{"id":153,"date":"2019-05-29T06:55:35","date_gmt":"2019-05-29T06:55:35","guid":{"rendered":"http:\/\/edcint.co.nz\/checkwmiplus\/?post_type=faq&#038;p=153"},"modified":"2019-05-30T00:21:26","modified_gmt":"2019-05-30T00:21:26","slug":"can-you-show-me-some-example-command-lines","status":"publish","type":"faq","link":"https:\/\/edcint.co.nz\/checkwmiplus\/faq\/can-you-show-me-some-example-command-lines\/","title":{"rendered":"Can you show me some example command lines?"},"content":{"rendered":"<p>The checks shown on this page are generated using the &#8211;iexample=1 parameter.<br \/>\nA valid -H HOSTNAME -u USER and -p PASSWORD must also be passed on the command line.<br \/>\nThe examples are run against a machine (which is not very busy) running Windows Server 2008 R2, IIS v7, SQL Express 2008 and Exchange 2010.<\/p>\n<h2>Lets Start Easy<\/h2>\n<p><strong>Show the version and basic command line help<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS --version<\/code><br \/>\nOutput : <code><font color=blue>Version: 1.51<\/font><\/code><\/p>\n<p>Some of the following commands need at least 2 WMI data samples. If the command output shows <code>Collecting first WMI sample because the previous state data file (\/tmp\/cwpss_somefilename.state) contained no data. Results will be shown the next time the plugin runs.<\/code> then you need to run the command a second time to see the output.<\/p>\n<p>The plugin output is colour coded as follows:<br \/>\n<font color=blue>Plugin display output<\/font><br \/>\n<font color=red>Warning\/Critical trigger information<\/font><br \/>\n<font color=green>Performance Data<\/font><\/p>\n<p><strong>Check CPU utilisation<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checkcpu<\/code><br \/>\nOutput : <code><font color=blue>OK (Sample Period 58 sec) - Average CPU Utilisation 3.10%<\/font>|<font color=green>'Avg CPU Utilisation'=3.10%; <\/font><\/code><\/p>\n<p>If you take a look at the &#8211;help output for checkcpu you can see that the only valid Warning\/Critical Field is _AvgCPU, so you do not  even  need to specify it. So the command for going warning above 1% and critical above 90% is:<br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checkcpu -w 1 -c 90<\/code><br \/>\nOutput : <code><font color=blue>WARNING (Sample Period 0 sec) - <\/font><font color=red>[Triggered by _AvgCPU>1]<\/font><font color=blue> - Average CPU Utilisation 7.69%<\/font>|<font color=green>'Avg CPU Utilisation'=7.69%;1;90; <\/font><\/code><\/p>\n<h2>The Built-in Checks<\/h2>\n<p><strong>Check the CPU Queue<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checkcpuq<\/code><br \/>\nOutput : <code><font color=blue>OK - Average CPU Queue Length 0.3 (3 points with 1 sec delay gives values: 0, 1, 0)<\/font>|<font color=green>'Avg CPU Queue Length'=0.3; <\/font><\/code><\/p>\n<p><strong>Check the CPU Queue 5 times as fast as possible (0 seconds apart)<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checkcpuq -a 5 -y 0<\/code><br \/>\nOutput : <code><font color=blue>OK - Average CPU Queue Length 0.6 (5 points with 0 sec delay gives values: 1, 0, 0, 1, 1)<\/font>|<font color=green>'Avg CPU Queue Length'=0.6; <\/font><\/code><\/p>\n<p><strong>Check the drive size of C:<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checkdrivesize -a c:<\/code><br \/>\nOutput : <code><font color=blue>OK - C: Total=99.90GB, Used=13.09GB (13.1%), Free=86.81GB (86.9%)     <\/font>|<font color=green>'C: Space'=13.09GB; 'C: Utilisation'=13.1%; <\/font><\/code><\/p>\n<p><strong>Check the drive size of all drives, use volume names and include an overall total<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checkdrivesize -o 1 -3 1<\/code><br \/>\nOutput : <code><font color=blue>OK - Overall Disk Total=99.90GB, Used=13.09GB (13.1%), Free=86.81GB (86.9%)     <\/font>|<font color=green>'Overall Disk Space'=13.09GB; 'Overall Disk Utilisation'=13.1%; <\/font><\/code><\/p>\n<p><strong>Check the system event log for the last 1 hour for warnings and errors<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checkeventlog<\/code><br \/>\nOutput : <code><font color=blue>OK - 0 event(s) of at least Severity Level \"Error\", were recorded in the last 1 hours from the System Event Log.