Section 7.2. Windows Management Instrumentation

   

---

7.2 Windows Management Instrumentation

As stated earlier, CIM is the DMTF-defined and SNIA-adopted Common Information Model. WMI is the Microsoft implementation of CIM. In other words, WMI is "CIM for Windows."

WMI has been implemented in both kernel mode and user mode. Windows NT 4.0 SP6 shipped with only the user mode WMI. Windows 2000, Windows XP, and Windows Server 2003 have WMI implemented in both kernel mode and user mode.

WMI has a three-tiered architecture as shown in Figure 7.1. The three layers are

1. WMI application layer

2. WMI service provider layer

3. WMI provider layer

Figure 7.1. WMI Architecture

At the top is the WMI application layer. WMI applications are typically systems management applications. Independent software vendors (ISVs) write management applications using the interface provided by the WMI service or using the scripting interface provided on top of the WMI service. Multiple WMI applications can coexist on the same machine.

The WMI service layer is the next layer and consists of a single entity, the WMI service. The WMI service is a Windows NT service provided by Microsoft as part of the Windows NT operating system. The WMI service instantiates a schema based on CIM. Sometimes the WMI service is also referred to as a CIM Object Manager, or CIMOM. The WMI service provides a single interface for management applications to use, no matter what the source of the information is or which management applications use the provided services. In other words, the WMI service multiplexes and demultiplexes requests between applications and the various providers. The WMI service also implements the WMI scripting interface that allows access to WMI managed objects from any scripting language supported by the Windows Scripting Host (e.g., Visual Basic, JScript, VBScript).

The last tier in the hierarchy is the WMI provider layer. There are various WMI providers, some written by Microsoft and some written by other vendors. WMI providers are created via the WMI SDK that is part of the Platform SDK and consist of simple user model dynamic link libraries (DLLs). Microsoft has written numerous WMI providers itself. OEMs, IHVs, and ISVs can also write a provider to differentiate their products. For example, an OEM could write a WMI provider for its server enclosure that could instrument the various component temperatures and fans and possibly even raise an alert when the server's chassis opens.

Microsoft has written various WMI providers that instrument Windows user mode applications and services. One special case is the Windows Driver Model (WDM) provider that enables data and events from kernel mode drivers to be made available to user mode management applications. The kernel mode code and drivers are instrumented via WMI code, but the driver writers themselves do not need to write WMI providers.

WMI extensions to WDM provide a means of publishing information and raising events from kernel mode drivers. WMI may be implemented in any driver that receives I/O request packets (IRPs). WMI may also be implemented in SCSI miniport, Storport miniport, and NDIS miniport drivers. In each of these cases, the port driver shipped by Microsoft performs the necessary translation between IRPs and the miniport interface. Microsoft has implemented WMI in various class and port drivers. Vendors may also differentiate their products by including WMI features in their hardware's device driver. WMI is implemented in drivers by means of just the Windows Driver Development Kit. WMI defines new functionality via IRP_MJ_SYSTEMCONTROL. It also allows the control of device settings.

WMI provides a rich set of functionality for management applications. For example, a management application can register with WMI for notification in the following circumstances:

• When a particular managed object changes in a prescribed manner; for example, the temperature exceeds a certain value.

• When a new instance of a managed object is created.

• When an existing instance of a managed object is destroyed .

• When a complex condition is satisfied (for example, condition 1 and condition 2, but not condition 3, are met). Note that different providers may instrument the monitoring of conditions. Further, the query to indicate the complex set of conditions is built with a language called WMI Query Language (WQL) with syntax extremely close to that of SQL. WQL allows managed objects to be queried but not modified.

• When a given managed object can be extended by the writing of a provider.

Another important aspect is that WMI provides a standardized way for hardware and software vendors to differentiate their products. A vendor can write a WMI-enabled driver or a WMI provider that addresses an interesting aspect of its device. Management applications can dynamically discover and deal with the new management objects that the vendor provides, through WMI code in either the vendor-written driver or the vendor-written WMI provider.

Microsoft uses WMI extensively for storage and application management. Microsoft Exchange 2000 and SQL Server 2000 are managed via the WMI providers that each of them have written. Disk management and iSCSI management are some other examples that rely on WMI code.

---

Top