PowerShell for Windows Admins


May 1, 2011  12:25 PM

PowerShell Deep Dive: VI WQL Query Speed–Remote

Richard Siddaway Richard Siddaway Profile: Richard Siddaway

Looking at WQL query vs a Get-WmiObject filter on the local machine we saw that they were practically the same. If we used a where-object to do the filtering it took nearly twice as long.

I wanted to repeat these runs against a remote machine.  I use two Windows 2008 R2 servers for the test.

 

PS> 1..100 | foreach {Measure-Command -Expression {Get-WmiObject -Class Win32_Process -Filter "Name=’Notepad.exe’" -computername webr201}} |

Measure-Object -Property TotalMilliseconds -Average

Count    : 100
Average  : 29.678681
Sum      :
Maximum  :
Minimum  :
Property : TotalMilliseconds

 

PS> 1..100 | foreach {Measure-Command -Expression {Get-WmiObject -Query "SELECT * FROM Win32_Process WHERE Name=’Notepad.exe’" -computername webr201}} | Measure-Object -Property TotalMilliseconds -Average

Count    : 100
Average  : 30.669341
Sum      :
Maximum  :
Minimum  :
Property : TotalMilliseconds

 

PS> 1..100 | foreach {Measure-Command -Expression {Get-WmiObject -Class Win32_Process -computername webr201 | Where {$_.Name -eq ‘Notepad.exe’} }} |

Measure-Object -Property TotalMilliseconds -Average

Count    : 100
Average  : 59.997321
Sum      :
Maximum  :
Minimum  :
Property : TotalMilliseconds

 

Results Summary

Filter: 29.678681

Query:  30.669341

Where:  59.997321

Again the filter and the query are nearly the same. I millisecond difference in the average of 100 runs is not enough to worry about. Using where-object is again about twice the time.

The results this time are quicker than running on the local machine.  This is because the server I used is more powerful than the laptop I used for the local test. The important thing is the relationships not the exact numbers. I ran the tests locally on the server and got similar pattern of results.

After all this I would say the running a full WQL query or using –Filter are about the same in speed. There may be a gain for the query if we selected properties as well but the extra typing and checking probably don’t justify the gain. Use a query or use a filter the results will be similar.  I’ll stick with the filter because its less typing.

May 1, 2011  4:13 AM

PowerShell Deep Dive: V WMI associations

Richard Siddaway Richard Siddaway Profile: Richard Siddaway

NOTE: If you are wondering why the Deep Dive posts are non-consecutive – they are part of a longer series posted here http://msmvps.com/blogs/richardsiddaway/default.aspx

WMI classes will sometimes have be associated with other classes for example each instance of the Win32_NetworkAdatper class is associated with an instance of the Win32_NetworkAdapterConfiguration.  The link is expressed by the Win32_NetworkAdapterSetting which shows the links.

I normally use WQL queries based on ASSOCIATORS and REFERENCES to discover these classes.  ASSOCIATORS shows the end point of the link and REFERENCES shows the linking class

We can do some of this work directly from the WMI object.

Lets get a network adapter object (you will need to use a deviceid thats present on your machine)

$nic = Get-WmiObject Win32_NetworkAdapter  -Filter "DeviceId=11"

and check its methods

$nic | gm -MemberType method

 

This doesn’t show what we need so we’ll drop to the underlying object

$nic.psbase | gm -MemberType method

 

which shows two methods of interest

GetRelated
GetRelationships

 

We could also use

$nic | gm -MemberType method -View base

The methods relate to WQL like this

GetRelated = Associations
GetRelationships = References

 

What we get with these methods is the full related object.  We don’t have a method on the object to discover the classes that are related. For that we stick with WQL

Get-WmiObject -Query "ASSOCIATORS OF {Win32_NetworkAdapter.DeviceID=11} WHERE ClassDefsOnly"
Get-WmiObject -Query "REFERENCES OF {Win32_NetworkAdapter.DeviceID=11} WHERE ClassDefsOnly"

 

though these snippets are equivalent

$nic.GetRelated() | select __class –Unique

$nic.GetRelationships() | select __class –Unique

 

If we want to see the associated classes we can do this

$nic.GetRelated()

or

Get-WmiObject -Query "ASSOCIATORS OF {Win32_NetworkAdapter.DeviceID=11}"

 

For a specific result class we can do this

$nic.GetRelated("Win32_NetworkAdapterConfiguration")

or

et-WmiObject -Query "ASSOCIATORS OF {Win32_NetworkAdapter.DeviceID=11} WHERE ResultClass=Win32_NetworkAdapterConfiguration"

 

Switching to the links between classes – if we want to see all the links

$nic.GetRelationships()

or

Get-WmiObject -Query "REFERENCES OF {Win32_NetworkAdapter.DeviceID=11} "

 

and if we want to see a single link

$nic.GetRelationships("Win32_NetworkAdapterSetting")

or

Get-WmiObject -Query "REFERENCES OF {Win32_NetworkAdapter.DeviceID=11} WHERE ResultClass=Win32_NetworkAdapterSetting"

This gives us two routes to the information we need.  Use whichever you are most comfortable with.