<\/font>|<font color=green>'Event Count'=0; <\/font><\/code><\/p>\n<p><strong>Check the Application event log for errors only (hence the -o 2) for the past 4 hours<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checkeventlog -a application -o 2 -3 4<\/code><br \/>\nOutput : <code><font color=blue>OK - 0 event(s) of at least Severity Level \"Warning\", were recorded in the last 4 hours from the application Event Log.<\/font>|<font color=green>'Event Count'=0; <\/font><\/code><\/p>\n<p><strong>Check the file age of c:\/pagefile.sys and warn if it is older 10 minutes, go critical if less than 30 minutes<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checkfileage -a c:\/pagefile.sys -w 10min -c 30min:<\/code><br \/>\nOutput : <code><font color=blue>WARNING - <\/font><font color=red>[Triggered by _FileAge>10min]<\/font><font color=blue> - Age of File c:\/pagefile.sys is 1236 days 09:00:26 (1780380min) or 29673.01hr(s).<\/font>|<font color=green>'c:\/pagefile.sys Age'=29673.01hr;0.166666666666667;0.5; <\/font><\/code><\/p>\n<p><strong>Check the size of c:\/pagefile.sys, warn if it is more than 1500MB and go critical if larger than 2GB<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checkfilesize -a c:\/pagefile.sys -w 1500m -c 2g<\/code><br \/>\nOutput : <code><font color=blue>OK - File c:\/pagefile.sys is 1.000GB. Found 1 instance(s).<\/font>|<font color=green>'c:\/pagefile.sys Size'=1073741824bytes;1572864000;2147483648; 'File Count'=1; <\/font><\/code><\/p>\n<p><strong> show the size of the files in c:\/ (do not include sub directories)<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checkfoldersize -a c:\/<\/code><br \/>\nOutput : <code><font color=blue>OK - Folder c:\/ is 1.000GB. Found 2 files(s). (List is on next line)<\/font>|<font color=green>'c:\/ Size'=1073792186bytes; 'File Count'=2; <\/font><font color=blue>The file(s) found are c:\\pagefile.sys<br \/>\nc:\\wmiexplorer.ps1<\/font><\/code><\/p>\n<p><strong>Check the RAM utilisation<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checkmem<\/code><br \/>\nOutput : <code><font color=blue>OK - Physical Memory: Total: 0.976GB - Used: 0.897GB (92%) - Free: 0.079GB (8%)<\/font>|<font color=green>'Physical Memory Used'=963153920Bytes; 'Physical Memory Utilisation'=92%; <\/font><\/code><\/p>\n<p><strong>Check the RAM utilisation, warn if more than 40% utilised, go critical of more than 90%<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checkmem -w 40 -c 90<\/code><br \/>\nOutput : <code><font color=blue>CRITICAL - <\/font><font color=red>[Triggered by _MemUsed%>90]<\/font><font color=blue> - Physical Memory: Total: 0.976GB - Used: 0.897GB (92%) - Free: 0.079GB (8%)<\/font>|<font color=green>'Physical Memory Used'=963174400Bytes; 'Physical Memory Utilisation'=92%;40;90; <\/font><\/code><\/p>\n<p><strong>Check the RAM utilisation, warn if less than 70% is free<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checkmem -w _MemFree%=70:<\/code><br \/>\nOutput : <code><font color=blue>WARNING - <\/font><font color=red>[Triggered by _MemFree%<70]<\/font><font color=blue> - Physical Memory: Total: 0.976GB - Used: 0.897GB (92%) - Free: 0.079GB (8%)<\/font>|<font color=green>'Physical Memory Used'=963178496Bytes; 'Physical Memory Utilisation'=92%; <\/font><\/code><\/p>\n<p><strong>List valid network adapters for checknetwork<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checknetwork<\/code><br \/>\nOutput : <code><font color=blue>No Network Interfaces specified. Valid Interface Names are:<br \/>\nIntel[R] PRO_1000 MT Network Connection, LAN0, (192.168.3.201,fe80::79ad:8819:1156:9eaf), 00:0C:29:7C:1D:BC<br \/>\nIntel[R] PRO_1000 MT Network Connection _2, LAN1, (10.1.0.1,fe80::905c:856d:aa31:8fff), 00:0C:29:7C:1D:C6<br \/>\nisatap.lambert.rd.to, , ,<br \/>\nTeredo Tunneling Pseudo-Interface, , ,<br \/>\nisatap.