remote Access Service ports of the RAS device on the computer.
Win32_PerfRawData_PerfNet_Redirector	The Redirector performance object consists of counters that monitor network connections originating at the local computer.
Win32_PerfRawData_PerfNet_Server	The Server performance object consists of counters that measure communication between the local computer and the network.
Win32_PerfRawData_PerfNet_ServerWorkQueues	The Server Work Queues performance object consists of counters that monitor the length of the queues and objects in the queues.
Win32_PerfRawData_PerfOS_System	The System performance object consists of counters that apply to more than one instance of a component processors on the computer.
Win32_PerfRawData_Tcpip_TCP	The TCP performance object consists of counters that measure the rates at which TCP Segments are sent and received by using the TCP protocol. It includes counters that monitor the number of TCP connections in each TCP connection state.
Win32_PerfRawData_TapiSrv_Telephony	The Telephony System
Win32_PerfRawData_PerfProc_ThreadDetails_Costly	The Thread Details performance object consists of counters that measure aspects of thread behavior that are difficult or time-consuming or collect. These counters are distinguished from those in the Thread object by their high overhead.
Win32_PerfRawData_PerfProc_Thread	The Thread performance object consists of counters that measure aspects of thread behavior. A thread is the basic object that executes instructions on a processor. All running processes have at least one thread.
Win32_PerfRawData_Tcpip_UDP	The UDP performance object consists of counters that measure the rates at which UDP datagrams are sent and received by using the UDP protocol. It includes counters that monitor UDP protocol errors.
Win32_PerfRawData_W3SVC_WebServiceCache	The Web Service Cache Counters object includes cache counters specific to the World Wide Web Publishing Service.
Win32_PerfRawData_W3SVC_WebService	The Web Service object includes counters specific to the World Wide Web Publishing Service.
Win32_PerfRawData_NTFSDRV_SMTPNTFSStoreDriver	This object represents global counters for the Exchange NTFS Store driver.

The Cooked Counter provider, which provides calculated counter data. This provider is only available under Windows XP or Windows Server 2003. Its name is HiPerfCooker_v1. It is available in both the Root\CIMv2 namespace and the Root\WMI namespace. The Cooked Counter provider supports a set of classes derived from the Win32_PerfFormattedData class (see Table 3.74).

