Network Management

Optional Pause Mechanism for Hung WMI Nodes

An optional pause mechanism for WMI-polled nodes is implemented in SolarWinds Platform 2025.4.

First published date

10/16/2025 10:21 PM

Last published date

10/16/2025 10:21 PM

Overview

In some customer environments, repeated Windows Management Instrumentation (WMI) connection attempts to unresponsive devices can cause rapid exhaustion of TCP ports on the polling server. This issue is commonly associated with the error code 0x80010002 (RPC_E_CALL_CANCELED), which indicates that the remote machine has canceled the RPC call. Such errors often result from WMI provider crashes or overload of the RPC Service (RPCSS).
 
To address this, an optional pause mechanism has been implemented. This feature allows users to enable a pause in polling when specific WMI error codes are detected. This prevents continuous connection attempts to hung devices and thereby avoids TCP port exhaustion on the SolarWinds Self-Hosted (OSH) poller server.
 

A new Advanced (Centralized) Setting has been introduced with the following parameters:

  • WMIErrorPauseDurationMinutes: Duration of the pause in minutes. Default is 0, which means the pause feature is disabled.
  • WMIErrorPauseTriggerCodes: Comma-separated list of WMI error codes that trigger the pause. Default is 0x80010002.

When a configured error code is detected during WMI polling for 3 consecutive poll cycles on a device, the system will pause further polling attempts only for that affected device for the duration specified by WMIErrorPauseDurationMinutes.

All pause events are logged with the following details for troubleshooting and visibility:

  • Device identifier
  • Error code that triggered the pause
  • Pause duration

The pause mechanism is disabled by default and must be explicitly enabled by configuring the centralized settings. See Access the Advanced Configuration settings in the SolarWinds Platform Web Console.

Product section

Orion Platform

Resolution

To proactively monitor devices that enter a hung WMI state, you can create a custom SAM (Server & Application Monitor) component monitor that detects these paused/hung nodes and triggers alerts. This enables timely intervention, such as restarting the affected WMI service or device. Below is an example of a configured component monitor:

 

  1. Create the custom SAM component monitor using the below PowerShell script.
$category = "SolarWinds: Windows Hung Connection Benchmarks" $counter = "HungConnectionDetected" # Retrieve all instances (IP addresses) in the category $instances = [System.Diagnostics.PerformanceCounterCategory]::new($category).GetInstanceNames() $hungIps = @() foreach ($ip in $instances) { try { $value = (Get-Counter "\$category($ip)\$counter").CounterSamples.CookedValue if ($value -eq 1) { $hungIps += $ip } } catch { Write-Verbose "Failed to read counter for $ip" } } if ($hungIps.Count -gt 0) { Write-Output " Statistic.HangedConnections: 1" Write-Output " Message.HangedConnections: $($hungIps -join ', ')" } else { Write-Output " Statistic.HangedConnections: 0" }
  1. Assign the component monitor to the target node(s) where you want to detect hung WMI connections.
  2. Navigate to Alerts & Activity > Alerts > Manage Alerts > New Alert and configure an alert based on the component monitor’s output to notify administrators when a hung connection is detected.

  1. Obtain the Component ID from the PowerShell component details page URL to use in alert configuration.