|
Managing Windows with WMI
Michael Maston
Microsoft Corporation
November 1999
Summary: Introduces Microsoft® Windows® Management Instrumentation, part of Windows 2000 (but available for Windows 95, Windows 98, and Windows NT® 4.0), which is designed to help you manage your enterprise systems, applications, and networks as they become larger and more complex. (15 printed pages)
Contents
Introduction
List All Services on the System
List Automatic Services That Are Stopped
Listing All Drive Partitions with Less Than 20 Percent Free Space
Setting the Operating System Boot Delay
Backing Up the Application Event Log
Reboot a Remote Machine
Launch Notepad Through WMI
Collecting Windows NT Log Events in WMI
Collecting High CPU Utilization Events
Conclusion
Introduction
The goal of this article is to introduce Microsoft® Windows® Management Instrumentation (WMI) and get you up and running as quickly as possible, using it to manage your system through the WMI scripting interface. Before diving into what WMI can do, including several useful examples, we first need a little background in what WMI is, how it came about, and why it is valuable.
One of the greatest challenges facing information technology managers is managing enterprise systems, applications, and networks as they become larger and more complex. In order to help solve these problems and reduce the total cost of ownership (TCO) of Windows-based servers and desktops, Microsoft has developed Windows Management Instrumentation (WMI), a scalable management infrastructure, and included it as part of Windows 2000. WMI is based on the Web-based Enterprise Management (WBEM) initiative and the Common Information Model (CIM) adopted by the Distributed Management Task Force (DMTF) (see the "DMTF, CIM, WBEM, and WMI" sidebar at http://www.msdn.microsoft.com/voices/news/wmisidebar2.asp ). WMI includes the managed objects defined by CIM as well as extensions to the CIM model for additional information available from the Windows platform.
What this all means is that WMI makes Windows 2000 extremely manageable using a single consistent, standards-based, extensible and object-oriented interface. Also, any application or script accessing WMI data can do so on the local machine or remotely in a seamless way. And, it''''s not only for Windows 2000—WMI is available for Windows 95, Windows 98, and Windows NT® 4.0. There are several key features in WMI that will be valuable in solving the complex management tasks IT administrators are challenged with today:
- Uniform Scripting API. All managed objects are defined under a common object framework based on the CIM object model. Scripts only need to use a single API, WMI, to access information for numerous disparate sources.
- Remote Administration. Objects managed within WMI are by definition available to applications and scripts both locally and remotely. No additional work is needed to manage remote objects.
- Discoverability and Navigation. Applications and scripts are able to discover what information is available about a system by enumerating the classes that are available. Relationships between related objects can be detected and traversed to see how one managed entity affects another.
- Query Capability. WMI treats its managed data much like a relational database and allows for SQL queries to be submitted in order to filter and focus requests for data to only that of interest.
- Powerful Event Publication and Subscription. Events can be requested for virtually any change in the managed objects in the system, regardless of whether they support an internal event capability. Event subscribers are able to request notification of very specific events based on their particular interests rather than only being able to get events that were predefined by the original developers. Also, a very flexible architecture allows virtually any user-defined action to be taken upon the receipt of a given event.
Let''''s first take a look at WMI from an architectural perspective. Figure 1 describes the three-layer model WMI uses, which consists of providers, the CIM Object Manager (CIMOM), and consumers of WMI information.
If your browser does not support inline frames, click here to view on a separate page.
Figure 1 WMI architecture
Working from the lowest level upward, the first tier is the provider. Simply put, a provider is an intermediate agent between the system to be managed (for example, operating system, service, application, device driver, and so on) and the CIM object manager. The job of a provider is to extract management information from the underlying data source using whatever interfaces that software presents for management. The management information and interfaces are then mapped by the provider into the object classes that WMI presents to WMI consumers. Moving forward, new and updated managed systems will use providers as a direct way to expose management APIs without significant intermediate conversions.
Next is CIMOM, the CIM Object Manager, which has its own storage repository and acts as a broker for object requests. CIMOM and its repository are represented on the system by the system service called WinMgmt. Providers plug into CIMOM via a published set of COM interfaces. CIMOM keeps track of what classes are available (their definitions are stored in the repository) and what provider is responsible for supplying instances of those classes. When a request for management information comes from a WMI consumer to CIMOM, it evaluates the request, identifies which provider has the information, and upon getting it returns the data to the consumer. The consumer only needs to ask for the information it wants but at no time needs to know the exact source of it or any details of how it is extracted from the underlying API. It should be noted that static data can be stored in the repository and retrieved without a provider, but the real power of the WMI system is that it supplies dynamic information about the managed system, and this is done entirely through providers.
Finally, there are consumers of WMI data. These can be management tools such as MMC snap-ins, management applications like Microsoft Systems Management Server (SMS) or third-party applications or scripts. These consumers, as previously noted, only need to know about the classes of the objects about which they wish to get information. The details of where the information comes from and how it is actually obtained are hidden and not relevant. In this way, an application or script can write to one common API, WMI, and get a wealth of information about the computer, operating system, applications, devices, and even information available via other management protocols like SNMP and DMI.
Before getting into some examples of using WMI, we should spend a moment on what sorts of things are possible to do through the management classes WMI provides. There are several types of information that can be defined in WMI classes:
- Properties. These supply descriptive or operational information about a particular instance of a class. For example, the instance of Win32_DiskDrive class defines a property called InterfaceType, which has the value of "IDE" on my C: drive.
- Methods. For a given instance of a class, these are actions you can execute upon that instance. For example, the Win32_Directory class includes a method called Compress() that allows the contents of a folder to be compressed in the same way as can be done through the Windows graphical user interface.
- Events. These are notifications a consumer can request to receive for interesting occurrences or failures in the system. Any change to a defined property can be used as the basis of an event. For example, the LoadPercentage property of the Win32_Processor class can be used to request an event whenever CPU utilization is measured to be greater than 50 percent. Events can also be provided without being based on a particular property.
- Associations. An association describes a relationship between classes and is in itself defined by a class. An example of an association is the Win32_POTSModemToSerialPort class that contains references to the instances of a dialup modem and the communications port to which it is connected. This is an extremely powerful concept, because it allows management information about an entire system of related components to be viewed and traversed for tasks such as troubleshooting.
The latest version of WMI, shipped with Windows 2000 and available for all other Windows operating systems, includes several providers that expose a rich set of instrumentation for many parts of the system. These providers include:
|
注：本站部分文章源于互联网，版权归原作者所有！如有侵权，请原作者与本站联系，本站将立即删除！ 本站文章除特别注明外均可转载，但需注明出处！ [MinTao学以致用网] 
