topic Re: Extentsion 2.0 WMI collect string in Extensions

Extension 2.0 WMI collect string

henk_stobbe — Thu, 05 Jun 2025 13:36:01 GMT

Hello,

Would this be an improvement (RFE), or to far fetched?

Make possible for the WMI 2.0 extension to also collect strings and or arrays. This would make Dynatrace also a great inventory tool. So collect every 60 minutes like below,

Just a thought, please comment (-;

KR Henk

Re: Extentsion 2.0 WMI collect string

Mike_L — Wed, 23 Feb 2022 09:41:08 GMT

It wouldn't fit in our metrics database as that one expects a number. It could potentially go into the log ingest though?

@dglugla , raise an RFE or is something similar already going to be possible based on what you've got planned?

Re: Extentsion 2.0 WMI collect string

dglugla — Wed, 23 Feb 2022 10:13:08 GMT

If the data can be fetched via a standard WMI query - we can already store it via log ingest. See example usage in MS Exchange extension.

But I would also ask if the data is more an event, or rather entity attribute? For example: BIOS seems to fit more like an attribute of a host. While it can be reported either as an event, or a metric dimension (not a value though), it all comes down to where should it be presented: as a log line, or host entity attribute?

QFEs on the other hand are a great example of log events.

In any case - WMI exts already supports any of those.

Sample YAML section:

- subgroup: ExchangeLogEvents featureSet: events interval: minutes: 1 query: SELECT SourceName, EventCode, RecordNumber, CategoryString, Message, Type, TimeGenerated FROM Win32_NTLogEvent WHERE Logfile='[MS]Exchange Management' OR SourceName LIKE '%[MS]Exchange%' type: logfileEvent dimensions: - key: source value: column:SourceName - key: dt.event.key value: column:EventCode - key: category value: column:CategoryString - key: content value: column:Message - key: status value: column:Type - key: recordno value: column:RecordNumber - key: timestamp value: $timestamp(const:ntlog, column:TimeGenerated)

Re: Extentsion 2.0 WMI collect string

henk_stobbe — Wed, 23 Feb 2022 10:29:11 GMT

Both, thanks for your reply, small question, what are QFE's?

Re: Extentsion 2.0 WMI collect string

Mike_L — Wed, 23 Feb 2022 10:30:38 GMT

The second command you pasted into your question? 🙂

Re: Extentsion 2.0 WMI collect string

henk_stobbe — Wed, 23 Feb 2022 10:35:06 GMT

Oeps.... I did it again😞

Re: Extentsion 2.0 WMI collect string

Mike_L — Wed, 23 Feb 2022 10:38:55 GMT

Yes, stop playing with my heart 😂

Re: Extentsion 2.0 WMI collect string

tarjei — Fri, 02 Sep 2022 12:30:50 GMT

Do you have more examples for Event log monitoring using WMI Extension 2.0?

How would you store the latest position read in the eventlog? Or dont you do that?

Second, how would you alert on something that only occurs once?

Re: Extentsion 2.0 WMI collect string

dglugla — Tue, 18 Oct 2022 07:19:30 GMT

@tarjei you don't need to do that. The WMI DataSource fetches only the entries that were written to the eventlog since the previous read.

Regarding alerting on single occurrence: what do you mean by that? If that's about a single occurrence in a single fetch (1 minute period) then you just simply configure an alert on that event. In other cases (single occurrence over a longer time period) you may introduce your own metric extracted of that type of en event and set up an alert on that metric.

The MS Exchange extension is currently the only one that leverages that capability, but if you see a potential in another extension - please share the details and I'm sure we'll be able to help.

Re: Extentsion 2.0 WMI collect string

tarjei — Wed, 02 Nov 2022 15:08:18 GMT

I was thinking where there is an alert where a "Backup job failed" or a disk event id 55. Cases where there might be one event, and no repeats.
How do we configure this alert on one event?

Re: Extentsion 2.0 WMI collect string

tarjei — Mon, 28 Nov 2022 12:28:01 GMT

Hi @dglugla! Any chance that this functionality will be documented soon?
We are trying to implement this in our plugin, but it is behaving strangely. And without any documentation it is quite difficult.

Re: Extentsion 2.0 WMI collect string

dglugla — Tue, 29 Nov 2022 14:05:48 GMT

Let me ask the doc team for that (FYI: @jaroslaw_orlows)

Re: Extentsion 2.0 WMI collect string

36Krazyfists — Tue, 27 May 2025 18:33:19 GMT

So wait, the WMI Extension can change WMI Queries to logs? Where is this in the documentation? I don't see it anywhere.

If so, this really needs to be documented (or documented better if it is hidden in there somewhere) as this is kind of a big deal.

And like, what other extensions can create log entries like this? I know the SQL one can do that (again, I don't believe that is documented either. I discovered it via the Custom Extensions Creator, but it isn't in the actual SQL Extensions 2.0 documentation that I could find...).