You are not logged in. [Log In] KiXtart.org website » Forums » KiXtart » Advanced Scripting » Is mining information from WMI slow or is just me?
Register User       Forum List       Calendar       FAQ
Page 1 of 1 1
Topic Options
#139914 - 2005-05-18 07:13 PM Is mining information from WMI slow or is just me?
IanDubbelboer Offline
Fresh Scripter

Registered: 2004-06-25
Posts: 24
Hello!

I'm running into and issue which may be a result of a lack of understanding of WMI. I am trying to write a script to mine file version data from systems on the network. I have code which works but execution time seems really slow to me.

Here is the code block. I have lumped all the file queries together in a single WMI request because I hoped it would speed execution. It actually made no difference and runs the same speed as 26 individual WMI requests.

It takes about 15-19 seconds to run this code on a local system and about 40 -50 to run it on a remote LAN system.

I cannot detect a CPU or bandwidth bottleneck on either my system or the remote system. So why is it so dang slow!

Performing the same function with 26 individual \\system\c$\path\file checks takes about 3 - 5 seconds. But beats up the network. Any ideas what is wrong?

Code:
  
;;;;;;;;;;;
; Collecting file versions
;;;;;;;;;;;

$system=”.”

     $objWMIService = GetObject("winmgmts:\\"+$system+"\root\cimv2")

     $DataReturn = $objWMIService.ExecQuery("SELECT * FROM CIM_Datafile WHERE 
	Name = 'c:\\Program Files\\Internet Explorer\\IEXPLORE.EXE' OR 
	Name = 'c:\\winnt\\system32\\kernel32.dll' OR
	Name = 'c:\\Program Files\\Microsoft Office\\Office\\Excel.exe' OR
	Name = 'c:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA6\\Vbe6.dll' OR
	Name = 'c:\\winnt\\system32\\Rpcss.dll' OR
	Name = 'c:\\WINNT\\system32\\Msgsvc.dll' OR
	Name = 'c:\\WINNT\\system32\\Shlwapi.dll' OR
	Name = 'c:\\WINNT\\system32\\WKSSVC.DLL' OR
	Name = 'c:\\WINNT\\system32\\Msasn1.dll' OR
	Name = 'c:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Msconv97.dll' OR
	Name = 'c:\\WINNT\\system32\\inetcomm.dll' OR
	Name = 'c:\\WINNT\\system32\\msjtes40.dll' OR
	Name = 'c:\\WINNT\\system32\\Quartz.dll' OR
	Name = 'c:\\WINNT\\system32\\cryptdlg.dll' OR
	Name = 'c:\\WINNT\\system32\\Mstask.exe' OR
	Name = 'c:\\WINNT\\system32\\Itss.dll' OR
	Name = 'c:\\WINNT\\system32\\Shell32.dll' OR
	Name = 'c:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\Vgx.dll' OR
	Name = 'c:\\WINNT\\system32\\Mshtml.dll' OR
	Name = 'c:\\WINNT\\system32\\Hhctrl.ocx' OR
	Name = 'c:\\WINNT\\system32\\Sp3res.dll' OR
	Name = 'c:\\WINNT\\system32\\Ciodm.dll' OR
	Name = 'c:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\Dhtmled.ocx' OR
	Name = 'c:\\WINNT\\system32\\Hlink.dll' OR
	Name = 'c:\\WINNT\\system32\\Wmp.dll' OR
	Name = 'c:\\WINNT\\system32\\Drivers\\Tcpip.sys'",,48)

