WMIMon

This command line tool allows to monitor WMI activity on Windows platform.

If you don’t have Visual Studio to build it, you can download binaries from https://github.com/luctalpe/WMIMon/blob/master/Downloads/WMIMon_Binaries.zip

Features

It is a real-time ETL consumer for the WMI-Activity event log channel. It will allow to also get information about the WMI client process (executable). You can specify a regular expression to filter and limit output to a specific executable,username,client computername, Process ID,query.

Scenarios

This tool may be useful for several scenarios:

• Finding which executable/computer/user are executing specific queries and putting load on your system
• Learn WMI queries done by your components or a component tha you need to troubleshoot
• Execute a specific script when a WMI error code is returned to a client

Sample 1

• Allow to view all WMI activity

  C:\Temp>WMIMOn
  
  ***** *** Successfully Created ETW Session WMITrace_{1B701051-0E73-4EEE-85B7-567AC21B1E55}
  
  
  
  ***** *** Successfully Added Provider to  ETW Session
  
  
  
  ***** 14:38:22.372 Grp=125426 _ClientProcessId=3092 [MsMpEng.exe] LUCT10 NT AUTHORITY\SYSTEM
  
          IWbemServices::Connect
  
  ***** 14:38:22.376 Grp=125427 Op=125428 _ClientProcessId=3092 [MsMpEng.exe] LUCT10 NT AUTHORITY\SYSTEM
  
          Start IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
  
  ***** 14:38:22.380 Stop Op=125426 0x0
  
  ***** 14:38:22.380 Stop Op=125428 0x0

Sample 2

• Will monitor all queries containing CreateSnaphost. When this query is executed, the prowershell script listvar.ps1 is executed.This script will display all WMIMON powershell variable and will display informations for the WMI current process ($WMIMOM_PID variable)

  PS C:\temp\WMIMon> type .\listvar.ps1
  
  ls variable:WMI*
  
  get-process -ID $WMIMON_PID
  
  
  
  
  
  PS C:\temp\WMIMon> .\WMIMon.exe "-filter=.*Virtual.*CreateSnapshot" "-action=.\listvar.ps1"
  
  Parsing:        filtering on .*virtual.*createsnapshot
  
  Parsing:        Powershell action when filter is found : .\listvar.ps1
  
  ***** *** Successfully Created ETW Session WMITrace_{81830E71-72D7-4228-94CE-A02FE99A01B8}
  
  
  
  ***** *** Successfully Added Provider to  ETW Session
  
  
  
  ***** 14:46:46.615 Grp=12388022 Op=12388023 _ClientProcessId=3448 [mmc.exe] LUCT2016 LUCT2016\luct
  
          Start IWbemServices::ExecMethod - root\virtualization\v2 : \\.\ROOT\virtualization\v2:Msvm_VirtualSystemSnapshot
  
  Service.CreationClassName="Msvm_VirtualSystemSnapshotService",Name="vssnapsvc",SystemCreationClassName="Msvm_ComputerSys
  
  tem",SystemName="LUCT2016"::CreateSnapshot
  
  
  
  Name                           Value
  
  ----                           -----
  
  WMIMON_PID                     3448
  
  WMIMON_EXECUTABLE              mmc.exe
  
  WMIMON_COMPUTER                LUCT2016
  
  WMIMON_USER                    LUCT2016\luct
  
  WMIMON_STOPSTATUS              0
  
  WMIMON_ACTIVITY                14:46:46.615 Grp=12388022 Op=12388023 _ClientProcessId=3448 [mmc.exe] LUCT2016 LUCT201...
  
  WMIMON_RELATEDACTIVITY
  
  
  
  Id      : 3448
  
  Handles : 1715
  
  CPU     : 17070.078125
  
  SI      : 2
  
  Name    : mmc
  
  
  
  
  
  
  
  ***** 14:46:46.659 Stop Op=12388023 0x0

Usage

• WMItrace.exe is a basic C++ version without any filtering capability
• WMIMON.exe is a .Net tool with all the features. You need to copy WMIMonC.dll in the same directory

  c:\Temp>WMImon /?
  
  Parsing:        Invalid argument /?
  
  
  
  
  
  Usage:  WmiMon [-filter=regular_expression_string] [-stop=start|end|none] [-ifstopstatus=hexadecimal_value] [-log=all|filter] [action=pipeline]
  
                    default WmiMon [-filter=.*] [-stop=none] [-log=all]
  
  will monitor WMI activity. By default all WMI activities are displayed.
  
  
  
  You can filter the output with the -filter switch.
  
  
  
  You can stop the application :
  
  - if the filtering is successfull. Stop will occur at activity startup  if -stop=start is specified.
  
        If -stop=end is specified we will wait for the end of the activity to stop the monitoring
  
          Warning : if many records match the filtering pattern , memory usage  may increase
  
  - if the filtering is successfull and _ifstopstatus condition is meet
  
      Warning : if many records match the filtering pattern , memory usage for this query may be hudge
  
  
  
  For all filtered items or if a stop condition is meet , the pipeline action will be executed
  
  Powershell variables WMIMON_* will be set in Powershell runspace to reflect the current WMI activity.
  
  Your Powershell actions may use these variables (client PID, client computer, client user, stop status, WMI query,...)  
  
  
  
  N.B: WMIMon is based on RealTime ETL notification. ETL infrastructure doesn't guarantee that all events will be received.
  
  N.B: WMI Stop operation logging may occur after a delay based on client (get-cim* cmdlets cleanup occurs immediately
  
       This is not true with get-wmiobject cmdlet).

Download