Come join our live training webinar every other Wednesday at 11am PST and hear LogicMonitor experts explain best practices and answer common questions. We understand these are uncertain times, and we are here to help!
Note: A Windows Collector must be used in order to monitor Windows hosts.
The LogicMonitor Collector primarily uses Windows Management Instrumentation (WMI) to monitor Windows servers. Most issues with the Windows task collection result from permission restrictions when the Collector machine attempts to query your hosts for data.
In these situations, the credentials for both of your Collector services, including “LogicMonitor Collector” and “LogicMonitor Watchdog”, should reference either a Domain user that is an Administrative account on the hosts to be monitored , or a local administrator that will be available on each Windows host to be monitored by this Collector. To change the user the services run as, change the credentials in the “Log On” tab for both services, and then start the services again.
If you cannot run the Collector under an administrator user, or if you are monitoring hosts between multiple domains and need to make a host-specific credential adjustment, follow these instructions to add the “wmi.user” and “wmi.pass” custom properties to your host.
Microsoft published a Windows DCOM Server security feature bypass (CVE-2021-26414) to address vulnerabilities with WMI. You need to install these updates on your monitored Windows servers before you install them on your Windows Collector.
If you updated your Collector and not your servers, WMI collection might fail. If you are already experiencing issues your Windows clients or servers, you can expect to see the following error event IDs in your logs:
For more information, see the LogicMonitor Community forum.
All of the following services should be running and set to an “Automatic” startup type for WMI monitoring on a Windows host:
And the following service(s) may be set to a “Manual” startup type:
To test a WMI connection manually, you will need to run the WBEMTEST utility from the host on which the Collector is running. The following steps describe how to connect to the remote computer and pass WMI queries using the Windows WBEMTEST tool, and you can use it to quickly explore or confirm WMI details. (See the sections below for additional detail.)
Click Start > Run… > “wbemtest” to enter the WBEMTEST utility. Click “Connect”.
Then enter the local or remote host IP into the remote namespace field, followed by “\root\cimv2”, and credentials into Connection dialog. In the above example, we are attempting to check WMI connectivity of the host 192.168.23.1. Click Connect3
If something is wrong that prevents WBEMTEST from connecting, an error dialog will show the reason causing the failure.
If you connection is successful, you will be returned back to the main window, this time with additional options available.
Click on Enum Classes…> toggle Recursive > OK
This should return with a list of your available WMI classes. Most normal Windows installations have 800-1200 classes.
If you do not get a list of classes returned, there may be an incompatibility between the WMI implementations of the different hosts. One workaround is to install a Collector on the same OS as the host you want to query (or on that very host.) Contact our support for additional troubleshooting and workaround options.
To determine whether WMI is working correctly on the host, from the host that you are trying to query:
If local WMI access on the host works, you should isolate why the Collector is not able to collect data.
If permission issues are suspected, try a remote WMI connection, specifying the credentials of a domain administrator account in your network, or local administrator that is available the target machine. If it succeeds, this establishes that WMI is working correctly on the local host and Collector machine, but the LogicMonitor services are running as an account with insufficient privileges.
If WMI is working correctly, but it cannot be accessed from a remote machine, there may be firewall issues, access right issue or DCOM issues. See the section under Access Denied in this article or search support.microsoft.com for more information on how to troubleshoot these issues.
When using non-host based firewalls or third-party firewalls on Windows, you will need to open specific ports to allow for WMI communication.
By default, port 135/tcp (RPC Endpoint Mapper) is used to establish communications. WMI is then assigned ports through DCOM and communications is handled over a randomly assigned port in the dynamic port range.
In Windows Server 2008 and later versions, and in Windows Vista and later versions, the default dynamic port range changed to the following range:
Windows 2000, Windows XP, and Windows Server 2003 use the following dynamic port range:
Be advised that LogicMonitor does not provide support for customizations made to operating systems.
The minimum number of ports required may differ from computer to computer. Computers with higher traffic may run into a port exhaustion situation if the RPC dynamic ports are restricted. Take this into consideration when restricting the port range.
For direction in restricting RPC dynamic port allocation, see the Microsoft support article How to configure RPC dynamic port allocation to work with firewalls.