Table 3.74: The Win32_PerfFormattedData Classes
Name	Win32 _PerfRawData class	Comments
Win32_PerfFormattedData_ESE_Database	Win32_PerfRawData_ESE_Database	Database provides performance statistics for each process using the ESE high performance embedded database management system.
Win32_PerfFormattedData_ESE_DatabaseInstances	Win32_PerfRawData_ESE_DatabaseInstances	Instances in this process
Win32_PerfFormattedData_FileReplicaConn_FileReplicaConn	Win32_PerfRawData_FileReplicaConn_FileReplicaConn	Displays Performance statistics of the REPLICACONN Object.
Win32_PerfFormattedData_MSDTC_DistributedTransactionCoordinator	Win32_PerfRawData_MSDTC_DistributedTransactionCoordinator	Mlicrosoft Distributed Transaction Coordinator performance counters
Win32_PerfFormattedData_MSExchangeAL_MSExchangeAL	Win32_PerfRawData_MSExchangeAL_MSExchangeAL	Microsoft Exchange Address List Service
Win32_PerfFormattedData_MSExchangeIS_MSExchangeIS	Win32_PerfRawData_MSExchangeIS_MSExchangesIS	Microsoft Exchange Information Store performance data
Win32_PerfFormattedData_MSExchangeIS_MSExchangeISMailbox	Win32_PerfRawData_MSExchangeIS_MSExchangeISMailbox	Microsoft Exchange Mailbox Store performance data
Win32_PerfFormattedData_MSExchangeIS_MSExchangeISPublic	Win32_PerfRawData_MSExchangeIS_MSExchangeISPublic	Microsoft Exchange Public Folder Store performance data
Win32_PerfFormattedData_MSExchangeMTA_MSExchangeMTA	Win32_PerfRawData_MSExchangeMTA_MSExchangeMTA	Only one instance : global MTA performance data.
Win32_PerfFormattedData_MSExchangeMTA_MSExchangeMTAConnections	Win32_PerfRawData_MSExchangeMTA_MSExchangeMTAConnections	Each instance describes a single known entity.
Win32_PerfFormattedData_MSExchangeSA_MSExchangeSANSPIProxy	Win32_PerfRawData_MSExchangeSA_MSExchangeSANSPIProxy	NSPI Proxy used by Microsoft Exchange System Attendant
Win32_PerfFormattedData_MSExchangeSRS_MSExchangeSRS	Win32_PerfRawData_MSExchangeSRS_MSExchangeSRS	The MSExchangeSRS Object Type handles the Microsoft Exchange Site Replication service on your system.
Win32_PerfFormattedData_NTDS_NTDS	Win32_PerfRawData_NTDS_NTDS	CIM_StatisticalInformation is a root class for any arbitrary collection of statistical data and/or metrics applicable to one or more managed system elements.
Win32_PerfFormattedData_NTFSDRV_SMTPNTTTSStoreDriver	Win32_PerfRawData_NTFSDRV_SMTPNTFSStoreDriver	This object represents global counters for the Exchange NTFS Store driver
Win32_PerfFormattedData_PerfDisk_LogicalDisk	Win32_PerfRawData_PerfDisk_LogicalDisk	The Logical Disk performance object consists of counters that monitor logical partitions of a hard or fixed disk drives. Performance Monitor identifies logical disks by their a drive letter, such as C.
Win32_PerfFormattedData_PerfDisK_PhysicalDisk	Win32_PerfRawData_PerfDisk_PhysicalDisk	The Physical Disk performance object consists of counters that monitor hard or fixed disk drive on a computer. Disks are used to store file, program, and paging data and are read to retrieve these items, and written to record changes to them. The values of physical disk counters are sums of the values of the logical disks (or partitions) into which they are divided.
Win32_PerfFormattedData_PerfNet_Browser	Win32_PerfRawData_PerfNet_Browser	The Browser performance object consists of counters that measure the rates of announcements, enumerations, and other Browser transmissions.
Win32_PerfFormattedData_PerfNet_Redirector	Win32_PerfRawData_PerfNet_Redirector	The Redirector performance object consists of counter that monitor network connections originating at the local computer.
Win32_PerfFormattedData_PerfNet_Server	Win32_PerfRawData_PerfNet_Server	The Server performance object consists of counters that measure communication between the local computer and the network.
Win32_PerfFormattedData_PerfNet_ServerWorkQueues	Win32_PerfRawData_PerfNet_ServerWorkQueues	The Server Work Queues performance object consists of counters that monitor the length of the queues and objects in the queues.
Win32_PerfFormattedData_PerfOS_Cache	Win32_PerfRawData_PerfOS_Cache	The Cache performance object consists of counters that monitor the file system cache, an area of physical memory that stores recently used data as long as possible to permit access to the data without having to read from the disk. Because applications typically use the cache, the cache is monitored as an indicator of application I/O operations. When memory is plentiful, the cache can grow, but when memory is scarce, the cache can become too small to be effective.
Win32_PerfFormattedData_PerfOS_Memory	Win32_PerfRawData_PerfOS_Memory	The Memory performance object consists of counters that describe the behavior of physical and virtual memory on the computer. Physical memory is the amount of random access memory on the computer. Virtual memory consists of the space in physical memory and on disk. Many of the memory counters monitor paging, which is the movement of pages of code and data between disk and physical memory. Excessive paging, a symptom of a memory shortage, can cause delays which interfere with all system processes.
Win32_PerfFormattedData_PerfOS_Objects	Win32_PerfRawData_PerfOS_Objects	The Object performance object consists of counters that monitor logical objects in the system, such as processes, threads, mutexes, and semaphores. This information can be used to detect the unnecessary consumption of computer resources. Each object requires memory to store basic information about the object.
Win32_PerFormattedData_PerfOS_PagingFile	Win32_PerfRawData_PerfOS_PagingFile	The Paging File performance object consists of counters that monitor the paging file(s) on the computer. The paging file is a reserved space on disk that backs up committed physical memory on the computer.
Win32_PerfFormattedData_PerfOS_Processor	Win32_PerfRawData_PerfOS_Processor	The Processor performance object consists of counters that measure aspects of processor activity The processor is the part of the computer that performs arithmetic and logical computations, initiates operations on peripherals, and runs the threads of processes. A computer can have multiple processors. The processor object represents each processor as an instance of the object.
Win32_PerfFormattedData_PerfOS_System	Win32_PerfRawData_PerfOS_System	The System performance object consists of counters that apply to more than one instance of a component processors on the computer.
Win32_PerfFormattedData_PerfProc_FullImage_Costly	Win32_PerfRawData_PerfProc_FullImage_Costly	The Full Image performance object consists of counters that monitor the virtual address usage of images executed by processes on the computer. Full Image counters are the same counters as contained in Image object with the only difference being the instance name. In the Full Image object, the instance name includes the full file path name of the loaded modules, while in the Image object only the filename is displayed.
Win32_PerfFormattedData_PerfProc_Image_Costly	Win32_PerfRawData_PerfProc_Image_Costly	The Image performance object consists of counters that monitor the virtual address usage of images executed by processes on the computer.
Win32_PerfFormattedData_PerfProc_JobObject	Win32_PerfRawData_PerfProc_JobObject	Reports the accounting and processor usage data collected by each active named Job object.
Win32_PerfFormattedData_PerfProc_JobObjectDetails	Win32_PerfRawData_PerfProc_JobObjectDetails	% Job object Details shows detailed performance information about the active processes that make up a Job object.
Win32_PerfFormattedData_PerfProc_Process	Win32_PerfRawData_PerfProc_Process	The Process performance object consists of counters that monitor running application program and system processes. All the threads in a process share the same address space and have access to the same data.
Win32_PerfFormattedData_PerfProc_ProcessAddressSpace_Costly	Win32_PerfRawData_PerfProc_ProcessAddressSpace_Costly	The Process Address Space performance object consists of counters that monitor memory allocation and use for a selected process.
Win32_PerFormattedData_PerfProc_Thread	Win32_PerfRawData_PerfProc_Thread	The Thread performance object consists of counters that measure aspects of thread behavior. A thread is the basic object that executes instructions on a processor. All running processes have at least one thread.
Win32_PerfFormattedData_PerProc_ThreadDetails_Costly	Win32_PerfRawData_PerfProc_ThreadDetails_Costly	The Thread Details performance object consists of counters that measure aspects of thread behavior that are difficult or time-consuming or collect These counters are distinguished from those in the Thread object by their high overhead.
Win32_PerfFormattedData_RemoteAccess_RASPort	Win32_PerffRawData_RemoteAccess_RASPort	The RAS performance object consists of counters that monitor individual Remote Access Service ports of the RAS device on the computer.
Win32_PerfFormattedData_RemoteAccess_RASTotal	Win32_PerfRawData_RemoteAccess_RASTotal	The RAS performance object consists of counters that combine values for all ports of the Remote Access service (RAS) device on the computer.
Win32_PerfFormattedData_RSVP_RSVPInterfaces	Win32_PerfRawData_RSVP_RSVPInterfaces	RSVP Interfaces performance counters.
Win32_PerfFormattedData_RSVP_RSVPService	Win32_PerfRawData_RSVP_RSVPService	RSVP service performance counters.
Win32_PerfFormattedData_Spooler_PrintQueue	Win32_PerfRawData_Spooler_PrintQueue	Displays performance statistics about a Print Queue.
Win32_PerfFormattedData_TapiSrv_Telephony	Win32_PerfRawData_TapiSrv_Telephony	The Telephony System
Win32_PerfFormattedData_Tcpip_ICMP	Win32_PerfRawData_Tcpip_ICMP	The ICMP performance object consists of counters that measure the rates at which messages are sent and received by using ICMP protocols. It also includes counters that monitor ICMP protocol errors.
Win32_PerfFormattedData_Tcpip_IP	Win32_PerfRawData_Tcpip_IP	The IP performance object consists of counters that measure the rates at which IP datagrams are sent and received by using IP protocols. It also includes counters that monitor IP protocol errors.
Win32_PerfFormattedData_Tcpip_NBTConnection	Win32_PerfRawData_Tcpip_NBTConnection	The NBT Connection performance object consists of counters that measure the rates at which bytes are sent and received over the NBT connection between the local computer and a remote computer. The connection is identified by the name of the remote computer.
Win32_PerfFormattedData_Tcpip_NetworkInterface	Win32_PerfRawData_Tcpip_NetworkInterface	The Network Interface performance object consists of counters that measure the rates at which bytes and packets are sent and received over a TCP/IP network connection. It includes counters that monitor connection errors.
Win32_PerFormattedData_Tcpip_TCP	Win32_PerfRawData_Tcpip_TCP	The TCP performance object consists of counters that measure the rates at which TCP Segments are sent and received by using the TCP protocol. It includes counters that monitor the number of TCP connections in each TCP connection state.
Win32_PerfFormattedData_Tcpip_UDP	Win32_PerfRawData_Tcpip_UDP	The UDP performance object consists of counters that measure the rates at which UDP datagrams are sent and received by using the UDP protocol. It includes counters that monitor UDP protocol errors.
Win32_PerfFormattedData_TermSeivice_TerminalServices	Win32_PerfRawData_TermService_TerminalServices	Terminal Services summary information.
Win32_PerfFormattedData_TermService_TerminalServicesSession	Win32_PerfRawData_TermService _TerminalServicesSession	Terminal Services per-session resource monitoring.