{53B0E612-FFAF-4126-AFC5-A5322389AD44}, , ,<br \/>\nSpecify the -a parameter with an adapter name. Use ' ' around the adapter name.<\/font><\/code><\/p>\n<p><strong>Check the network stats for the &#8216;LAN0&#8217; interface (might not be valid for your system).<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checknetwork -a LAN0<\/code><br \/>\nOutput : <code><font color=blue>OK (Sample Period 59 sec) - Number of Interfaces=1. Interface Details - OK - Interface:LAN0, IP Address:(192.168.3.201,fe80::79ad:8819:1156:9eaf), MAC Address 00:0C:29:7C:1D:BC, Speed:1.000Gbit\/s, DHCPEnabled=True, Byte Send Rate=0.018MB\/sec, Byte Receive Rate=5.159KB\/sec, Packet Send Rate=29.000packet\/sec, Packet Receive Rate=37.000packet\/sec, Output Queue Length=0, Packets Received Errors=0    <\/font>|<font color=green>'LAN0 BytesSentPersec'=18143; 'LAN0 BytesReceivedPersec'=5159; 'LAN0 PacketsSentPersec'=29; 'LAN0 PacketsReceivedPersec'=37; 'LAN0 OutputQueueLength'=0; 'LAN0 PacketsReceivedErrors'=0; <\/font><\/code><\/p>\n<p><strong>Check the size of all page files using automatic warning and critical settings<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checkpage -a auto -o .<\/code><br \/>\nOutput : <code><font color=blue>Overall Status - OK. Individual Page Files Detail: OK - C:\\pagefile.sys Total: 1.000GB - Used: 0.153GB (15%) - Free: 0.847GB (85%), Peak Used: 0.168GB (17%) - Peak Free: 0.832GB (83%)     <\/font>|<font color=green>'C:\\pagefile.sys Page File Size'=1073741824Bytes; 'C:\\pagefile.sys Used'=164626432Bytes; 'C:\\pagefile.sys Utilisation'=15%; 'C:\\pagefile.sys Peak Used'=180355072Bytes; 'C:\\pagefile.sys Peak Utilisation'=17%; <\/font><\/code><\/p>\n<p><strong>Check for all the processes whose Name matches svchost<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checkprocess -a svchost<\/code><br \/>\nOutput : <code><font color=blue>OK - Found 16 Instance(s) of \"svchost\" running (0 excluded).  (List is on next line)<\/font>|<font color=green>'Process Count'=16; 'Excluded Process Count'=0; <\/font><font color=blue>The process(es) found are 15x svchost.exe,    SMSvcHost.exe<\/font><\/code><\/p>\n<p><strong>Check for all the processes whose Name matches svchost, display the full Commandline and warn if there are more than 4 of them<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checkprocess -a svchost -o comm -w 4<\/code><br \/>\nOutput : <code><font color=blue>WARNING - <\/font><font color=red>[Triggered by _ItemCount>4]<\/font><font color=blue> - Found 16 Instance(s) of \"svchost\" running (0 excluded).  (List is on next line)<\/font>|<font color=green>'Process Count'=16;4; 'Excluded Process Count'=0; <\/font><font color=blue>The process(es) found are  C:\\Windows\\system32\\svchost.exe -k DcomLaunch,    C:\\Windows\\system32\\svchost.exe -k RPCSS,    C:\\Windows\\System32\\svchost.exe -k LocalServiceNetworkRestricted,    C:\\Windows\\system32\\svchost.exe -k netsvcs,    C:\\Windows\\system32\\svchost.exe -k LocalService,    C:\\Windows\\System32\\svchost.exe -k LocalSystemNetworkRestricted,    C:\\Windows\\system32\\svchost.exe -k NetworkService,    C:\\Windows\\system32\\svchost.exe -k LocalServiceNoNetwork,    C:\\Windows\\system32\\svchost.exe -k apphost,    C:\\Windows\\system32\\svchost.exe -k DHCPServer,    \"C:\\Windows\\Microsoft.NET\\Framework64\\v3.0\\Windows Communication Foundation\\SMSvcHost.exe\",    C:\\Windows\\system32\\svchost.exe -k regsvc,    C:\\Windows\\system32\\svchost.exe -k iissvcs,    C:\\Windows\\System32\\svchost.exe -k termsvcs,    C:\\Windows\\system32\\svchost.exe -k NetworkServiceNetworkRestricted,    C:\\Windows\\system32\\svchost.exe -k LocalServiceAndNoImpersonation<\/font><\/code><\/p>\n<p><strong>Check for all the processes whose Commandline matches C:\/Windows\/system32\/svchost.exe, display the full Commandline and exclude any of them that contain the string &#8216;serv&#8217;<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checkprocess -s comm -a C:\/Windows\/system32\/svchost.exe -o comm -3 serv<\/code><br \/>\nOutput : <code><font color=blue>OK - Found 8 Instance(s) of \"C:\/Windows\/system32\/svchost.exe\" running (7 excluded).  (List is on next line)<\/font>|<font color=green>'Process Count'=8; 'Excluded Process Count'=7; <\/font><font color=blue>The process(es) found are  C:\\Windows\\system32\\svchost.exe -k DcomLaunch,    C:\\Windows\\system32\\svchost.exe -k RPCSS,    C:\\Windows\\system32\\svchost.exe -k netsvcs,    C:\\Windows\\System32\\svchost.exe -k LocalSystemNetworkRestricted,    C:\\Windows\\system32\\svchost.exe -k apphost,    C:\\Windows\\system32\\svchost.exe -k regsvc,    C:\\Windows\\system32\\svchost.exe -k iissvcs,    C:\\Windows\\System32\\svchost.exe -k termsvcs<\/font><\/code><\/p>\n<p><strong>Check the all automatially started services are running OK. Warn if there is more than zero not OK, go critical if there is more than 1 not OK<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checkservice -a auto -w 0 -c 1<\/code><br \/>\nOutput : <code><font color=blue>WARNING - <\/font><font color=red>[Triggered by _NumBad>0]<\/font><font color=blue> - Found 55 Services(s), 54 OK and 1 with problems (0 excluded). 'Windows Licensing Monitoring Service' (WLMS) is Stopped.<\/font>|<font color=green>'Total Service Count'=55; 'Service Count OK State'=54; 'Service Count Problem State'=1;0;1; 'Excluded Service Count'=0; <\/font><\/code><\/p>\n<p><strong>Check all services with the string &#8216;windows&#8217; in the short or long name<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checkservice -a windows<\/code><br \/>\nOutput : <code><font color=blue>OK - Found 20 Services(s), 9 OK and 11 with problems (0 excluded). 'Windows Audio Endpoint Builder' (AudioEndpointBuilder) is Stopped, 'Windows Audio' (AudioSrv) is Stopped, 'Windows Event Log' (eventlog) is Running, 'Windows Font Cache Service' (FontCache) is Running, 'Windows Presentation Foundation Font Cache 3.0.0.0' (FontCache3.0.0.0) is Stopped, 'Windows CardSpace' (idsvc) is Stopped, 'Windows Firewall' (MpsSvc) is Running, 'Windows Installer' (msiserver) is Stopped, 'Windows Modules Installer' (TrustedInstaller) is Running, 'Windows Time' (W32Time) is Running, 'Windows Process Activation Service' (WAS) is Running, 'Windows Color System' (WcsPlugInService) is Stopped, 'Windows Event Collector' (Wecsvc) is Stopped, 'Windows Error Reporting Service' (WerSvc) is Stopped, 'Windows Management Instrumentation' (Winmgmt) is Running, 'Windows Remote Management (WS-Management)' (WinRM) is Running, 'Windows Licensing Monitoring Service' (WLMS) is Stopped, 'Microsoft Exchange Server Extension for Windows Server Backup' (wsbexchange) is Stopped, 'Windows Update' (wuauserv) is Running, 'Windows Driver Foundation - User-mode Driver Framework' (wudfsvc) is Stopped.<\/font>|<font color=green>'Total Service Count'=20; 'Service Count OK State'=9; 'Service Count Problem State'=11; 'Excluded Service Count'=0; <\/font><\/code><\/p>\n<p><strong>Check SMART status of all drives on the system.<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checksmart -H gold<\/code><br \/>\nOutput : <code><font color=blue>Overall Status - OK -  Found 2 Disks(s), 2 OK and 0 failing <\/font>|<font color=green>'5FB9WFRP_Reallocated_Sector_Count'=2; '5FB9WFRP_Power_On_Hours'=18836; '5FB9WFRP_Power_Cycle_Count'=1532; '5FB9WFRP_Temperature'=48; '5FB9WFRP_Current_Pending_Sector'=2; '5FB9WFRP_Offline_Uncorrectable'=0; 'Disk#1_Reallocated_Sector_Count'=17; 'Disk#1_Power_On_Hours'=23056; 'Disk#1_Power_Cycle_Count'=2289; 'Disk#1_Temperature'=44; 'Disk#1_Current_Pending_Sector'=0; 'Disk#1_Offline_Uncorrectable'=15; <\/font><font color=blue>OK - Dev#0, ST340810 A SCSI Disk Device, Serial#5FB9WFRP, PredictFailure=False, Temperature=48<br \/>\nOK - Dev#1, Maxtor 6 Y120P0 SCSI Disk Device, Serial#(null), PredictFailure=False, Temperature=44<\/font><\/code><\/p>\n<p><strong>Check all services with the string &#8216;windows&#8217; in the short or long name, exclude any that have &#8216;audio&#8217; in them<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checkservice -a windows -o audio<\/code><br \/>\nOutput : <code><font color=blue>OK - Found 18 Services(s), 9 OK and 9 with problems (2 excluded). 