<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:black;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";
color:black;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;
color:black;}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle21
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";
color:black;}
span.EmailStyle24
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body bgcolor=white lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='color:#1F497D'>David,<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>I don't really need the event reporting, it's just a nice-to-have. I'll try disabling it and see if it reduces the load. <o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><p class=MsoNormal><span style='font-family:"Arial","sans-serif";color:#1F497D'>Scot Kreienkamp<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Arial","sans-serif";color:#1F497D'>Senior Systems Engineer<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Arial","sans-serif";color:#1F497D'>skreien@la-z-boy.com<o:p></o:p></span></p></div><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'> David Baldwin [mailto:David.Baldwin@ausport.gov.au] <br><b>Sent:</b> Monday, May 16, 2011 12:53 AM<br><b>To:</b> Scot Kreienkamp; xymon@xymon.com<br><b>Subject:</b> RE: [Xymon] Windows PS client svcs data missing<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span lang=EN-AU style='color:#1F497D'>Scot,</span><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'><o:p></o:p></span></b></p><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'><o:p> </o:p></span></b></p><p class=MsoNormal style='margin-left:.5in'><span style='color:#1F497D'>One other thing… I noticed that whenever the PS client runs it takes the CPU up to 100% for 5-15 seconds or so on many of the systems it's installed on. I'm already getting push back from other systems admins because of that. I imagine many people will be complaining about it sooner or later, that's kind of a bad thing. </span><span style='font-family:Wingdings;color:#1F497D'>J</span><span style='color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>The CPU spike could be the event log reporting – I don’t actually use that part of the client myself (there is a switch to disable event log reporting completely). Get-EventLog cmdlet is very braindead and scans the entire event log every time it runs (the –since “filter” does not use any indexing as far as I can tell on any version of Windows). I forward my event logs with SNARE to a central syslog server and then use winevtmsgs which I have added to xymonton. I did have a go at using .Net to properly “tail” the event logs, but didn’t get that finished to add to the client. Might take another look at that when I get a chance.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>David.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><p class=MsoNormal><span style='font-family:"Arial","sans-serif";color:#1F497D'>Scot Kreienkamp<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Arial","sans-serif";color:#1F497D'>Senior Systems Engineer<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Arial","sans-serif";color:#1F497D'><a href="mailto:skreien@la-z-boy.com">skreien@la-z-boy.com</a><o:p></o:p></span></p></div><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'> David Baldwin [mailto:david.baldwin@ausport.gov.au] <br><b>Sent:</b> Monday, May 09, 2011 9:31 PM<br><b>To:</b> Scot Kreienkamp; xymon@xymon.com<br><b>Subject:</b> Re: [Xymon] Windows PS client svcs data missing<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>On 10/05/11 2:09 AM, Scot Kreienkamp wrote: <o:p></o:p></p><p class=MsoNormal>Hi everyone,<o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>I've run into a problem with the Windows Powershell client intermittently omitting service data on Win2008. Here's the relevant parts of the client data file:<o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>Microsoft Windows Server 2008 R2 Standard (build 7600)<o:p></o:p></p><p class=MsoNormal>---snip---<o:p></o:p></p><p class=MsoNormal>Persistent Routes:<o:p></o:p></p><p class=MsoNormal> None<o:p></o:p></p><p class=MsoNormal>[ifstat]<o:p></o:p></p><p class=MsoNormal>fe80::619f:8c8:bf22:6ca5%11 2254617444 2999570366<o:p></o:p></p><p class=MsoNormal>10.100.1.211 2254617444 2999570366<o:p></o:p></p><p class=MsoNormal>::1 0 0<o:p></o:p></p><p class=MsoNormal>127.0.0.1 0 0<o:p></o:p></p><p class=MsoNormal>[svcs]<o:p></o:p></p><p class=MsoNormal>Name StartupType Status DisplayName<o:p></o:p></p><p class=MsoNormal>[uptime]<o:p></o:p></p><p class=MsoNormal>sec: 8168297<o:p></o:p></p><p class=MsoNormal>94 days 12 hours 58 minutes 17 seconds<o:p></o:p></p><p class=MsoNormal>Bootup: 20110203213923.713291-360<o:p></o:p></p><p class=MsoNormal>[who]<o:p></o:p></p><p class=MsoNormal>SESSIONNAME USERNAME ID STATE TYPE DEVICE<o:p></o:p></p><p class=MsoNormal>---snip---<o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>As you can see, the svcs portion is empty. I already updated the client to the latest PS client files available and it still is happening. I'm not a programmer so I'm not sure how I can help troubleshoot this, but I'm willing to help in any way I can.<o:p></o:p></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'>services information is gathered from WMI. The builtin powershell "get-services" doesn't return sufficient information.<br><br>Try the following:<br><br>open a powershell window (powershell.exe lives in C:\WINDOWS\system32\windowspowershell\v1.0)<br><br>Get-WmiObject -Class Win32_Service<br><br>Try running it a few times. Is it slow, or does it sometimes not return any information?<br><br>Also, if you look at the Client data report (link at the bottom of various pages - cpu, disk, procs, svcs), do you see sections for [WMI:Win32...] towards the bottom of the report. There should be:<o:p></o:p></span></p><pre>WMI:Win32_OperatingSystem<o:p></o:p></pre><pre>WMI:Win32_ComputerSystem<o:p></o:p></pre><pre>WMI:Win32_BIOS<o:p></o:p></pre><pre>WMI:Win32_Processor<o:p></o:p></pre><pre>WMI:Win32_PhysicalMemory<o:p></o:p></pre><pre>WMI:Win32_LogicalDisk<o:p></o:p></pre><pre>WMI:Win32_QuickFixEngineering<o:p></o:p></pre><pre>WMI:Win32_Product<o:p></o:p></pre><pre><o:p> </o:p></pre><p class=MsoNormal style='margin-bottom:12.0pt'><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'>If these are missing there may be a problem with the WMI service. Try restarting it in the first instance.<br><br>David.<o:p></o:p></span></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>Thanks!<o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal><span style='font-family:"Arial","sans-serif"'>Scot Kreienkamp</span><o:p></o:p></p><p class=MsoNormal><span style='font-family:"Arial","sans-serif"'><a href="mailto:skreien@la-z-boy.com">skreien@la-z-boy.com</a></span><o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal><span style='font-size:8.0pt;font-family:"Arial","sans-serif";color:gray'>This message is intended only for the individual or entity to which it is addressed. It may contain privileged, confidential information which is exempt from disclosure under applicable laws. If you are not the intended recipient, please note that you are strictly prohibited from disseminating or distributing this information (other than to the intended recipient) or copying this information. If you have received this communication in error, please notify us immediately by e-mail or by telephone at the above number. Thank you. </span><o:p></o:p></p><p class=MsoNormal style='margin-bottom:12.0pt'><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'><o:p> </o:p></span></p><pre>-- <o:p></o:p></pre><pre>David Baldwin - IT Unit<o:p></o:p></pre><pre>Australian Sports Commission <a href="http://www.ausport.gov.au">www.ausport.gov.au</a><o:p></o:p></pre><pre>Tel 02 62147830 Fax 02 62141830 PO Box 176 Belconnen ACT 2616<o:p></o:p></pre><pre><a href="mailto:david.baldwin@ausport.gov.au">david.baldwin@ausport.gov.au</a> Leverrier Street Bruce ACT 2617<o:p></o:p></pre><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'><o:p> </o:p></span></p><div class=MsoNormal align=center style='text-align:center'><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'><hr size=2 width="100%" align=center></span></div><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'>Keep up to date with what's happening in Australian sport visit <a href="http://www.ausport.gov.au">www.ausport.gov.au</a> <br><br></span><span style='font-size:7.5pt;font-family:"Arial","sans-serif"'>This message is intended for the addressee named and may contain confidential and privileged information. If you are not the intended recipient please note that any form of distribution, copying or use of this communication or the information in it is strictly prohibited and may be unlawful. If you receive this message in error, please delete it and notify the sender.</span><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'> <o:p></o:p></span></p><div class=MsoNormal align=center style='text-align:center'><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'><hr size=2 width="100%" align=center></span></div><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal><span style='font-size:8.0pt;font-family:"Arial","sans-serif";color:gray'>This message is intended only for the individual or entity to which it is addressed. It may contain privileged, confidential information which is exempt from disclosure under applicable laws. If you are not the intended recipient, please note that you are strictly prohibited from disseminating or distributing this information (other than to the intended recipient) or copying this information. If you have received this communication in error, please notify us immediately by e-mail or by telephone at the above number. Thank you. <o:p></o:p></span></p></div><FONT face=Tahoma size=2><FONT color=#0000ff></FONT></FONT>
<P class=MsoNormal style="MARGIN: 0in 0in 0pt"><SPAN style="FONT-SIZE: 8pt; COLOR: gray"><FONT face=Arial></FONT></SPAN> </P>
<P class=MsoNormal style="MARGIN: 0in 0in 0pt"><SPAN style="FONT-SIZE: 8pt; COLOR: gray"><FONT face=Arial></FONT></SPAN> </P>
<P class=MsoNormal style="MARGIN: 0in 0in 0pt"> </P>
<P class=MsoNormal style="MARGIN: 0in 0in 0pt"><SPAN style="FONT-SIZE: 8pt; COLOR: gray"><FONT face=Arial>This message is intended only for the individual or entity to which it is addressed. It may contain privileged, confidential information which is exempt from disclosure under applicable laws. If you are not the intended recipient, please note that you are strictly prohibited from disseminating or distributing this information (other than to the intended recipient) or copying this information. If you have received this communication in error, please notify us immediately by e-mail or by telephone at the above number. Thank you. <?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" /><o:p></o:p></FONT></SPAN></P><A title="gfidisc.la-z-boy.com" href="#"> </A></body></html>