WMI and Performance Counters: I
Posted by: Richard Siddaway
Security
We are always worried about the performance of our systems for one reason or another. We usually turn to sysmon/perfmon to find out how the system is doing.
We can actually use WMI to retrieve this data!
CPU performance is always an issue. We can see what is available
PS> Get-WmiObject -List Win32_Perf*Processor | select name
Name
—-
Win32_PerfFormattedData_PerfOS_Processor
Win32_PerfRawData_PerfOS_Processor
The two classes do exactly what they say – they return the raw data or formatted data. You may think that returning the raw data is the best bet but you will need to perform a set of calculations on the data to get the results you expect. We’ll stick with the formatted data for now.
PS> Get-WmiObject -Class Win32_PerfFormattedData_PerfOS_Processor | select Name
Name
—-
0
1
_Total
I have two cores on my windows 7 system so this works. if we just look at the _Total data
__GENUS : 2
__CLASS : Win32_PerfFormattedData_PerfOS_Processor
__SUPERCLASS : Win32_PerfFormattedData
__DYNASTY : CIM_StatisticalInformation
__RELPATH : Win32_PerfFormattedData_PerfOS_Processor.Name="_Total"
__PROPERTY_COUNT : 24
__DERIVATION : {Win32_PerfFormattedData, Win32_Perf, CIM_StatisticalInformation}
__SERVER : RSLAPTOP01
__NAMESPACE : root\cimv2
__PATH : \\RSLAPTOP01\root\cimv2:Win32_PerfFormattedData_PerfOS_Processor.Name="_Total"
C1TransitionsPersec : 307
C2TransitionsPersec : 0
C3TransitionsPersec : 0
Caption :
Description :
DPCRate : 0
DPCsQueuedPersec : 116
Frequency_Object :
Frequency_PerfTime :
Frequency_Sys100NS :
InterruptsPersec : 190
Name : _Total
PercentC1Time : 96
PercentC2Time : 0
PercentC3Time : 0
PercentDPCTime : 0
PercentIdleTime : 100
PercentInterruptTime : 0
PercentPrivilegedTime : 0
PercentProcessorTime : 0
PercentUserTime : 0
Timestamp_Object :
Timestamp_PerfTime :
Timestamp_Sys100NS :
This dumps all of the counters for a set. If you’ve looked the Processor counters before these should be familiar. The drawback to the formatted counters is that we lose the timestamp information. Either we use the raw data and calculate all of the results or we add the timestamp ourselves. My vote goes to option 2.
|
001
002 003 004 005 006 007 008 009 010 011 012 013 014 015 016 017 018 019 020 021 022 023 024 025 026 027 028 029 030 |
$source=@"
public class CPUcounter { public string Timestamp {get; set;} public string Name {get; set;} public ulong PercProcTime {get; set;} } "@ Add-Type -TypeDefinition $source -Language CSharpversion3 $data = @() 1..3 | foreach { $date = (Get-Date).ToString() Get-WmiObject -Class Win32_PerfFormattedData_PerfOS_Processor | $value = New-Object -TypeName CPUCounter -Property @{ TimeStamp = $date Name = $_.Name PercProcTime = $_.PercentProcessorTime } $data += $value } Start-Sleep -Seconds 1 $data | Format-Table -AutoSize |
We create our own object to hold the counter values and add the timestamp. This can be the basis of a performance baseline as we will see next time
Comment
RSS Feed
Email a friend