'Windows Event Log' (eventlog) is Running, 'Windows Font Cache Service' (FontCache) is Running, 'Windows Presentation Foundation Font Cache 3.0.0.0' (FontCache3.0.0.0) is Stopped, 'Windows CardSpace' (idsvc) is Stopped, 'Windows Firewall' (MpsSvc) is Running, 'Windows Installer' (msiserver) is Stopped, 'Windows Modules Installer' (TrustedInstaller) is Running, 'Windows Time' (W32Time) is Running, 'Windows Process Activation Service' (WAS) is Running, 'Windows Color System' (WcsPlugInService) is Stopped, 'Windows Event Collector' (Wecsvc) is Stopped, 'Windows Error Reporting Service' (WerSvc) is Stopped, 'Windows Management Instrumentation' (Winmgmt) is Running, 'Windows Remote Management (WS-Management)' (WinRM) is Running, 'Windows Licensing Monitoring Service' (WLMS) is Stopped, 'Microsoft Exchange Server Extension for Windows Server Backup' (wsbexchange) is Stopped, 'Windows Update' (wuauserv) is Running, 'Windows Driver Foundation - User-mode Driver Framework' (wudfsvc) is Stopped.<\/font>|<font color=green>'Total Service Count'=18; 'Service Count OK State'=9; 'Service Count Problem State'=9; 'Excluded Service Count'=2; <\/font><\/code><\/p>\n<p><strong>Check the uptime and warn if it is less than 20 minutes, go critical if it is less than 10 minutes (and just so it will always show a warning for this example add -w 1min)<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checkuptime -w 10min: -c 20min: -w 1min<\/code><br \/>\nOutput : <code><font color=blue>WARNING - <\/font><font color=red>[Triggered by _UptimeSec>1min]<\/font><font color=blue> - System Uptime is  00:51:39 (51min).<\/font>|<font color=green>'Uptime Minutes'=51min;1;20; <\/font><\/code><\/p>\n<h2>Some Example Ini File Checks<\/h2>\n<p>Only some of the checks from the ini files have been included. There are lots more.<\/p>\n<p><strong>Check DHCP stats. Warn if the active queue length exceeds 2<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checkdhcp -s stats -w ActiveQueueLength=2<\/code><br \/>\nOutput : <code><font color=blue>OK (Sample Period 60 sec) - _AcksPersec=0.0, ActiveQueueLength=0, ConflictCheckQueueLength=0, Deniedduetomatch=0, Deniedduetononmatch=0, _DeclinesPersec=0.0, _DiscoversPersec=0.0, _OffersPersec=0.0, _PacketsReceivedPersec=0.0, _ReleasesPersec=0.0, _RequestsPersec=0.0<\/font>|<font color=green>'_AcksPersec'=0.0; 'ActiveQueueLength'=0;2; 'ConflictCheckQueueLength'=0; 'Deniedduetomatch'=0; 'Deniedduetononmatch'=0; '_DeclinesPersec'=0.0; '_DiscoversPersec'=0.0; '_OffersPersec'=0.0; '_PacketsReceivedPersec'=0.0; '_ReleasesPersec'=0.0; '_RequestsPersec'=0.0; <\/font><\/code><\/p>\n<p><strong>Check the number of DNS A records defined <\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checkdns -s arecords<\/code><br \/>\nOutput : <code><font color=blue>OK - Number of DNS A Records=48<\/font>|<font color=green>'DNS A Record Count'=48; <\/font><\/code><\/p>\n<p><strong>Check utilisation of each CPU, rather than just the overall total, warn if any of them goes above 5% utilisation<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checkeachcpu -w 5<\/code><br \/>\nOutput : <code><font color=blue>WARNING (Sample Period 59 sec) - <\/font><font color=red>[Triggered by _AvgCPU>5]<\/font><font color=blue> - CPU0=5.2%   CPU1=2.5%   CPU_Total=3.9%   <\/font>|<font color=green>'Avg Utilisation CPU0'=5.2%;5; 'Avg Utilisation CPU1'=2.5%;5; 'Avg Utilisation CPU_Total'=3.9%;5; <\/font><\/code><\/p>\n<p><strong>List Exchange DB Instances (needs at least Information Store and Transport services running)<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checkexchange -s listDBInstances<\/code><br \/>\nOutput : <code><font color=blue>Number of Instances=3. DB Instance Names - 'edgetransport\/_Total' SessionsInUse=13, 'edgetransport\/Transport Mail Database' SessionsInUse=7, 'edgetransport\/IP Filtering Database' SessionsInUse=6, <\/font>|<font color=green>'DB