Does anyone else have sporadic issues where WMI checks stop working for some machines?
Summary: Kel L, known as Kel L, is experiencing sporadic issues with WMI checks failing to work on certain machines because port 135 used by LogicMonitor (LM) for WMI queries becomes unavailable. Despite successful direct queries on hosts, the issue arises with RPC connection failures when the collector attempts to access the machines through port 135. CIM queries still function properly, suggesting a potential transition from WMI to CIM could resolve the issue. Kel L asks the community if others have encountered this problem and seeks advice on solutions, other than rebooting, and inquires about LM's plans to adopt CIM as a standard.
Hi,
We will randomly have WMI completely stop working for some machines. It's rare, but when it happens, it basically means LM isn't able to get any data from those servers because 95% of Windows information is gathered through WMI.
When the WMI queries stop working, it's not actually WMi that breaks on the hosts, it's port 135 that LM uses to connect to the host in order to run the WMI queries. If I run the query directly on the host computer it works fine. It's just when the collector tries to reach out and connect through port 135 that it can't and then fails to run the WMI query. This is not a collector problem because I also can't connect to these machines from our other Utility servers.
When this happens, we can sometimes run some scripts to reset things, but it doesn't always work. I currently have 4 machines that are showing No Data for basically everything except Ping, because most of the rest of the things use WMI over port 135.
What I did notice is that CIM queries work fine. If I manually run get-wmiobject to get CPU or Memory info, it will fail. If I run get-CIMInstance, it will work just fine.
Get-WmiObject Win32_OperatingSystem -ComputerName $server -> Fail - The RPC server is unavailable
Get-CimInstance Win32_OperatingSystem -ComputerName $server -> Success
To be clear, this isn't tehnically a problem with LM. But, since LM is using an RPC connection to run the WMI query, if RPC stops working, so does LM.
Does anyone else run into this? If so, does anyone have a fix other than Rebooting the host server?
I started duplicating some of the WMI-based module and turning them into CIM module using Powershell, but then I realized there are tons of them so I stopped. ;)
Information I've seen online says that the old WMI query method has been replaced by CIM queries since it works better, is more secure, etc. Does LM have any plans to migrated to what is apparently the newer standard?
Andrew Callaghan
·4 months agoYes its something we've seen. WMI just 'stops' after 20 mins and we need to reboot. We've noticed it mainly on 2025 builds and TBH , i thoroughly check WMI and its fine. In the end we just rebuild the server and its fixed but my suspicion is its related to firewall rules not always applying equally all the time.