Extentsion 2.0 WMI collect string

[henk_stobbe]

Hello,

Would this be an improvement (RFE), or to far fetched?

Make possible for the WMI 2.0 extension to also collect strings and or arrays . This would make Dynatrace also a great inventory tool. So collect every 60 minutes like below,

Just a thought, please comment (-;

KR Henk

[Mike_L]

It wouldn't fit in our metrics database as that one expects a number. It could potentially go into the log ingest though?

@dglugla , raise an RFE or is something similar already going to be possible based on what you've got planned?

[dglugla · Accepted solution]

If the data can be fetched via a standard WMI query - we can already store it via log ingest. See example usage in MS Exchange extension.

But I would also ask if the data is more an event, or rather entity attribute? For example: BIOS seems to fit more like an attribute of a host. While it can be reported either as an event, or a metric dimension (not a value though), it all comes down to where should it be presented: as a log line, or host entity attribute?

QFEs on the other hand are a great example of log events.

In any case - WMI exts already supports any of those.

Sample YAML section:

      - subgroup: ExchangeLogEvents
        featureSet: events
        interval:
          minutes: 1
        query: SELECT SourceName, EventCode, RecordNumber, CategoryString, Message, Type, TimeGenerated FROM Win32_NTLogEvent WHERE Logfile='[MS]Exchange Management' OR SourceName LIKE '%[MS]Exchange%'
        type: logfileEvent
        dimensions:
          - key: source
            value: column:SourceName
          - key: dt.event.key
            value: column:EventCode
          - key: category
            value: column:CategoryString
          - key: content
            value: column:Message
          - key: status
            value: column:Type
          - key: recordno
            value: column:RecordNumber
          - key: timestamp
            value: $timestamp(const:ntlog, column:TimeGenerated)

[henk_stobbe]

Both, thanks for your reply, small question, what are QFE's? 

[Mike_L]

The second command you pasted into your question? 🙂 

[henk_stobbe]

Oeps.... I did it again😞

[Mike_L]

Yes, stop playing with my heart 😂