<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 12 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:black;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;
color:black;}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body bgcolor=white lang=EN-AU link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='color:#1F497D'>Scot,</span><b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'><o:p></o:p></span></b></p><p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'><o:p> </o:p></span></b></p><p class=MsoNormal style='margin-left:36.0pt'><span lang=EN-US style='color:#1F497D'>One other thing… I noticed that whenever the PS client runs it takes the CPU up to 100% for 5-15 seconds or so on many of the systems it's installed on. I'm already getting push back from other systems admins because of that. I imagine many people will be complaining about it sooner or later, that's kind of a bad thing. </span><span lang=EN-US style='font-family:Wingdings;color:#1F497D'>J</span><span lang=EN-US style='color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>The CPU spike could be the event log reporting – I don’t actually use that part of the client myself (there is a switch to disable event log reporting completely). Get-EventLog cmdlet is very braindead and scans the entire event log every time it runs (the –since “filter” does not use any indexing as far as I can tell on any version of Windows). I forward my event logs with SNARE to a central syslog server and then use winevtmsgs which I have added to xymonton. I did have a go at using .Net to properly “tail” the event logs, but didn’t get that finished to add to the client. Might take another look at that when I get a chance.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'>David.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='color:#1F497D'><o:p> </o:p></span></p><div><p class=MsoNormal><span lang=EN-US style='font-family:"Arial","sans-serif";color:#1F497D'>Scot Kreienkamp<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial","sans-serif";color:#1F497D'>Senior Systems Engineer<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial","sans-serif";color:#1F497D'>skreien@la-z-boy.com<o:p></o:p></span></p></div><p class=MsoNormal><span lang=EN-US style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'>From:</span></b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'> David Baldwin [mailto:david.baldwin@ausport.gov.au] <br><b>Sent:</b> Monday, May 09, 2011 9:31 PM<br><b>To:</b> Scot Kreienkamp; xymon@xymon.com<br><b>Subject:</b> Re: [Xymon] Windows PS client svcs data missing<o:p></o:p></span></p></div></div><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US>On 10/05/11 2:09 AM, Scot Kreienkamp wrote: <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Hi everyone,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>I've run into a problem with the Windows Powershell client intermittently omitting service data on Win2008. Here's the relevant parts of the client data file:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Microsoft Windows Server 2008 R2 Standard (build 7600)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>---snip---<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Persistent Routes:<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> None<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>[ifstat]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>fe80::619f:8c8:bf22:6ca5%11 2254617444 2999570366<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>10.100.1.211 2254617444 2999570366<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>::1 0 0<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>127.0.0.1 0 0<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>[svcs]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Name StartupType Status DisplayName<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>[uptime]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>sec: 8168297<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>94 days 12 hours 58 minutes 17 seconds<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Bootup: 20110203213923.713291-360<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>[who]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>SESSIONNAME USERNAME ID STATE TYPE DEVICE<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>---snip---<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>As you can see, the svcs portion is empty. I already updated the client to the latest PS client files available and it still is happening. I'm not a programmer so I'm not sure how I can help troubleshoot this, but I'm willing to help in any way I can.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif"'>services information is gathered from WMI. The builtin powershell "get-services" doesn't return sufficient information.<br><br>Try the following:<br><br>open a powershell window (powershell.exe lives in C:\WINDOWS\system32\windowspowershell\v1.0)<br><br>Get-WmiObject -Class Win32_Service<br><br>Try running it a few times. Is it slow, or does it sometimes not return any information?<br><br>Also, if you look at the Client data report (link at the bottom of various pages - cpu, disk, procs, svcs), do you see sections for [WMI:Win32...] towards the bottom of the report. There should be:<o:p></o:p></span></p><pre><span lang=EN-US>WMI:Win32_OperatingSystem<o:p></o:p></span></pre><pre><span lang=EN-US>WMI:Win32_ComputerSystem<o:p></o:p></span></pre><pre><span lang=EN-US>WMI:Win32_BIOS<o:p></o:p></span></pre><pre><span lang=EN-US>WMI:Win32_Processor<o:p></o:p></span></pre><pre><span lang=EN-US>WMI:Win32_PhysicalMemory<o:p></o:p></span></pre><pre><span lang=EN-US>WMI:Win32_LogicalDisk<o:p></o:p></span></pre><pre><span lang=EN-US>WMI:Win32_QuickFixEngineering<o:p></o:p></span></pre><pre><span lang=EN-US>WMI:Win32_Product<o:p></o:p></span></pre><pre><span lang=EN-US><o:p> </o:p></span></pre><p class=MsoNormal style='margin-bottom:12.0pt'><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif"'>If these are missing there may be a problem with the WMI service. Try restarting it in the first instance.<br><br>David.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>Thanks!<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial","sans-serif"'>Scot Kreienkamp</span><span lang=EN-US><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial","sans-serif"'><a href="mailto:skreien@la-z-boy.com">skreien@la-z-boy.com</a></span><span lang=EN-US><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:8.0pt;font-family:"Arial","sans-serif";color:gray'>This message is intended only for the individual or entity to which it is addressed. It may contain privileged, confidential information which is exempt from disclosure under applicable laws. If you are not the intended recipient, please note that you are strictly prohibited from disseminating or distributing this information (other than to the intended recipient) or copying this information. If you have received this communication in error, please notify us immediately by e-mail or by telephone at the above number. Thank you. </span><span lang=EN-US><o:p></o:p></span></p><p class=MsoNormal style='margin-bottom:12.0pt'><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif"'><br><br><o:p></o:p></span></p><pre><span lang=EN-US>-- <o:p></o:p></span></pre><pre><span lang=EN-US>David Baldwin - IT Unit<o:p></o:p></span></pre><pre><span lang=EN-US>Australian Sports Commission <a href="http://www.ausport.gov.au">www.ausport.gov.au</a><o:p></o:p></span></pre><pre><span lang=EN-US>Tel 02 62147830 Fax 02 62141830 PO Box 176 Belconnen ACT 2616<o:p></o:p></span></pre><pre><span lang=EN-US><a href="mailto:david.baldwin@ausport.gov.au">david.baldwin@ausport.gov.au</a> Leverrier Street Bruce ACT 2617<o:p></o:p></span></pre><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif"'><o:p> </o:p></span></p><div class=MsoNormal align=center style='text-align:center'><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif"'><hr size=2 width="100%" align=center></span></div><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif"'>Keep up to date with what's happening in Australian sport visit <a href="http://www.ausport.gov.au">www.ausport.gov.au</a> <br><br></span><span lang=EN-US style='font-size:7.5pt;font-family:"Arial","sans-serif"'>This message is intended for the addressee named and may contain confidential and privileged information. If you are not the intended recipient please note that any form of distribution, copying or use of this communication or the information in it is strictly prohibited and may be unlawful. If you receive this message in error, please delete it and notify the sender.</span><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif"'> <o:p></o:p></span></p><div class=MsoNormal align=center style='text-align:center'><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif"'><hr size=2 width="100%" align=center></span></div><p class=MsoNormal><span lang=EN-US> <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:8.0pt;font-family:"Arial","sans-serif";color:gray'>This message is intended only for the individual or entity to which it is addressed. It may contain privileged, confidential information which is exempt from disclosure under applicable laws. If you are not the intended recipient, please note that you are strictly prohibited from disseminating or distributing this information (other than to the intended recipient) or copying this information. If you have received this communication in error, please notify us immediately by e-mail or by telephone at the above number. Thank you. <o:p></o:p></span></p></div></body></html>