Instance Count'=3; 'edgetransport\/_Total Sessions in use'=13; 'edgetransport\/Transport Mail Database Sessions in use'=7; 'edgetransport\/IP Filtering Database Sessions in use'=6; <\/font><\/code><\/p>\n<p><strong>Check Exchange stats for any database name ending in _Total<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checkexchange -s DBInstances -a %_total<\/code><br \/>\nOutput : <code><font color=blue>Overall Status - OK (Sample Period 60 sec) -  Transport Name=\"edgetransport\/_Total\" (OK) - _DatabaseCachePercentHit=0, DatabaseCacheSizeMB=1, _DatabaseCacheRequestsPersec=1, _DatabaseCacheMissesPersec=0, _IODatabaseReadsAverageLatency=0ms, _IODatabaseWritesAverageLatency=0ms, _IOLogReadsAverageLatency=0ms, _IOLogWritesAverageLatency=0ms, _IODatabaseReadsPersec=0, _IODatabaseWritesPersec=0, _IOLogReadsPersec=0, _IOLogWritesPersec=0, _LogBytesWritePersec=0, SessionsInUse=13, _TableOpenCachePercentHit=0, TablesOpen=3, _TableOpensPersec=0<\/font>|<font color=green>'_DatabaseCachePercentHit'=0; 'DatabaseCacheSizeMB'=1; '_DatabaseCacheRequestsPersec'=1; '_DatabaseCacheMissesPersec'=0; '_IODatabaseReadsAverageLatency'=0ms; '_IODatabaseWritesAverageLatency'=0ms; '_IOLogReadsAverageLatency'=0ms; '_IOLogWritesAverageLatency'=0ms; '_IODatabaseReadsPersec'=0; '_IODatabaseWritesPersec'=0; '_IOLogReadsPersec'=0; '_IOLogWritesPersec'=0; '_LogBytesWritePersec'=0; 'SessionsInUse'=13; '_TableOpenCachePercentHit'=0; 'TablesOpen'=3; '_TableOpensPersec'=0; <\/font><\/code><\/p>\n<p><strong>Check Exchange SMTP Receive states for all transports (_Total)<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checkexchange -s SmtpReceive -a _total<\/code><br \/>\nOutput : <code><font color=blue>Overall Status - OK (Sample Period 60 sec) -  Transport Name=\"_total\" (OK) - _BytesReceivedPersec=0.000\/sec, _ConnectionsCreatedPersec=0.000\/sec, _DisconnectionsbyAgentsPersecond=0.000\/sec, _MessageBytesReceivedPersec=0.000\/sec, _MessagesReceivedPersec=0.000\/sec, AveragebytesPerconnection_Base=0.000, AveragebytesPermessage=0.000, AveragebytesPermessage_Base=0.000, AveragemessagesPerconnection=0.000, AveragemessagesPerconnection_Base=0.000, AveragerecipientsPermessage=0.000, AveragerecipientsPermessage_Base=0.000, BytesReceivedTotal=0.000, ConnectionsTotal=0.000, Frequency_PerfTime=3.414M, MessageBytesReceivedTotal=0.000, MessagesReceivedTotal=0.000, RecipientsacceptedTotal=0.000, TarpittingDelaysAnonymous=0.000<\/font>|<font color=green>'_BytesReceivedPersec'=0; '_ConnectionsCreatedPersec'=0; '_DisconnectionsbyAgentsPersecond'=0; '_MessageBytesReceivedPersec'=0; '_MessagesReceivedPersec'=0; 'BytesReceivedTotal'=0; 'MessageBytesReceivedTotal'=0; 'MessagesReceivedTotal'=0; 'RecipientsacceptedTotal'=0; <\/font><\/code><\/p>\n<p><strong>Check IIS Connection stats for all web sites<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checkiis -s connections -a _total<\/code><br \/>\nOutput : <code><font color=blue>OK (Sample Period 60 sec) - Site Name=\"_Total\", CurrentConnections=0.000, _ConnectionAttemptsPersec=0.000\/sec<\/font>|<font color=green>'CurrentConnections'=0; '_ConnectionAttemptsPersec'=0; <\/font><\/code><\/p>\n<p><strong>Check IIS Request stats and warn if the POST Requests per second exceeds 10 for the testsite<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checkiis -s requests -a TestSite -w _PostRequestsPersec=10<\/code><br \/>\nOutput : <code><font color=blue>OK (Sample Period 60 sec) - Site Name=\"TESTSite\", _GetRequestsPersec=0.000\/sec, _HeadRequestsPersec=0.000\/sec, _PostRequestsPersec=0.000\/sec, _PropfindRequestsPersec=0.000\/sec, _PutRequestsPersec=0.000\/sec, _ISAPIExtensionRequestsPersec=0.000\/sec, TotalGetRequests=0.000, TotalHeadRequests=0.000, TotalPostRequests=0.000, TotalPropfindRequests=0.000, TotalPutRequests=0.000, TotalISAPIExtensionRequests=0.000<\/font>|<font color=green>'_GetRequestsPersec'=0; '_HeadRequestsPersec'=0; '_PostRequestsPersec'=0;10; '_PropfindRequestsPersec'=0; '_PutRequestsPersec'=0; '_ISAPIExtensionRequestsPersec'=0; 'TotalGetRequests'=0; 