Both class types (raw and cooked) follow the same naming convention, which is of the form:

Win32_PerfRawData_<service_name>_<object_name>
Win32_PerfFormattedData_<service_name>_<object_name>

When dealing with TCP/IP information at the level of the network interface, we will have a class name such as Win32_PerfRawData_Tcpip_ NetworkInterface for the raw data counters and Win32_PerfFormattedData_Tcpip_NetworkInterface for the cooked data counters.

The WMI AutoDiscovery/AutoPurge (ADAP) process transfers performance counter objects registered in the performance counter libraries into Win32_PerfRawData and Win32_PerfFormattedData classes in the WMI repository. When a new performance library is found, ADAP then adds a related performance object to the CIM repository. When an application is deinstalled, the deleted performance library is also detected by ADAP and it updates the CIM repository accordingly. So, basically, the ADAP process parses the performance libraries to build the Win32_PerfRawData and Win32_PerfFormattedData classes in the CIM repository.

You can look for errors generated by ADAP in two places: the NT Application Event Log (with the Event Viewer) and the WMI application event logs (in Windows\System32\Wbem\Logs\Wmiadap.log).

With the _ADAPStatus system class, it is possible to determine the status of the last ADAP execution. This system class exposes three read-only properties, described in Table 3.75. The __ADAPStatus system class is a singleton class located in the Root\Default namespace. The information exposed by the instance of the __ADAPStatus system class provides data about the most recent run of ADAP.

Table 3.75: The __ADAPStatus System Class Properties
Name	Type	Comments
LastStartTime	datetime	Last time the ADAP process started.
LastStopTime	datetime	Last time the ADAP process completed.
Status	uint32	Defines the current state of the ADAP process. 0 Process has never run on this computer. 1 Process is currently running. 2 Process is processing a performance library. 3 Process is updating and committing changes to WMI. 4 Process has finished.

Although started automatically, it is always possible to force a synchronization of the performance counters with the CIM repository content by using, for Windows 2000:

 C:\>Winmgmt /resyncperf <PID_of_WINMGMT.EXE>

For Windows XP and Windows Server 2003, use the following:

 C:\Winmgmt /resyncperf

In WMI, the Win32_PerfFormattedData is a calculated performance counter coming from the corresponding Win32_PerfRawData class representing the raw counter performance. The correspondence between the cooked class and the raw class is defined with the AutoCook_RawClass qualifier set on the same-named Win32_PerfFormattedData class. Table 3.74 shows the corresponding classes. Note that all Win32_PerfFormattedData classes have a corresponding Win32_PerfRawData class. For example, the Win32_PerfFormattedData_Tcpip_NetworkInterface has the AutoCook_ RawClass qualifier set with a value equal to the name of the Win32_ PerfRawData_Tcpip_NetworkInterface class.

Because the Win32_PerfFormattedData_Tcpip_NetworkInterface properties data is calculated from the Win32_PerfRawData_Tcpip_NetworkInterface properties data, this implies the use of a formula for each of the properties exposed by the Win32_PerfFormattedData_Tcpip_NetworkInterface class. The formula type is defined in a property qualifier for each calculated property of the Win32_PerfFormattedData_Tcpip_NetworkInterface class. This qualifier is called the CookingType qualifier and contains a cooking type identifier. Table 3.76 lists the Win32_PerfFormattedData_Tcpip_NetworkInterface properties exposing cooked counter information with the associated formula.

Table 3.76: The Win32_PerfFormattedData_Tcpip_NetworkInterface Properties
Name	Type	Cooking Type	Comments
BytesReceivedPersec	uint32	PERF_COUNTER_COUNTER	Bytes Received/sec is the rate at which bytes are received over each network adapter, including framing characters. Network Interface\\Bytes Received/sec is a subset of Network Interface\\Bytes Total/sec.
BytesSentPersec	uint32	PERF_COUNTER_COUNTER	Bytes Sent/sec is the rate at which bytes are sent over each network adapter, including framing characters. Network Interface\\Bytes Sent/sec is a subset of Network Interface\\Bytes Total/sec.
BytesTotalPersec	uint64	PERF_COUNTER_BULK_COUNT	Bytes Total/sec is the rate at which bytes are sent and received over each network adapter, including framing characters. Network Interface\\Bytes Received/sec is a sum of Network Interface\\Bytes Received/sec and Network Interface\\Bytes Sent/sec.
CurrentBandwidth	uint32	PERF_COUNTER_RAWCOUNT	Current Bandwidth is an estimate of the current bandwidth of the network interface in bits per second (BPS). For interfaces that do not vary in bandwidth or for those where no accurate estimation can be made, this value is the nominal bandwidth.
OutputQueueLength	uint32	PERF_COUNTER_RAWCOUNT	Output Queue Length is the length of the output packet queue (in packets). If this is longer than two, there are delays and the bottleneck should be found and eliminated, if possible. Since the requests are queued by the Network Driver Interface Specification (NDIS) in this implementation, this will always be 0.
PacketsOutboundDiscarded	uint32	PERF_COUNTER_RAWCOUNT	Packets Outbound Discarded is the number of outbound packets that were chosen to be discarded even though no errors had been detected to prevent transmission. One possible reason for discarding packets could be to free up buffer space.
PacketsOutboundErrors	uint32	PERF_COUNTER_RAWCOUNT	Packets Outbound Errors is the number of outbound packets that could not be transmitted because of errors.
PacketsPersec	uint32	PERF_COUNTER_COUNTER	Packets/sec is the rate at which packets are sent and received on the network interface.
PacketsReceivedDiscarded	uint32	PERF_COUNTER_RAWCOUNT	Packets Received Discarded is the number of inbound packets that were chosen to be discarded even though no errors had been detected to prevent their delivery to a higher-layer protocol. One possible reason for discarding packets could be to free up buffer space.
PacketsReceivedErrors	uint32	PERF_COUNTER_RAWCOUNT	Packets Received Errors is the number of inbound packets that contained errors preventing them from being deliverable to a higher-layer protocol.
PacketsReceivedNonUnicastPersec	uint32	PERF_COUNTER_COUNTER	Packets Received Non-Unicast/sec is the rate at which non-Unicast (subnet broadcast or subnet multicast) packets are delivered to a higher-layer protocol.
PacketsReceivedPersec	uint32	PERF_COUNTER_COUNTER	Packets Received/sec is the rate at which packets are received on the network interface.
PacketsReceivedUnicastPersec	uint32	PERF_COUNTER_COUNTER	Packets Received Unicast/sec is the rate at which (subnet) Unicast packets are delivered to a higher-layer protocol.
PacketsReceivedUnknown	uint32	PERF_COUNTER_RAWCOUNT	Packets Received Unknown is the number of packets received through the interface that were discarded because of an unknown or unsupported protocol.
PacketsSentNonUnicastPersec	uint32	PERF_COUNTER_COUNTER	Packets Sent Non-Unicast/sec is the rate at which packets are requested to be transmitted to non-Unicast (subnet broadcast or subnet multicast) addresses by higher-level protocols. The rate includes the packets that were discarded or not sent.
PacketsSentPersec	uint32	PERF_COUNTER_COUNTER	Packets Sent/sec is the rate at which packets are sent on the network interface.
PacketsSentUnicastPersec	uint32	PERF_COUNTER_COUNTER	Packets Sent Unicast/sec is the rate at which packets are requested to be transmitted to subnet-Unicast addresses by higher-level protocols. The rate includes the packets that were discarded or not sent.