     For Each $DataObject in $DataReturn
      $ObjectName = $DataObject.Name
      SELECT
       CASE (INSTR($ObjectName, "c:\Program Files\Internet Explorer\IEXPLORE.EXE") <> 0)
        $test1 = $DataObject.Version
       CASE (INSTR($ObjectName, "c:\winnt\system32\kernel32.dll") <> 0)
        $test2 = $DataObject.Version
       CASE (INSTR($ObjectName, "c:\Program Files\Microsoft Office\Office\Excel.exe") <> 0)
        $test3 = $DataObject.Version
       CASE (INSTR($ObjectName, "c:\Program Files\Common Files\Microsoft Shared\VBA\VBA6\Vbe6.dll") <> 0)
        $test4 = $DataObject.Version
       CASE (INSTR($ObjectName, "c:\winnt\system32\Rpcss.dll") <> 0)
        $test5 = $DataObject.Version
       CASE (INSTR($ObjectName, "c:\WINNT\system32\Msgsvc.dll") <> 0)
        $test6 = $DataObject.Version
       CASE (INSTR($ObjectName, "c:\WINNT\system32\Shlwapi.dll") <> 0)
        $test7 = $DataObject.Version
       CASE (INSTR($ObjectName, "c:\WINNT\system32\WKSSVC.DLL") <> 0)
        $test8 = $DataObject.Version
       CASE (INSTR($ObjectName, "c:\WINNT\system32\Msasn1.dll") <> 0)
        $test9 = $DataObject.Version
       CASE (INSTR($ObjectName, "c:\Program Files\Common Files\Microsoft Shared\TextConv\Msconv97.dll") <> 0)
        $test10 = $DataObject.Version
       CASE (INSTR($ObjectName, "c:\WINNT\system32\inetcomm.dll") <> 0)
        $test11 = $DataObject.Version
       CASE (INSTR($ObjectName, "c:\WINNT\system32\msjtes40.dll") <> 0)
        $test12 = $DataObject.Version
       CASE (INSTR($ObjectName, "c:\WINNT\system32\Quartz.dll") <> 0)
        $test13 = $DataObject.Version
       CASE (INSTR($ObjectName, "c:\WINNT\system32\cryptdlg.dll") <> 0)
        $test14 = $DataObject.Version
       CASE (INSTR($ObjectName, "c:\WINNT\system32\Mstask.exe") <> 0)
        $test15 = $DataObject.Version
       CASE (INSTR($ObjectName, "c:\WINNT\system32\Itss.dll") <> 0)
        $test16 = $DataObject.Version
       CASE (INSTR($ObjectName, "c:\WINNT\system32\Shell32.dll") <> 0)
        $test17 = $DataObject.Version
       CASE (INSTR($ObjectName, "c:\Program Files\Common Files\Microsoft Shared\VGX\Vgx.dll") <> 0)
        $test18 = $DataObject.Version
       CASE (INSTR($ObjectName, "c:\WINNT\system32\Mshtml.dll") <> 0)
        $test19 = $DataObject.Version
       CASE (INSTR($ObjectName, "c:\WINNT\system32\Hhctrl.ocx") <> 0)
        $test20 = $DataObject.Version
       CASE (INSTR($ObjectName, "c:\WINNT\system32\Sp3res.dll") <> 0)
        $test21 = $DataObject.Version
       CASE (INSTR($ObjectName, "c:\WINNT\system32\Ciodm.dll") <> 0)
        $test22 = $DataObject.Version
       CASE (INSTR($ObjectName, "c:\Program Files\Common Files\Microsoft Shared\Triedit\dhtmled.ocx") <> 0)
        $test23 = $DataObject.Version
       CASE (INSTR($ObjectName, "c:\WINNT\system32\Hlink.dll") <> 0)
        $test24 = $DataObject.Version
       CASE (INSTR($ObjectName, "c:\WINNT\system32\Wmp.dll") <> 0)
        $test25 = $DataObject.Version
       CASE (INSTR($ObjectName, "c:\WINNT\system32\Drivers\Tcpip.sys") <> 0)
        $test26 = $DataObject.Version
       CASE 1
      ENDSELECT
     Next

? test1
? test2
? test3
? test4
? test5
? test6
? test7
? test8
? test9
? test10
? test11
? test12
? test13
? test14
? test15
? test16
? test17
? test18
? test19
? test20
? test21
? test22
? test23
? test24
? test25
? test26
Top
#139915 - 2005-05-18 07:41 PM Re: Is mining information from WMI slow or is just me?
NTDOC Administrator Offline
Administrator
*****

Registered: 2000-07-28
Posts: 11634
Loc: Space
Well I can tell you're using Word to at least post
$system=”.” ASCII does not produce curly quotes.

Anyways... Yes WMI is slower in general then a direct read of data.

When you say it beats up your Network what do you mean exactly. I mean yes you have 26 distinct packet calls plus normal traffic with direct reads, but the're all small packets. The WMI call is a smaller call overall but the timing is slower so I guess you have to decide for yourself which method is more acceptable to you.

You could try a different method of the WMI connect and provide credentials which might increase the speed a little.

Look up SWbemLocator connection method instead of using a moniker connecton.  
SWbemLocator.ConnectServer.ConnectServer

http://msdn.microsoft.com/library/defaul...nnectserver.asp
Top
#139916 - 2005-05-18 08:30 PM Re: Is mining information from WMI slow or is just me?
IanDubbelboer Offline
Fresh Scripter

Registered: 2004-06-25
Posts: 24
> Well I can tell you're using Word to at least post
Guilty as charged.

> When you say it beats up your Network what do you mean exactly?