April 30, 2011  12:02 PM

PowerShell Deep Dive III: WQL query speed

Richard Siddaway Richard Siddaway Profile: Richard Siddaway

One topic that came up during my talk at Deep Dive was the speed of running a WQL vs using –Filter in Get-WmiObject.  I’d never tested it so its time to find out.

PowerShell v2 has a handy cmdlet called Measure-Command that times how long a command runs

We’ll start with using a filter

Get-WmiObject -Class Win32_Process -Filter "Name=’Notepad.exe’"

 

if we wrap it in Measure-Command we get this

Measure-Command -Expression {Get-WmiObject -Class Win32_Process -Filter "Name=’Notepad.exe’"}

Days              : 0
Hours             : 0
Minutes           : 0
Seconds           : 0
Milliseconds      : 81
Ticks             : 817436
TotalDays         : 9.46106481481481E-07
TotalHours        : 2.27065555555556E-05
TotalMinutes      : 0.00136239333333333
TotalSeconds      : 0.0817436
TotalMilliseconds : 81.7436

 

We want the TotalMilliseconds property and we need to do it more than once

 

1..100 | foreach {Measure-Command -Expression {Get-WmiObject -Class Win32_Process -Filter "Name=’Notepad.exe’"}} |

Measure-Object -Property TotalMilliseconds -Average

Count    : 100
Average  : 52.640332
Sum      :
Maximum  :
Minimum  :
Property : TotalMilliseconds

 

Now lets repeat as a query

Get-WmiObject -Query "SELECT * FROM Win32_Process WHERE Name=’Notepad.exe’"

 

which becomes

Measure-Command -Expression {Get-WmiObject -Query "SELECT * FROM Win32_Process WHERE Name=’Notepad.exe’"}

 

1..100 | foreach {Measure-Command -Expression {Get-WmiObject -Query "SELECT * FROM Win32_Process WHERE Name=’Notepad.exe’"}} |

Measure-Object -Property TotalMilliseconds -Average

Count    : 100
Average  : 52.345972
Sum      :
Maximum  :
Minimum  :
Property : TotalMilliseconds

 

Just for fun lets try this

1..100 | foreach {Measure-Command -Expression {Get-WmiObject -Class Win32_Process | Where {$_.Name -eq ‘Notepad.exe’} }} |

Measure-Object -Property TotalMilliseconds -Average

Count    : 100
Average  : 92.96794
Sum      :
Maximum  :
Minimum  :
Property : TotalMilliseconds

 

So the results so far

Filter:  52.640332

Query:   52.345972

Where:   92.96794

The filter and the query are almost the same – I’m not going to argue over 0.03 milliseconds.  Using Where-Object takes nearly twice as long. This is understandable because the query and filter pick out a single process but using Where-Object we return all processes and then filter.

I stated in my talk that it was better to use the filter because it was less typing. On these results I’ll stand by that statement for local machines as it takes me more than a few milliseconds to type the extra characters using a query.

Further research is needed:

  1. What happens if running against remote machines?
  2. is it faster to select properties in the query or using select-object

We’ll return to these points later


April 29, 2011  3:28 AM

PowerShell Deep Dive: II Win32_Volume

Richard Siddaway Richard Siddaway Profile: Richard Siddaway

One question that I was asked at the deep dive –

Is there a way to link a disk volume back to the physical disk it resides on?

There doesn’t seem to be. If we test the WMI classes associated with a volume we get these results

Win32_Directory
Win32_QuotaSetting
Win32_ShadowProvider
Win32_ShadowCopy
Win32_ComputerSystem
Win32_Volume
Win32_Group

If anyone knows how to relate Win32_Volume to the physical disk (need to get the serial number off the disk) then I’d be interested in hearing about it


April 26, 2011  1:27 PM

May 2011–UK PowerShell UG

Richard Siddaway Richard Siddaway Profile: Richard Siddaway


When: Tuesday, May 10, 2011 8:30 PM (BST)


Where: Live Meeting

*~*~*~*~*~*~*~*~*~*

Join PowerShell MVP and author Jonathan Medd to learn about PowerShell modules and how to get the most out of them.

Notes


Richard Siddaway has invited you to attend an online meeting using Live Meeting.
Join the meeting.
Audio Information
Computer Audio
To use computer audio, you need speakers and microphone, or a headset.
First Time Users:
To save time before the meeting, check your system to make sure it is ready to use Microsoft Office Live Meeting.
Troubleshooting
Unable to join the meeting? Follow these steps:

  1. Copy this address and paste it into your web browser:
    https://www.livemeeting.com/cc/usergroups/join
  2. Copy and paste the required information:
    Meeting ID: 8TWQGF
    Entry Code: 6NB,TJm(m
    Location: https://www.livemeeting.com/cc/usergroups

If you still cannot enter the meeting, contact support

Notice
Microsoft Office Live Meeting can be used to record meetings. By participating in this meeting, you agree that your communications may be monitored or recorded at any time during the meeting.