Table 3.77 lists the various cooking types available (for more details, you can refer to the WinPerf.h file, which comes with the Platform SDK installation).

Table 3.77: The Miscellaneous Cooking Type

Noncomputational Counter Types
PERF_COUNTER_TEXT	2816	This counter type shows a variable-length text string in Unicode. It does not display calculated values.
PERF_COUNTER_RAWCOUNT	65536	Raw counter value requiring no further calculations and representing a single sample, which is the last observed value only.
PERF_COUNTER_LARGE_RAWCOUNT	65792	Same as PERF_COUNTER_RAWCOUNT but a 64-bit representation for larger values.
PERF_COUNTER_RAWCOUNT_HEX	0	Most recently observed value in hexadecimal format. It does not display an average.
PERF_COUNTER_LARGE_RAWCOUNT	256	Same as PERF_COUNTER_RAWCOUNT_HEX but a 64-bit representation in hexadecimal for use with large values.

Basic Algorithm Counter Types
PERF_RAW_FRACTION	537003008	Ratio of a subset to its set as a percentage. This counter type displays the current percentage only, not an average over time.
PERF_SAMPLE_FRACTION	549585920	Average ratio of hits to all operations during the last two sample intervals. This counter type requires a base property with the PERF_SAMPLE_BASE counter type.
PERF_COUNTER_DELTA	4195328	This counter type shows the change in the measured attribute between the two most recent sample intervals.
PERF_COUNTER_LARGE_DELTA	4195584	Same as PERF_COUNTER_DELTA but a 64-bit representation for larger values.
PERF_ELAPSED_TIME	807666944	Total time between when the process started and the time when this value is calculated.

Counter Algorithm Counter Types
PERF_AVERAGE_BULK	1073874176	Number of items processed, on average, during an operation. This counter type displays a ratio of the items processed (such as bytes sent) to the number of operations completed, and requires a base property with PERF_AVERAGE_BASE as the counter type.
PERF_COUNTER_COUNTER	272696320	Average number of operations completed during each second of the sample interval.
PERF_SAMPLE_COUNTER	4260864	Average number of operations completed in one second. This counter type requires a base property with the counter type PERF_SAMPLE_BASE.
PERF_COUNTER_BULK_COUNT	272696576	Average number of operations completed during each second of the sample interval. This counter type is the same as the PERF_COUNTER_COUNTER type, but it uses larger fields to accommodate larger values.

Timer Algorithm Counter Types
PERF_COUNTER_TIMER	541132032	Average time that a component is active as a percentage of the total sample time.
PERF_COUNTER_TIMER_INV	557909248	Average percentage of time observed during sample interval that the object is not active. This counter type is the same as PERF_100NSEC_TIMER_INV except that it measures time in units of ticks of the system performance timer rather than in 100ns units.
PERF_AVERAGE_TIMER	805438464	Average time to complete a process or operation. This counter type displays a ratio of the total elapsed time of the sample interval to the number of processes or operations completed during that time. Requires a base property with PERF_AVERAGE_BASE as the counter type.
PERF_100NSEC_TIMER	542180608	Active time of one component as a percentage of the total elapsed time in units of 100ns of the sample interval.
PERF_100NSEC_TIMER_INV	592512256	Percentage of time the object was not in use. This counter type is the same as PERF_COUNTER_TIMER_INV except that it measures time in 100ns units rather than in system performance timer ticks.
PERF_COUNTER_MULTI_TIMER	574686464	Active time of one or more components as a percentage of the total time of the sample interval. Differs from PERF_100NSEC_MULTI_TIMER in that it measures time in units of ticks of the system performance timer, rather than in 100ns units. Requires a base property with the PERF_COUNTER_MULTI_BASE counter type.
PERF_COUNTER_MULTI_TIMER_INV	591463680	Inactive time of one or more components as a percentage of the total time of the sample interval. Differs from PERF_100NSEC_MULTI_TIMER_INV in that it measures time in units of ticks of the system performance timer, rather than in 100ns units. Requires a base property with the PERF_COUNTER_MULTI_BASE counter type.
PERF_100NSEC_MULTI_TIMER	575735040	This counter type shows the active time of one or more components as a percentage of the total time (100ns units) of the sample interval. Requires a base property with the PERF_COUNTER_MULTI_BASE counter type.
PERF_100NSEC_MULTI_TIMER_INV	592512256	Inactive time of one or more components as a percentage of the total time of the sample interval. Counters of this type measure time in 100ns units. Requires a base properly with the PERF_COUNTER_MULTI_BASE counter type.
PERF_OBJ_TIME_TIMER		A 64-bit timer in object-specific units.

Precision Timer Algorithm Counter Types
Queue-length Algorithm Counter Types
PERF_PRECISION_SYSTEM_TIMER	541525248	Similar to PERF_COUNTER_TIMER except that it uses a counter defined time base instead of the system timestamp.
PERF_PRECISION__100NS_TIMER	542573824	Similar to PERF_100NSEC_TIMER except that it uses a 100ns counter defined time base instead of the system 100ns timestamp.
PERF_COUNTER_QUEUELEN_TYPE	4523008	Average length of a queue to a resource overtime. It shows the difference between the queue lengths observed during the last two sample intervals divided by the duration of the interval.
PERF_COUNTER_LARGE_QUEUELEN_TYPE	4523264	Average length of a queue to a resource overtime. Counters of this type display the difference between the queue lengths observed during the last two sample intervals, divided by the duration of the interval.
PERF_COUNTER_100NS_QUEUELEN_TYPE	5571840	Average length of a queue to a resource over time in 100 nanosecond units.
PERF_COUNTER_OBJECT_TIME_QUEUELEN_TYPE	6620416	Time an object is in a queue.