'TotalHeadRequests'=0; 'TotalPostRequests'=0; 'TotalPropfindRequests'=0; 'TotalPutRequests'=0; 'TotalISAPIExtensionRequests'=0; <\/font><\/code><\/p>\n<p><strong>Check the IO of the logical drive C:, warn if the current disk queue length is more than 10<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checkio -s logical -a c: -w CurrentDiskQueueLength=10<\/code><br \/>\nOutput : <code><font color=blue>Overall Status - OK (Sample Period 59 sec) -  Logical Drive Name=\"C:\" (OK) - _PercentIdleTime=90%, _PercentBusyTime=10%, _PercentDiskTime=14%, _PercentDiskReadTime=0%, _PercentDiskWriteTime=13%, _DiskReadBytesPersec=6.480KB\/sec, _DiskReadsPersec=1.000\/sec, _DiskWriteBytesPersec=6.062KB\/sec, _DiskWritesPersec=1.000\/sec, CurrentDiskQueueLength=1, _AvgDiskQueueLength=0.1, _AvgDiskReadQueueLength=0.0, _AvgDiskWriteQueueLength=0.1<\/font>|<font color=green>'_PercentIdleTimeC:'=90; '_PercentBusyTimeC:'=10; '_PercentDiskTimeC:'=14; '_PercentDiskReadTimeC:'=0; '_PercentDiskWriteTimeC:'=13; '_DiskReadBytesPersecC:'=6636; '_DiskReadsPersecC:'=1; '_DiskWriteBytesPersecC:'=6208; '_DiskWritesPersecC:'=1; 'CurrentDiskQueueLengthC:'=1;10; '_AvgDiskQueueLengthC:'=0.1; '_AvgDiskReadQueueLengthC:'=0.0; '_AvgDiskWriteQueueLengthC:'=0.1; <\/font><\/code><\/p>\n<p><strong>Check the IO of the physical drive C: (may be different to the logical C:)<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checkio -s physical -a c:<\/code><br \/>\nOutput : <code><font color=blue>Overall Status - OK (Sample Period 59 sec) -  Physical Drive Name=\"0 C:\" (OK) - _PercentIdleTime=90%, _PercentBusyTime=10%, _PercentDiskTime=14%, _PercentDiskReadTime=0%, _PercentDiskWriteTime=14%, _DiskReadBytesPersec=6.474KB\/sec, _DiskReadsPersec=1.000\/sec, _DiskWriteBytesPersec=6.192KB\/sec, _DiskWritesPersec=1.000\/sec, CurrentDiskQueueLength=0, _AvgDiskQueueLength=0.1, _AvgDiskReadQueueLength=0.0, _AvgDiskWriteQueueLength=0.1<\/font>|<font color=green>'_PercentIdleTime0 C:'=90; '_PercentBusyTime0 C:'=10; '_PercentDiskTime0 C:'=14; '_PercentDiskReadTime0 C:'=0; '_PercentDiskWriteTime0 C:'=14; '_DiskReadBytesPersec0 C:'=6629; '_DiskReadsPersec0 C:'=1; '_DiskWriteBytesPersec0 C:'=6341; '_DiskWritesPersec0 C:'=1; 'CurrentDiskQueueLength0 C:'=0; '_AvgDiskQueueLength0 C:'=0.1; '_AvgDiskReadQueueLength0 C:'=0.0; '_AvgDiskWriteQueueLength0 C:'=0.1; <\/font><\/code><\/p>\n<p><strong>Check the printer spooler, warn if OutofPaperErrors>0 (There are no printer servers running on this test machine!)<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checkprint -s spooler -w OutofPaperErrors=0<\/code><br \/>\nOutput : <code><font color=blue>WMI Query returned no data. The item you were looking for may NOT exist or the software that creates the WMI Class may not be running, or all data has been excluded.<\/font><\/code><\/p>\n<p><strong>Check CPU utilisation for some SQL server processes, warn if utilisation is more than 10% or if there are more than 2 processes<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checkproc -s cpu -a %sql% -w 10 -w _ItemCount=2<\/code><br \/>\nOutput : <code><font color=blue>OK (Sample Period 59 sec) - Found 1 Instance(s) of \"%sql%\" running. CPU_sqlservr(PID=2220)=0.0%   <\/font>|<font color=green>'Process Count'=1;2; 'Avg Utilisation CPU_sqlservr'=0.0%;10; <\/font><\/code><\/p>\n<p><strong>Check for processes using more than 50% of the CPU. Include all processes with the string &#8216;serv&#8217;. Also warn if there are more than 2 of them found using more than 50%<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checkproc -s cpuabove -a %serv% -w 50 -w _ItemCount=2<\/code><br \/>\nOutput : <code><font color=blue>WARNING (Sample Period 59 sec) - <\/font><font color=red>[Triggered by _ItemCount>2]<\/font><font color=blue> - Total Process Count=5 (Process details on next line)\\nWARNING - <\/font><font color=red>[Triggered by _ItemCount>2]<\/font><font color=blue> - CPU for services (PID=468)=0.5%\\nOK - CPU for Microsoft.ActiveDirectory.WebServices (PID=1268)=0.0%\\nOK - CPU for ismserv (PID=1496)=0.0%\\nOK - CPU for sqlservr (PID=2220)=0.0%\\nOK - CPU for MSExchangeADTopologyService (PID=3764)=0.0%\\n<\/font>|<font color=green>'Process Count'=5;2; <\/font><\/code><\/p>\n<p><strong>List the SQL Express DB Instances<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checksql -s listdb -a MSSQLSQLEXPRESS_MSSQLSQLEXPRESS<\/code><br \/>\nOutput : <code><font color=blue>Overall Status - OK -Number of Databases=6. DB Names - tempdb, msdb, model, mssqlsystemresource, _Total, master, <\/font><\/code><\/p>\n<p><strong>Check SQL Express cache stats totals (use a different value for -a for SQL Server)<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checksql -s cache -a MSSQLSQLEXPRESS_MSSQLSQLEXPRESS<\/code><br \/>\nOutput : <code><font color=blue>Overall Status - OK - Cache Type _Total (OK) - CacheHitRatio=0, CacheObjectCounts=0, CacheObjectsinuse=0, CachePages=204pages (Each Page is 8k).  <\/font>|<font color=green>'CacheHitRatio'=0; 'CacheObjectCounts'=0; 'CacheObjectsinuse'=0; 'CachePages'=204pages; <\/font><\/code><\/p>\n<p><strong>Check SQL Express latch stats (use a different value for -a for SQL Server)<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checksql -s latches -a MSSQLSQLEXPRESS_MSSQLSQLEXPRESS<\/code><br \/>\nOutput : <code><font color=blue>OK (Sample Period 59 sec) - AverageLatchWaitTimems=5532ms, _LatchWaitsPersec=0, NumberofSuperLatches=0.000, _SuperLatchDemotionsPersec=0.000\/sec, _SuperLatchPromotionsPersec=0.000\/sec, TotalLatchWaitTimems=5532ms<\/font>|<font color=green>'AverageLatchWaitTimems'=5532ms; '_LatchWaitsPersec'=0; 'NumberofSuperLatches'=0; '_SuperLatchDemotionsPersec'=0; '_SuperLatchPromotionsPersec'=0; 'TotalLatchWaitTimems'=5532ms; <\/font><\/code><\/p>\n<p><strong>Check the numbers of Terminal Services sessions<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checkts -s sessions<\/code><br \/>\nOutput : <code><font color=blue>OK - ActiveSessions=1, InactiveSessions=2, TotalSessions=3<\/font>|<font color=green>'ActiveSessions'=1; 'InactiveSessions'=2; 'TotalSessions'=3; <\/font><\/code><\/p>\n<p><strong>Check for users that do not require a password and warn if you find some, go OK of none found (&#8211;nodatamode)<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m checkusers -s count -a \"PasswordRequired!='True'\" --nodatamode -w 0<\/code><br \/>\nOutput : <code><font color=blue>WARNING - <\/font><font color=red>[Triggered by _ItemCount>0]<\/font><font color=blue> - Number of Users=1 - User information shown on next line is: Name(FullName) \\n Guest()<\/font>|<font color=green>'Number of Users'=1;0; <\/font><\/code><\/p>\n<p><strong>Show the Operating System and Service Pack version, and the installation data. Warn if the installation is older than 2 years<\/strong><br \/>\nCommand: <code>check_wmi_plus.pl -H HOST -u USER -p PASS -m info -s os -w 2yr<\/code><br \/>\nOutput : <code><font color=blue>WARNING - <\/font><font color=red>[Triggered by _InstallSec>2yr]<\/font><font color=blue> - OS is Microsoft Windows Server 2008 R2 Datacenter , Service Pack 1, Installation Timestamp=20080116193016.000000+660 (1537.8 days old)<\/font>|<font color=green>'OS Installation Age'=1537.8days; <\/font><\/code><\/p>\n","protected":false},"author":1,"template":"","faq_groups":[10],"class_list":["post-153","faq","type-faq","status-publish","hentry","faq-group-examples"],"_links":{"self":[{"href":"https:\/\/edcint.co.nz\/checkwmiplus\/wp-json\/wp\/v2\/faqs\/153","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/edcint.co.nz\/checkwmiplus\/wp-json\/wp\/v2\/faqs"}],"about":[{"href":"https:\/\/edcint.co.nz\/checkwmiplus\/wp-json\/wp\/v2\/types\/faq"}],"author":[{"embeddable":true,"href":"https:\/\/edcint.co.nz\/checkwmiplus\/wp-json\/wp\/v2\/users\/1"}],"wp:attachment":[{"href":"https:\/\/edcint.co.nz\/checkwmiplus\/wp-json\/wp\/v2\/media?parent=153"}],"wp:term":[{"taxonomy":"faq-group","embeddable":true,"href":"https:\/\/edcint.co.nz\/checkwmiplus\/wp-json\/wp\/v2\/faq_groups?post=153"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}