Submit a ticketCall us

WebinarVisual Monitoring Tactics: Getting More Log Search Value from SolarWinds Log & Event Manager with nDepth Webcast

Do things seem to make more sense when they are visualized? Are you an IT professional or security expert with a wish for more cybersecurity tools that provide an intuitive visual experience? Join Alexis Horn and Jamie Hynds from SolarWinds as they demonstrate how the nDepth feature in LEM can help make visualizing log search results a reality.

Register now.

Home > Success Center > Orion Platform > Orion - Knowledgebase Articles > Orion Server UDP port exhaustion when monitoring WMI windows mount point

Orion Server UDP port exhaustion when monitoring WMI windows mount point

Updated 26th October 2018

Overview

The Orion server can experience port exhaustion when monitoring a very large number of WMI windows mount points on a WMI server(s).

 

Upon investigation, you can see in Windows Logs -> Applications and Services Logs -> Microsoft -> Windows -> WMI-Activity -> Operational, following error:

 

Id =

{4FBA8EAE-DC81-0018-3A55-BC4F81DCD301}

; ClientMachine = HOSTNAME; User = DOMAIN\USER; ClientProcessId = 43608; Component = Unknown; 
Operation = Start IWbemServices::ExecQuery - root\CIMV2 : associators of

{Win32_PnPEntity.DeviceID='DIGITS\1&7F6B424&0&36304376463030314242423532374534364235353431303030'}

where resultclass = Win32_SCSIController; ResultCode = 0x80041032; 
PossibleCause = Unknown

 

Used by MountPointDetailsPoller (V.Details.WMI.MountPoint) and NativeVolumeDetailsPoller (V.Details.WMI.MountPoint)

 

Some related errors from Core.Collector.Jobs logs (C:\ProgramData\SolarWinds\Logs\Orion\Core.Collector.Jobs_[ID])

 

ERROR SolarWinds.Orion.Pollers.Framework.PollerBase - (null) WMI Poller V.Status.WMI.MountPoint on IPAddress failed: Timed out Scope: IPAddress\root\CIMV2[\DOMAIN\USER] ErrorCode: 0x40004
2018-08-08 04:52:32,758 STP SmartThreadPool Thread #49 ERROR SolarWinds.Orion.Pollers.Framework.PollerBase - (null) Cannot poll mount point performance.
SolarWinds.Net.WMI.WmiResponseException: Scope: IPAddress\root\CIMV2[\DOMAIN\USER] ErrorCode: 0x80070102 ---> System.Runtime.InteropServices.COMException
at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo)
at System.Management.ManagementObjectCollection.ManagementObjectEnumerator.MoveNext()
at SolarWinds.Net.WMI.WmiDataReader.Read()
— End of inner exception stack trace —
at SolarWinds.Net.WMI.WmiDataReader.Read()
at SolarWinds.Orion.Core.Pollers.Volumes.WMI.LogicalDiskPerformanceDataHelper.ReadLogicalDiskPerfResult(IDataReader reader, VolumeWmiStatisticsResult result)
at SolarWinds.Orion.Core.Pollers.Volumes.WMI.MountPointStatisticsPoller.PollPerformanceData(WmiVolumePollerSetting pollerSettings, VolumeWmiStatisticsResult result)
at SolarWinds.Orion.Core.Pollers.Volumes.WMI.MountPointStatisticsPoller.DoPoll(WmiVolumePollerSetting pollerSettings)

Environment

  • Orion Core all versions
  • A large number of WMI monitored windows mount points

Cause

  • WMI query times out using up all the available the ports

Resolution

  • Try instead using the SolarWinds agent when polling many windows mount points on a windows server.
     
  • If this node has to be monitored via WMI (For Example, if it is Hyper V and monitored using VMAN)
     

You will need to make a global change on the polling engine level to work around this issue.
 

On polling engine that polls this node:
 

1) Backup SolarWinds.Orion.Core.Pollers.dll.config

2) Edit and add the following line to increase all WMI request timeouts to 7 minutes:

<add key="WmiQueryTimeout" value="7:00" />

3) Backup SolarWinds.Orion.Core.Collector.dll.config (to the desktop, outside of the SW directory),

4) Edit and modify line with WmiVolumeStatisticsJobTimeout to increase all WMI statistics job timeouts to 7 minutes:

<add key="WmiVolumeStatisticsJobTimeout" value="00:07:00" />

5) Shutdown all Orion services.

6) Replace SDF on collector:

a) Browse to: C:\ProgramData\SolarWinds\Collector\Data
b) Delete PollingController.sdf
c) Copy and rename the blank to
d) PollingController.sdf
e) Right Click and properties
f) Uncheck read only.

7) Replace SDF on job engine v2:

a) Browse to: C:\ProgramData\SolarWinds\JobEngine.v2\Data
b) Delete JobEngine35.sdf
c) Copy and rename the blank to
d) JobEngine35.sdf
e) Right Click and properties
f) Uncheck read only.

8) Start all Orion services.

 
Last modified

Tags

Classifications

Public