Base Counter Types
PERF_AVERAGE_BASE	1073939458	Base value used in calculation of PERF_AVERAGE_TIMER and PERF_AVERAGE_BULK counter types.
PERF_COUNTER_MULTI_BASE	1107494144	Base value used in calculation of PERF_COUNTER_MULTI_TIMER, PERF_COUNTER_MULTI_TIMER_INV, PERF_100NSEC_MULTI_TIMER, PERF_100NSEC_MULTI_TIMER_INV counter types.
PERF_LARGE_RAW_BASE	1073939715	Base value found in calculation of PERF_RAW_FRACTION. 64 bits.
PERF_RAW_BASE	1073939459	Base value used in calculation of the PERF_RAW_FRACTION counter type.
PERF_SAMPLE_BASE	1073939457	Base value used in calculation of the PERF_SAMPLE_COUNTER and PERF_SAMPLE_FRACTION counter types.

The biggest challenge when working with the Win32_PerfFormattedData classes is not to extract information from the counters but to correctly interpret the meaning of the collected numbers. This is why it is important to explore in detail the miscellaneous Win32_PerfFormattedData derived classes with their properties. This information can be retrieved with the LoadCIMInXL.wsf script developed at the end of Chapter 4 of the first book, Understanding WMI Scripting, and available in the appendix. However, because a great number of details are provided in the qualifiers, it is best to run the script with a maximum of requested details. The command line to use would be as follows:

 C:\>LoadCIMInXL.Wsf Win32_PerfFormattedData_Tcpip_NetworkInterface /Level:6

Once loaded, all information related to the Win32_PerfFormattedData_ Tcpip_NetworkInterface class with its properties and all associated qualifiers will be available in an Excel sheet.

Now that we have everything in our hands to understand what these raw and cooked counters are, the last step is to collect the counter information. Extracting a snapshot of a counter set is nice but not always relevant. The biggest interest in these classes is to monitor some counters over time and see the evolution of the miscellaneous values. For example, we can save a set of counters for a particular performance class instance and repeat the operation at a regular time interval. To do this, we can reuse some of the WMI features shown in the previous samples.

Samples 3.77 and 3.78 show how to retrieve one or more performance counter instances and save the snapshot taken at a regular time interval in a .CSV file for later review and analysis. For example, you may wish to use Excel to generate graphics from the captured data.

Sample 3.77: Capturing performance counter values (raw or cooked) at regular time intervals (Part I)

   1:<?xml version="1.0"?>   .:   8:<package>   9:  <job> ..:  13:    <runtime>  ..:  30:    </runtime>  31:  32:    <script language="VBScript" src="/books/2/679/1/html/2/..\Functions\CreateTextFileFunction.vbs" />  33:    <script language="VBScript" src="/books/2/679/1/html/2/..\Functions\ConvertStringInArrayFunction.vbs" />  34:    <script language="VBScript" src="/books/2/679/1/html/2/..\Functions\TinyErrorHandler.vbs" />  35:    <script language="VBScript" src="/books/2/679/1/html/2/..\Functions\PauseScript.vbs" />  36:  37:    <object progid= "WbemScripting.SWbemRefresher"  />  38:    <object prog  reference="true"/>  39:    <object prog  />  40:    <script language="VBscript">  41:    <![CDATA[  ..:  45:    Const cComputerName = "LocalHost"  46:    Const cWMINameSpace = "Root/cimv2"  47:    Const cWMITimerClass = "__IntervalTimerInstruction"  48:    Const cTimerID = "MyTimerEvent"  49:    Const cWMITimerQuery = "Select * From __TimerEvent Where TimerID='MyTimerEvent'"  50:    Const cWMIPerfFormattedClass = "Win32_PerfFormattedData"  51:    Const cWMIPerfRawClass = "Win32_PerfRawData" ...: 119:    Set objWMISink = WScript.CreateObject ("WbemScripting.SWbemSink", "SINK_") 120: 121:    objWMILocator.Security_.AuthenticationLevel = wbemAuthenticationLevelDefault 122:    objWMILocator.Security_.ImpersonationLevel = wbemImpersonationLevelImpersonate 123: 124:    Set objWMIServices = objWMILocator.ConnectServer(strComputerName, cWMINameSpace, _ 125:                                                     strUserID, strPassword) ...: 128:    ' ------------------------------------------------------------------------------------- 129:    ReDim objLogFileName (Ubound(arrayCounterName)) 130:    For intIndice = 0 To UBound (arrayCounterName) 131:        If boolRaw Then 132:           strWMIPerfClass = cWMIPerfRawClass & "_" & _ 133:                             arrayCounterName(intIndice) 134:        Else 135:           strWMIPerfClass = cWMIPerfFormattedClass & "_" & _ 136:                             arrayCounterName(intIndice) 137:        End If 138: 139:        Set objWMIClass = objWMIServices.Get (strWMIPerfClass) 140:        If Err.Number Then ErrorHandler (Err) 141: 142:        boolSingleton = objWMIClass.Qualifiers_.Item("Singleton").Value 143:        If Err.Number Then 144:           Err.Clear 145:           boolSingleton = False 146:        End If 147: 148:        If boolSingleton Then 149:           objWMIRefresher.Add objWMIServices, _ 150:                               strWMIPerfClass & "=@" 151:        Else 152:           objWMIRefresher.Add objWMIServices, _ 153:                               strWMIPerfClass & ".Name='" & _ 154:                               arrayInstanceName(intIndice) & "'" 155:        End If ...: 158:        ' ------------------------------------------------------------------------------------- 159:        strLogFileName = strWMIPerfClass & "_" & _ 160:                         Year(Date) & _ 161:                         Right ("0" & Month(Date), 2) & _ 162:                         Right ("0" & Day(Date), 2) & "-" & _ 163:                         Right ("0" & Hour(Time), 2) & _ 164:                         Right ("0" & Minute(Time), 2) & _ 165:                         Right ("0" & Second(Time), 2) & ".CSV" 166: 167:        Set objLogFileName(intIndice) = CreateTextFile (strLogFileName) 168: 169:        varTemp = objWMIClass.Path_.RelPath 170:        Set objWMIPropertySet = objWMIClass.Properties_ 171:        For Each objWMIProperty In objWMIPropertySet 172:            Select Case objWMIProperty.Name 173:                   Case "Caption" 174:                   Case "Description" 175:                   Case "Name" 176:                   Case Else 177:                        varTemp = varTemp & "," & objWMIProperty.Name 178:            End Select 179:        Next ...: 184:        WriteToFile objLogFileName(intIndice), varTemp 185:    Next 186: 187:    objWMIRefresher.AutoReconnect = True 188:    objWMIRefresher.Refresh 189: 190:    ' ------------------------------------------------------------------------------------- 191:    Set objWMIClass = objWMIServices.Get (cWMITimerClass) 192: 193:    Set objWMITimerInstance = objWMIClass.SpawnInstance_ 194:    objWMITimerInstance.TimerID = cTimerID 195:    objWMITimerInstance.IntervalBetweenEvents = intInterval * 1000 196:    objWMITimerInstance.Put_ wbemChangeFlagCreateOrUpdate Or _ 197:                             wbemFlagReturnWhenComplete ...: 200:    WScript.Echo "Counter timer created." 201: 202:    ' ------------------------------------------------------------------------------------- 203:    objWMIServices.ExecNotificationQueryAsync objWMISink, cWMITimerQuery 204:    If Err.Number Then ErrorHandler (Err) 205: 206:    WScript.Echo "Waiting for events..." 207: 208:    PauseScript "Click on 'Ok' to terminate the script ..." 209: 210:    WScript.Echo vbCRLF & "Cancelling event subscription ..." 211:    objWMISink.Cancel 212: 213:    ' ------------------------------------------------------------------------------------- 214:    objWMITimerInstance.Delete_ ...: 217:    WScript.Echo vbCRLF & "Counter timer deleted." 218: 219:    For intIndice = 0 To UBound (arrayCounterName) 220:        CloseTextFile objLogFileName (intIndice) 221:    Next ...: 226:    WScript.Echo "Finished." 227: ...: ...: ...:

Sample 3.78: Capturing performance counter values (raw or cooked) at regular time intervals (Part II)

 ...: ...: ...: 227: 228:    ' ----------------------------------------------------------------------------------------- 229:    Sub SINK_OnObjectReady (objWbemObject, objWbemAsyncContext) ...: 238:        intCounter = intCounter + 1 239: 240:        Wscript.Echo 241:        WScript.Echo FormatDateTime(Date, vbLongDate) & " at " & _ 242:                     FormatDateTime(Time, vbLongTime) & _ 243:                     " sample #" & intCounter & "." 244: 245:        objWMIRefresher.Refresh 246: 247:        For intIndice = 1 To objWMIRefresher.Count 248:            Set objWMIRefresherItem = objWMIRefresher.Item(intIndice * 2) 249:            Set objWMIInstance = objWMIRefresherItem.Object 250: 251:            varTemp = FormatDateTime(Date, vbShortDate) & " " & _ 252:                      FormatDateTime(Time, vbLongTime) 253:            Set objWMIPropertySet = objWMIInstance.Properties_ 254:            For Each objWMIProperty In objWMIPropertySet 255:                Select Case objWMIProperty.Name 256:                       Case "Caption" 257:                       Case "Description" 258:                       Case "Name" 259:                       Case Else 260:                            varTemp = varTemp & "," & objWMIProperty.Value 261:                End Select 262:            Next ...: 268:            WriteToFile objLogFileName(intIndice - 1), varTemp 269: 270:            WScript.Echo " WMICounter '" & arrayCounterName(intIndice - 1) & _ 271:                         "' saved." 272:        Next 273: 274:    End Sub 275: 276:    ]]> 277:    </script> 278:  </job> 279:</package>

 C:\>WMICounterMonitor.wsf Microsoft (R) Windows Script Host Version 5.6 Copyright (C) Microsoft Corporation 1996-2001. All rights reserved. Usage: WMICounterMonitor.wsf /CounterName:value /Instance:value [/interval:value] [/Raw[+|-]]                              [/Machine:value] [/User:value] [/Password:value] Options: CounterName : List of counter names to capture. Instance    : List of instance corresponding to the counter name interval    : Time interval between counter reads (in seconds). Raw         : Determine if the raw performance counter must be taken instead of the formatted one. Machine     : Determine the WMI system to connect to. (default=LocalHost) User        : Determine the UserID to perform the remote connection. (default=none) Password    : Determine the password to perform the remote connection. (default=none) Examples:      WMICounterMonitor.wsf /CounterName:Tcpip_NetworkInterface                            /Instance:"Compaq NC3121 Fast Ethernet NIC"      WMICounterMonitor.wsf /CounterName:Tcpip_NetworkInterface                            /Instance:"Compaq NC3121 Fast Ethernet NIC" /Log+      WMICounterMonitor.wsf /CounterName:Spooler_PrintQueue                            /Instance:"Lexmark 4039 Plus PS" /Interval:10      WMICounterMonitor.wsf /CounterName:"Spooler_PrintQueue,Tcpip_NetworkInterface"                            /Instance:"Lexmark 4039 Plus PS,Compaq NC3121 Fast Ethernet NIC"                            /Interval:10      WMICounterMonitor.wsf /CounterName:PerfOS_Processor /Instance:"_Total" /Interval:10

The script usage is pretty simple. Basically, it requires two mandatory command-line parameters:

The /CounterName switch: It represents the name (<service_name>_ <object_name>) used to form the WMI performance class name. For example, with the Win32_PerfFormattedData_Tcpip_NetworkInterface class, the name given on the command line is "Tcpip_NetworkInterface."
The /InstanceName switch: It represents the instance name of the requested counter instance. All performance classes (raw and cooked) are using a unique Key property called name or are singleton classes. For example, with the Win32_PerfFormattedData_Tcpip_NetworkInterface class, the instance name given on the command line could be "Compaq NC3121 Fast Ethernet NIC."

As a result, the complete command line would be as follows:

 C:\>WMICounterMonitor.wsf /CounterName:"Tcpip_NetworkInterface"                           /Instance:"Compaq NC3121 Fast Ethernet NIC"

It is possible to combine several performance classes with their respective instances. In such a case, the command line to use would be as follows:

 C:\>WMICounterMonitor.wsf /CounterName:"Tcpip_NetworkInterface,Tcpip_NBTConnection,PerfNet_Browser"                           /Instance:"Compaq NC3121 Fast Ethernet NIC ,_Total,@''

In such a case, the script will retrieve all properties of:

An instance called "Compaq NC3121 Fast Ethernet NIC" for the Win32_PerfFormattedData_Tcpip_NetworkInterface class.
An instance called "_Total" for the Win32_PerfFormattedData_ Tcpip_NBTConnection class.
An instance of the singleton Win32_PerfFormattedData_PerfNet_Browser class. Its name is "@," since the class is a singleton class

Let's see how Samples 3.77 and 3.78 work. The script is using an asynchronous event notification. Sample 3.77 contains the initialization process of the event notification. Sample 3.78 contains the event sink routine handling the event notifications.

Once the command-line parameters are defined and parsed, the script executes the WMI connection (lines 121 through 125). Right after the WMI connection, the script enters a loop (lines 130 through 185) to create several items used by the script:

Based on the /Raw command-line parameter value, the script builds the class name to be used (lines 131 through 137). If the /Raw switch is set to False, the class name will be a Win32_PerfFormattedData class. If the /Raw switch is set to True, the class name will be a Win32_PerfRawData class. The counter name given on the command line and the desired class name are combined to give the performance class name used to retrieve performance counter instance values.
From the performance class name, the script verifies if the Singleton qualifier is set to determine how the performance counter instance will be retrieved (lines 139 through 146).
If the class is a singleton class, the script uses the appropriate syntax to retrieve the unique instance from the given singleton class (lines 149 and 150). If the class is not a singleton class, it retrieves the performance counter instance with the name given with the /InstanceName switch (lines 152 through 154). It is important to note that the performance counter instances are not immediately stored in an SWBemObject instance. Instead, they are stored in SWbemRefresher object. This will give us the facility, later in the script, to refresh all instances stored in the SWbemRefresher object. This will improve the performance in retrieving the counter information, since a refresh operation is faster than an object instantiation. We have seen how the SWbemRefresher object can be used in Chapter 5 of Understanding WMI Scripting.
Once the performance counter class is instantiated and saved in the SWbemRefresher object, the script prepares the .CSV file name (lines 159 through 167). Once the .CSV file is created, the file header is also created from the various properties available from the class (lines 169 through 184).

Each of these operations is repeated in a loop for every performance counter specified with the /CounterName switch (lines 130 through 185). Next, the script initializes the SWbemRefresher object and ensures that it automatically attempts to reconnect to a remote provider if the connection is broken (lines 187 and 188).

To gather performance counter data at regular time intervals, the script creates an _IntervalTimerInstruction instance. We already used a similar technique in previous samples (Samples 3.60 and 3.61, "PINGing a system at regular time intervals"). From line 191 through 200, the _IntervalTimerInstruction instance is created. Next, at line 203, the WQL event query is submitted to WMI to receive timer event notifications in the event sink (lines 229 through 274). The corresponding SWbemSink object is created at line 119. Next, as in any previous asynchronous event notification sample in this book, the script is paused (line 208). Once the script is resumed, the timer event notification is canceled (line 211), and the timer event instance is deleted from the CIM repository (lines 214 through 217). Before ending the script execution, every .CSV file created for each performance counter is closed (lines 219 through 221).

What happens in the event sink routine? The answer is shown in Sample 3.78.

First, the sink routine increments a counter (line 238) used to display the number of performance counter samples already taken (lines 241 through 243). Next, the script refreshes the performance instances stored in the SWbemRefresher object (line 245). For each instance available in the SWbemRefresher object, the script executes a loop (lines 247 through 272) to save the performance counter instance data (lines 251 through 268). Each property (lines 254 through 262) of the performance counter is properly formatted into a .CSV format (line 260). Next, the counter data is appended to the corresponding .CSV file (line 268).

Note that the timer event is defaulted to ten seconds. The command-line definition exposes a switch, called /Interval, to redefine the timer event interval. Although a smaller value can be used, it is important to avoid too small intervals, because they will create huge .CSV files and generate a lot of network traffic if the monitored system is remote. In the same way as the performance data capture is executed during the timer event sink execution, if the timer interval is small, the refreshed instances data may not correspond to the instance state at the timer event triggering. WMI sends the event notifications to the consumer when they are available. However, it is likely that the consumer processes the event notification more slowly than the event notifications arrive. In such a case, waiting requests are queued. In such circumstances, it is likely that event notifications are not immediately processed when they are triggered. This is the reason why the script takes the time of the _IntervalTimerInstruction system class stored in the TIME_CREATED property exposed by the _TimerEvent system class (lines 252 and 253) and not the date and time of the event sink execution (lines 242 and 243).

3.8.2 Performance Monitoring provider

The Performance Monitoring provider is an instance and property provider that returns the same data seen in the System Monitor application. However, since it is not a High-performance provider, it lacks the speed and capabilities available through High-performance providers. (See Table 3.78.)

Table 3.78: The Performance Monitoring Providers Capabilities
Provider Name	Provider Namespace	Instance Provider	Property Provider	Support Get	Support Enumeration	Windows Server 2003	Windows XP	Windows 2000 Server	Windows 2000 Professional
Performance Monitoring Provider
PerfProv	Root/PerfMON	X		X	X	X	X	X	X
PerfPropProv	Root/PerfMON		X	X		X	X	X	X

The Performance Monitoring provider is not automatically registered in the Operating System. The main reason is that Microsoft does not encourage its use anymore and suggests the use of the High-performance providers instead. Therefore, if it is necessary to access system performance data using this provider, it must be registered first. (See Sample 3.79.)

Sample 3.79: The MOF file to register the Performance Monitoring provider

  1:   #pragma namespace("\\\\.\\Root")  2:  3:   instance of  _Namespace  4:   {  5:       Name   =   "PerfMON";  6:   };  7:  8:   #pragma namespace ("\\\\.\\Root\\PerfMON")  9: 10:   instance of _Win32 Provider as $PMPInst 11:   { 12:       Name  = "PerfProv"; 13:       ClsId = "{f00b4404-f8f1-11ce-a5b6-00aa00680c3f)"; 14:   }; 15: 16:   instance of __InstanceProviderRegistration 17:   { 18:       Provider = "_Win32Provider.Name=\"PerfProv\""; 19:       SupportsPut = FALSE; 20:       SupportsGet = TRUE; 21:       SupportsDelete = FALSE; 22:       SupportsEnumeration = TRUE; 23:   }; 24: 25:   instance of _Win32Provider as $PMPProp 26:   { 27:       Name = "PerfPropProv"; 28:       Clsid = "{72967903-68EC-11d0-B729-00AA0062CBB7}"; 29:   }; 30: 31:   instance of _PropertyProviderRegistration 32:   { 33:       Provider = $PMPProp; 34:       SupportsGet = TRUE; 35:       SupportsPut = FALSE; 36:   }; 37:

Briefly, this MOF file registers the instance provider (lines 10 through 23) and the property provider (lines 25 through 36). This MOF file comes from the WMI section in the Microsoft Platform SDK. The only additions are lines 1 through 8 to ensure the registration of the provider in a dedicated namespace, in this case called PerfMON.

Once the provider is registered, it is also necessary to create the classes and the instances that will receive information from the provider. So, this provider is not usable out of the box and does not expose any classes by default. The classes must be created from a MOF file. For example, to retrieve all the Performance Monitor Counters related to the processes (as shown in Figure 3.54), the MOF file shown in Sample 3.80 must be loaded in the CIM repository.