Another option is designating a fixed port for WMI as discussed in the Microsoft support article Setting Up a Fixed Port for WMI.
Possible Issues: The Windows Firewall is blocking the connection.
Quick fix: execute “netsh firewall set service RemoteAdmin enable” from command console at the monitored host (not the host on which the Collector is running). After passing this command, you can use the Windows Firewall snap-in console (wf.msc) to further tighten access to this port to be only be accessible by a certain host, user, or interface. For more information, see here. For Windows Vista and later, see here.
Possible Issues: The user does not have remote access to the computer through DCOM. Quick fix: Give the user Remote Launch and Remote Activation permissions in dcomcnfg.
For more information, see here
Possible Issues: If a user tries to connect to a namespace they are not allowed access to, they will receive error 0x80041003. By default, this permission is enabled only for administrators. Quick fix: An administrator can enable remote access to specific WMI namespaces for a nonadministrator user.
The following figure allows the user ‘logicmonitor’ to access the WMI namespace ‘ROOT/CIMV2’.
For more information, see here.
Possible Issues: Collector uses the wrong username/password
Quick fix 1: If the device was already added into LogicMonitor, edit device’s wmi.user and wmi.pass properties.
At times you may find that no matter what credentials you use and and how many security hurdles you’ve bypassed, you still cannot fully monitor your Windows machine. In these instances, your operating system may have a corrupted or inconsistent WMI class structure.
Other symptoms that you may be experiencing:
Microsoft reports that this may happen when “… certain extensible counters corrupt the registry, or if some Windows Management Instrumentation (WMI)-based programs modify the registry”, but the exact nature of these issues is largely unknown and normally not worth troubleshooting extensively.
You may use the sets of WMI counter repairs below to attempt to rebuild your WMI class structure:
CAUTION: These steps will overwrite all custom Performance counter registry settings that you may have configured and will replace them with default configurations.
Logged in as an Administrator user, please run the following:
If still having issues, or 0x80041003, “Empty result set” ; “Unexpected WMI query result”, “Expecting size 1, but got size 0” errors.
Performing a reboot after completing each fix block is ideal, but not absolutely necessary. Also, many of the above commands do not echo a response after completion, so do not be alarmed if you do not notice any changes occurring after passing a command.
Additional troubleshooting may be performed using the Windows WMI Diagnosis Utility (wmiadiag.vbs). For more information, please see this page.
Occasionally, LogicMonitor will not discover an IIS instance (or some other attribute) on a Windows server. This can occur when the performance classes are not correctly registered, or when your WMI class structure is corrupt or inconsistent.
These issues can normally be corrected by running WMI counter repairs. Please see WMI counter troubleshooting for more information.
Windows may report No Data for page file statistics if you have a server configured for “Automatically manage paging files for all drives”, or if one of the other “Automatic” options is selected. If you assign a minimum value explicitly, then these counters will become populated.
To explicitly assign a minimum value:
There is a recognised condition in which monitored Windows hosts prevent access to all WMI classes except for Win32_OperatingSystem and Win32_Volume. To resolve this, the User Account Control (UAC) must be disabled on monitored Windows hosts.
Note: Disabling UAC only applies to the built-in Administrator account and all other users who are member of the hosts local Administrators group.
There are two methods in which UAC may be disabled.
Method 1: Disabling UAC on UI using the Windows ‘Local Security Policy’. This method enables you to disable a single host.
Follow these steps to disable UAC:
Method 2: Disabling UAC using the Windows Registry. This method enables you to disable multiple hosts at a time.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
This will disable UAC and permit data collection from all classes.
Alternately, you can also use PowerShell to disable UAC on Windows hosts.
Get-ItemProperty -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System' -Name 'EnableLua'
Set-ItemProperty -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System' -Name 'EnableLUA' -Value '0'
In other cases, monitoring will stop for some objects (such as disks) while other monitoring continues correctly.
This may also indicate a WMI issue.
Some options to resolve this may be:
Once you have gathered the data, review the Event Logs for WMI errors. If you have captured the output from the WMI Diagnosis Utility, review the logs and resolve any errors where possible. Since WMI is such an integral part of Windows Operating System, please engage a Microsoft Support Engineer for assistance.
In This Article
