Monitoring File Size with Custom WMI Performance Counter

Have you ever needed to monitor the size of a file to ensure you were alerted when it’s size changed beyond certain values?  I had to help address this recently and at first glance, this may seem to be a good job for a script – and a script definitely could be used.  Scripts are great but I like to avoid them when I can and this is a perfect scenario for using a custom WMI performance counter.  After all, tracking a threshold is ultimately what we are after.  So how can this be done?  I wrote a sample monitor and rule to demonstrate.   Let’s walk through the monitor since both are similar – the reason for both is that a monitor will track live data but will not collect it; a rule collects performance data.

The first things is to configure the WMI query to specify which file we want to monitor and the properties.  We can do this through a very simple WMI query to the root\cimv2 namespace as shown below.  All files on a system can be accessed using this same query, Just change the filename and modify the properties being monitored if interested in something other than filesize.  For this example, I chose the pagefile.sys.

So we have the data through the WMI query, now we need to map this data and use it to create a custom performance counter.  We do that on the performance mapper screen as shown below.  Note that the Counter name and value name match.

For a rule, thats all you need to configure.  For a monitor, we need to specify the thresholds where we want to generate alerts.  This is done on the Threshold Range page.

We also need to map our thresholds to the appropriate health state.

And decide whether or not to alert.  With all of this configured, we are in business!  After our rule starts to run for a while we will see performance data start to show up for the custom counter.

Comments

• Anonymous
  December 10, 2011
  I am getting the following error, any thoughts. Seems pretty straightforward. Running against Windows Server 2008 server. The actual query in the rule is select FileSize from CIM_DataFile where name='C:FileSizefilesizetest.txt' but in the error it shows: Object enumeration failed Query: 'select FileSize from CIM_DataFile where name='C:FileSizefilesizetest.txt'' HRESULT: 0x80041017 Thoughts?

• Anonymous
  January 24, 2012
  Greetings,  First, thanks for the great post. I've tried this method both as a rule and as a monitor and I have two issues. First, I get a type mismatch on the $Data/Property value. Second, I get an alert because the WMI query is not an event query. Thoughts? Thanks for your time, Ron Hagerman

• Anonymous
  October 29, 2014
  Hi Steve Rachui, I have confusion in creating the file size monitor, can you please help me by giving the elaborate steps to create this monitor thanks in advance regards Shashikanth