Sample 3.80: A MOF file defining a class to retrieve Process counters from the Performance Monitor

  1:   #pragma namespace ("\\\\.\\Root")  2:  3:   instance of  _Namespace  4: {  5:   Name = ''PerfMON'';  6: };  7:  8:   #pragma namespace("//./Root/PerfMON")  9: 10:   [dynamic, provider("PerfProv"), ClassContext("local|Process")] 11:   class NTProcess 12:   { 13:       [key] 14:          String Process; 15: 16:       [PropertyContext("% Privileged Time")] 17:            uint32 PercentagePrivilegedTime; 18:       [PropertyContext("% Processor Time")] 19:            uint32 PercentageProcessTime; 20:       [PropertyContext("% User Time")] 21:            uint32 PercentageUserTime; 22:       [PropertyContext("Create Process ID")] 23:            uint32 CreateProcessID; 24:       [PropertyContext("Elapsed Time")] 25:            uint32 ElapsedTime; 26:       [PropertyContext("Handle Count")] 27:            uint32 HandleCount; 28:       [PropertyContext("ID Process")] 29:            uint32 ID; 30:       [PropertyContext("IO Data Bytes/sec")] 31:            uint32 IODataBytesPersec; 32:       [PropertyContext("IO Data Operations/sec")] 33:            uint32 IODataOperationsPersec; 34:       [PropertyContext("IO Other Bytes/sec")] 35:            uint32 IOOtherBytesPersec; 36:       [PropertyContext("IO Other Operations/sec")] 37:            uint32 IOOtherOperationsPersec; 38:       [PropertyContext("IO Read Bytes/sec")] 39:            uint32 IOReadBytesPersec; 40:       [PropertyContext("IO Read Operations/sec")] 41:            uint32 IOReadOperationsPersec; 42:       [PropertyContext("IO Write Bytes/sec")] 43:            uint32 IOWriteBytesPersec; 44:       [PropertyContext("IO Write Operations/sec")] 45:            uint32 IOWriteOperationsPersec; 46:       [PropertyContext("Page Faults/sec")] 47:            uint32 PageFaultsPersec; 48:       [PropertyContext("Page File Bytes")] 49:            uint32 PageFileBytes; 50:       [PropertyContext("Page File Bytes Peak")] 51:            uint32 PageFileBytesPeak; 52:       [PropertyContext("Pool Nonpaged Bytes")] 53:            uint32 PoolNonpagedBytes; 54:       [PropertyContext("Pool Paged Bytes")] 55:            uint32 PoolPagedBytes; 56:       [PropertyContext("Priority Base")] 57:            uint32 PriorityBase; 58:       [PropertyContext("Private Bytes")] 59:            uint32 PrivateBytes; 60:       [PropertyContext("Thread Count")] 61:            uint32 ThreadCount; 62:       [PropertyContext("Virtual Bytes")] 63:            uint32 VirtualBytes; 64:       [PropertyContext("Virtual Bytes Peak")] 65:            uint32 VirtualBytesPeak; 66:       [PropertyContext("Working Set")] 67:            uint32 WorkingSet; 68:       [PropertyContext("Working Set Peak")] 69:            uint32 WorkingSetPeak; 70:   };

click to expand
Figure 3.54: The Performance Monitor Process counters.

From line 1 through 8, the MOF file creates the Root\PerfMON namespace. It also creates the Performance Monitor NTProcess class (lines 10 through 69). The class and properties creations require three qualifiers specific to the Performance Monitor provider usage:

Provider qualifier: This qualifier specifies the Performance Monitoring provider as the dynamic provider responsible for managing the data for the new class. This provider is specified at the class level (line 10).
ClassContext qualifier: This qualifier specifies information needed by the Performance Monitoring provider to access the requested counter. The format of the ClassContext qualifier is:
```
 machine | perfobject 
```
where machine is the machine name and perfobject is the name of the performance object shown in System Monitor in Performance Monitoring (see Figure 3.55). In Sample 3.80, a value of "local | Process" indicates processes on the local machine in a class defined to hold counter data about the processes.

Figure 3.55: The Process counters of the Performance Counters available from WMI.
PropertyContext qualifier: This qualifier identifies the display name of each counter. This is the name appearing in the Performance Monitoring tool (see Figure 3.53). This qualifier is specified for each property created for the class and accessing a specific Performance Monitor Counter (even lines 16 through 68).

Once compiled, WMI CIM Studio will show the screen seen in Figure 3.55.

Now, we are ready to access the Process counters from the Performance Monitor tool with a script. This last part has nothing unusual, since the script follows the traditional scripting techniques. It is available for your information in the Jscript Sample 3.81.

Sample 3.81: Viewing the Performance Monitor Process counters with a script

  1:<?xml version="1.0"?>  .:  8:<package>  9:  <job> ..: 13:    <script language="VBScript" src="/books/2/679/1/html/2/..\Functions\DisplayFormattedPropertyFunction.vbs" /> ..: 14: 15:    <object prog  reference="true"/> 16:    <object prog  /> 17: 18:    <script language="JScript"> 19:    <![CDATA[ 20: 21:    var cComputerName = "LocalHost"; 22:    var cWMINameSpace = "Root/PerfMON"; 23:    var cWMIClass = "NTProcess"; ..: 29:    objWMILocator.Security_.AuthenticationLevel = wbemAuthenticationLevelDefault; 30:    objWMILocator.Security_.ImpersonationLevel = wbemImpersonationLevelImpersonate; 31:    objWMIServices = objWMILocator.ConnectServer(cComputerName, cWMINameSpace, "", ""); 32:    objWMIInstances = objWMIServices.InstancesOf (cWMIClass); 33: 34:    enumWMIInstances = new Enumerator (objWMIInstances); 35:    for (;! enumWMIInstances.atEnd(); enumWMIInstances.moveNext()) 36:        { 37:        objWMIInstance = enumWMIInstances.item(); 38: 39:        objWMIPropertySet = objWMIInstance.Properties_ 40:        enumWMIPropertySet = new Enumerator (objWMIPropertySet); 41:        for (;! enumWMIPropertySet.atEnd(); enumWMIPropertySet.moveNext()) 42:            { 43:            objWMIProperty = enumWMIPropertySet.item() 44: 45:            DisplayFormattedProperty (objWMIInstance, 46:                                      objWMIProperty.Name, 47:                                      objWMIProperty.Name, 48:                                      null); 49:            } 50:        WScript.Echo (); 51:        } 52: 53:    ]]> 54:    </script> 55:  </job> 56:</package>