April 26, 2011  1:08 PM

System Stability part II

Richard Siddaway Richard Siddaway Profile: Richard Siddaway

Last time we looked at the Win32_ReliabilityStabilityMetrics and closed by stating we’d look at the reliability records.  Reliability records are event log records related to system reliability.  The working part of the record is shown below (after the system properties are removed)

ComputerName     : RSLAPTOP01
EventIdentifier  : 19
InsertionStrings : {Security Update for Microsoft .NET Framework 4 on  Windows XP, Windows Server     2003, Windows Vista, Windows 7, Windows Server 2008, {ac2a295d-228e-4941-8568-ff131f842920}, 105}

Logfile          : System
Message          : Installation Successful: Windows successfully installed the following update: Security Update for Mi                 crosoft .NET Framework 4 on Windows XP, Windows Server 2003, Windows Vista, Windows 7, Windows Server 2008 x86 (KB2446708)

ProductName      : Security Update for Microsoft .NET Framework 4 on Windows XP, Windows Server 2003, Windows Vista, Windows 7, Windows Server 2008
RecordNumber     : 180291
SourceName       : Microsoft-Windows-WindowsUpdateClient
TimeGenerated    : 20110414224442.000000-000
User             : NT AUTHORITY\SYSTEM

 

This is fairly typical in that it shows something that has changed and could therefore affect system reliability. Which logs are involved.  On my system

PS> Get-WmiObject Win32_ReliabilityRecords | select Logfile -Unique

Logfile
——-
System
Application

As we are talking about event logs they have to have a source

PS> Get-WmiObject Win32_ReliabilityRecords | select SourceName -Unique

SourceName
———-
Microsoft-Windows-WindowsUpdateClient
Application Error
MsiInstaller
Microsoft-Windows-UserPnp
Application Hang
Application-Addon-Event-Provider
EventLog

If we want to see the events related to a particular source then we can do this

PS> Get-WmiObject -Class Win32_ReliabilityRecords -Filter "SourceName=’Application Hang’" | Format-Table TimeGenerated, ProductName, Message –wrap –AutoSize

What we really need is a function to wrap the choices so we just choose parameters. Thats what we’ll do next


April 23, 2011  5:34 AM

System Stability

Richard Siddaway Richard Siddaway Profile: Richard Siddaway

As admins one of the things we need to be able to prove is the stability and reliability of our systems. With Windows 7 and Windows 2008 R2 we have a way to do this

001
002
003
004
005
006
007
008
009
010
011
012
function get-stabilityindex {
[CmdletBinding()]
param
 (
 
[parameter(ValueFromPipeline=$true,
   ValueFromPipelineByPropertyName=$true)]
 [string]$computer="."
) 
 
Get-WmiObject -Class Win32_ReliabilityStabilityMetrics
 `
 
-ComputerName $computer |
 select @{N="TimeGenerated"; E={$_.ConvertToDatetime($_.TimeGenerated)}},
 
 
SystemStabilityIndex
}

Use the Win32_ReliabilityStabilityMetrics class – see http://msdn.microsoft.com/en-us/library/ee706632(VS.85).aspx for details

The function takes a computer name and returns the date and time a metric was computed and its value.

We’ll follow this up with a look at Win32_Reliability records next time


April 21, 2011  1:52 PM

PowerShell and WMI MEAP update

Richard Siddaway Richard Siddaway Profile: Richard Siddaway

Chapters 8 and 9 of PowerShell and WMI have been released into the MEAP. They are available from http://www.manning.com/siddaway2/

 

Chapter 8 covers the File system

  • Administer shares
  • Compress or encrypt files
  • Monitor file system events

Chapter 9 covers Services and processes including:

  • service load order
  • discover process owners
  • use WMI events to control processes

The code from the chapters is available for download.

Next up is chapter 10 dealing with printers.

Chapter 11 on Networking is complete and I’m working on the IIS WMI provider (chapter 12) and configuring a new server (chapter 13)

Enjoy


April 13, 2011  12:58 PM

Tuesday’s recording

Richard Siddaway Richard Siddaway Profile: Richard Siddaway

The recording from Tuesdays UG meeting is available.

Richard Siddaway has invited you to view a Microsoft Office Live Meeting recording.
View Recording
Recording Details
Subject: PowerShell and COM objects
Recording URL: https://www.livemeeting.com/cc/usergroups/view
Recording ID: Q4DPJT
Attendee Key: 4~_TzB%6w

The slides and scripts are available from

http://cid-43cfa46a74cf3e96.office.live.com/browse.aspx/PowerShell%20User%20Group/2011%20April

Previous meeting’s recordings are still available:

  • Regular Expressions
  • PowerShell utility cmdlets
  • PowerShell best practice
  • Remoting
  • Registry
  • DNS
  • Events
  • Modules


April 11, 2011  1:08 PM

User Group meeting–tomorrow

Richard Siddaway Richard Siddaway Profile: Richard Siddaway

Don’t forget the user group meeting tomorrow

http://msmvps.com/blogs/richardsiddaway/archive/2011/04/03/powershell-ug-meeting-april-2011-com-objects.aspx


Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to: