Select WMI source

• Object path

  The object path defines the WMI object that you want to monitor.

  How do I know what WMI object I should monitor?

  What's in WMI?

  WMI contains a very large amount of information about the configuration of Windows, and about the configuration of other programs that write information to WMI namespaces. In order to write a useful WMI policy, you need to gain an understanding of the kinds of information that are available in WMI.

  The information provided by WMI is divided into namespaces. The default namespaces provided by WMI are Root, Root\Default, Root\security and Root\CimV2. Other applications may add other namespaces, for example, HPOM adds the namespace root\Hewlett-Packard\OpenView\.

  Namespace Root\CimV2 is one of the most interesting namespaces, as it contains a large amount of information about the Windows operating system, and about hardware installed on the computer. The classes that are most useful are prefixed with Win32_, for example, Win32_Service, Win32_Desktop, Win32_Share, Win32_PhysicalDisk and so on. A good way to become acquainted with the information is to use a tool like wbemtest or the HP Operations class browser to examine the contents of the classes.

  • Node: The node that hosts the WMI database that you want to monitor. This can be an agentless node.
    If you do not specify a node, HPOM monitors the WMI database of the node that has this policy deployed. Use the browse button to select HPOM nodes or type a node name into the box. See Identify the originating node for information about adding agentless nodes to HPOM.
  • WMI Namespace: The namespace that contains the data that you want to manage.
  • Object type: Choose Event or Instance. Note that if you used the browse button to fill in the Object path fields, the Object type will probably be correctly set. If, however, the class is not correctly located in the class hierarchy, the setting might be wrong.
    What are WMI events and instances?

    Instance

    Static information written to the WMI repository. This information remains in the repository until it is changed or deleted.

    Event

    Information that briefly appears in the WMI repository. This information is transitory, and never remains in the repository. Some events are defined by WMI by default, and are known as intrinsic events. Intrinsic events include the creation, modification, or deletion of an instance, class, or namespace. Other events, known as extrinsic events, are only available to a WMI policy if the namespace designer has defined them.  In both cases, the event is only available to the WMI policy if the namespace designer has written a provider available for event, although intrinsic events can be simulated by the WMI policy by using a polling interval.

  • Event/Instance class name: Type the class that contains the event or instance that you want to monitor. (A class is a collection of data properties that is defined for information that will be stored in the WMI repository.)
  • Connect as non-agent user: If selected, the agent accesses the node's WMI database using the following account information. This account must exist on the agentless node and must have local administrator privileges. If not selected, the agent account is used.
  • User name: Type the user name of the account that the agent will use to connect to the WMI database.
  • Login password: Type the password of the connecting account.
• Type of query

  The type of query depends on the object type that you are monitoring. If you are monitoring an event for which a provider is defined, then you do not need to enter any information here. If you are monitoring an intrinsic event for which no provider is defined, then you need to specify a polling interval. If you are monitoring an Instance, then you need to provide the following information:

  • Select Query instances of class if you want to match specific values contained within the class. You must indicate the Polling interval to indicate the frequency with which the Windows Management Interface policy checks the instances you selected.
  • Select Query the intrinsic event for these instances if you want to check for the creation, modification or deletion of the instance, the class that contains the instance, or the namespace that contains the instance. If there is no provider for the event, you must also set the Polling interval to indicate the frequency with which the Windows Management Interface policy will check the object you selected. (This results a WBEM Query Language within clause.) How do I check for a provider?
    1. Click the button and connect to the namespace that contains the instance you are monitoring
    2. In the Class browser, select __SystemClass __ProviderRegistration __EventProviderRegistration.
    3. Click OK to close the Class browser.
    4. Select the Rules tab.
    5. Select New.
    6. Select Launch instance browser...
    7. Scroll horizontally to the EventQueryList column, and click Array. The new window will display all events that have a provider.
• View global WQL filter... A global filter can be described as a rule. It is a test that is applied to the instance or event before the policy begins to evaluate it. A global filter can improve performance, because events or instances that do not get through the filter are not evaluated by the policy. (The global filter is a WBEM Query Language where clause.)

  Sample global filters

  The syntax of a global filter has three parts:

  PROPERTY OPERATOR VALUE

  for example: _PATH = "C:/program files"

  If the global filter filters intrinsic events, the syntax is somewhat different:

  TargetInstance.PROPERTY OPERATOR VALUE
  or
  TargetClass.PROPERTY OPERATOR VALUE
  or
  TargetNamespace.PROPERTY OPERATOR VALUE

  for example,

  TargetInstance.InteractWithDeskTop = 1
TargetNamespace.name = "CIMV2"

To access this tab

1. Right-click the Windows Management Interface policy and select Edit.
2. Select Source.

Related Topics:

• Quick start: how to create a policy
• Agentless monitoring
• For more information about WMI, download the Microsoft Windows Management Instrumentation (WMI) SDK from the Microsoft Developers Network (msdn.microsoft.com)