Search code examples
c#perlwmisnmpauditing

Monitoring Bandwith on a remote machine with WMI


I am trying to monitor interfaces bandwidth on a remote Windows machine. So far I used SNMP with the Cisco Bandwidth Formula but that requires to retrieve two samples at two different times. Last but not least it seems that the value I record with SNMP is quite wrong. Since I have WMI support I'd like to use it but the only value I've found (which seems to be what I'm looking for) is BytesTotalPerSec of the Win32_PerfRawData_Tcpip_NetworkInterface. That value however looks more like a total counter (just like the SNMP one). Is there a way to retrieve the instant current bandwidth through WMI? To clarify the Current Bandwidth field always return 1000000000 (which is the Maximum Bandwidth) and as you can imagine it is not helpful.


Solution

  • Performance counter data is exposed in 2 places, Win32_PerfRawData* and Win32_PerfFormattedData*. The former contains raw data, the latter contains derived statistics, and is what you're after.

    What you typically see in perfmon (for example) is the Win32_PerfFormattedData* data.

    Try this :

    Set objWMI = GetObject("winmgmts://./root\cimv2")
    set objRefresher = CreateObject("WbemScripting.Swbemrefresher")
    Set objInterfaces = objRefresher.AddEnum(objWMI, _
      "Win32_PerfFormattedData_Tcpip_NetworkInterface").ObjectSet
    
    While (True)
        objRefresher.Refresh
        For each RefreshItem in objRefresher
    
            For each objInstance in RefreshItem.ObjectSet
                WScript.Echo objInstance.Name & ";" _
                  & objInstance.BytesReceivedPersec & ";" _
                  & objInstance.BytesSentPersec
    
            Next
    
        Next
        Wscript.Echo
        Wscript.Sleep 1000
    Wend
    

    From experience, taking a measurement for a given second is pretty useless unless you're collecting the metric every second.

    If you wanted the minutely bandwidth, you could derive it yourself from the raw data by taking 2 samples (you have to do this on Windows 2000 anyway)

    See the windows 2000 section here if that makes more sense.

    Derived stats on Windows 2000

    There's an excellent article here Make your own Formatted Performance Data Provider

    If you wanted to delve into collecting more statistical information over a longer sampling interval

    John