Well Here is my old way of doing this test
Code:
 

$System = “127.0.0.1”

    $test1 = GETFILEVERSION("\\" + $system + "\c$\Program Files\Internet Explorer\IEXPLORE.EXE",FileVersion)
    $test2 = GETFILEVERSION("\\" + $system + "\c$\winnt\system32\kernel32.dll",FileVersion)
    $test3 = GETFILEVERSION("\\" + $system + "\c$\Program Files\Microsoft Office\Office\Excel.exe",FileVersion)
    $test4 = GETFILEVERSION("\\" + $system + "\c$\Program Files\Common Files\Microsoft Shared\VBA\VBA6\Vbe6.dll",FileVersion)
    $test5 = GETFILEVERSION("\\" + $system + "\c$\winnt\system32\Rpcss.dll",FileVersion)
    $test6 = GETFILEVERSION("\\" + $system + "\c$\WINNT\system32\Msgsvc.dll",FileVersion)
    $test7 = GETFILEVERSION("\\" + $system + "\c$\WINNT\system32\Shlwapi.dll",FileVersion)
    $test8 = GETFILEVERSION("\\" + $system + "\c$\WINNT\system32\WKSSVC.DLL",FileVersion)
    $test9 = GETFILEVERSION("\\" + $system + "\c$\WINNT\system32\Msasn1.dll",FileVersion)
    $test10 = GETFILEVERSION("\\" + $system + "\c$\Program Files\Common Files\Microsoft Shared\TextConv\Msconv97.dll",FileVersion)
    $test11 = GETFILEVERSION("\\" + $system + "\c$\WINNT\system32\inetcomm.dll",FileVersion)
    $test12 = GETFILEVERSION("\\" + $system + "\c$\WINNT\system32\msjtes40.dll",FileVersion)
    $test13 = GETFILEVERSION("\\" + $system + "\c$\WINNT\system32\Quartz.dll",FileVersion)
    $test14 = GETFILEVERSION("\\" + $system + "\c$\WINNT\system32\cryptdlg.dll",FileVersion)
    $test15 = GETFILEVERSION("\\" + $system + "\c$\WINNT\system32\Mstask.exe",FileVersion)
    $test16 = GETFILEVERSION("\\" + $system + "\c$\WINNT\system32\Itss.dll",FileVersion)
    $test17 = GETFILEVERSION("\\" + $system + "\c$\WINNT\system32\Shell32.dll",FileVersion)
    $test18 = GETFILEVERSION("\\" + $system + "\c$\Program Files\Common Files\Microsoft Shared\VGX\Vgx.dll",FileVersion)
    $test19 = GETFILEVERSION("\\" + $system + "\c$\WINNT\system32\Inseng.dll",FileVersion)

? test1
? test2
? test3
? test4
? test5
? test6
? test7
? test8
? test9
? test10
? test11
? test12
? test13
? test14
? test15
? test16
? test17
? test18
? test19


I have a bandwidth monitor installed and I found that the Total file is copied to your systems memory the version is extracted then the file is flushed. So if you check the version of 30 MB of files that is how much network traffic is generated.

> Look up SWbemLocator connection method instead of using a moniker connection.

Thanks I will check that out and report back with some results.
Top
#139917 - 2005-05-18 08:37 PM Re: Is mining information from WMI slow or is just me?
Kdyer Offline
KiX Supporter
*****

Registered: 2001-01-03
Posts: 6241
Loc: Tigard, OR
For your - c:\WINNT and your - ("\\" + $system + "\c$\WINNT..

You should replace with %windir% and ("\\" + $system + "\Admin$.., respectively. The thing is with Windows XP and Windows 2003, you will not see the WINNT folder.

Kent
_________________________
Utilize these resources:
UDFs (Full List)
KiXtart FAQ & How to's

Top
#139918 - 2005-05-18 08:41 PM Re: Is mining information from WMI slow or is just me?
NTDOC Administrator Offline
Administrator
*****

Registered: 2000-07-28
Posts: 11634
Loc: Space
Thanks... That is interesting in deed. Guess I never really looked at it or thought of it in terms like that. Have done only a couple version checks remotely and on a 100MB LAN the speed was quick.

Maybe a RemoteExecute method then, but that would have at least the same slow initial execution speed.

However there must be something else to the picture because using the MyComputerInfo script gets the version of hundreds of files and it certainly can't be loading the entire progam into memory just to read the version.

My Computer Info - for Help Desk use PART 4
 

Try running that script locally. (it doesn't support remotely running it) and see all the data it returns. I just ran it on my system that has almost 300 applications installed and it took 14 seconds to run it.
 
Top
#139919 - 2005-05-19 01:16 AM Re: Is mining information from WMI slow or is just me?
Sealeopard Offline
KiX Master
*****

Registered: 2001-04-25
Posts: 11165
Loc: Boston, MA, USA
You could also run the query asynchronously or optimize the WQL queries.
_________________________
There are two types of vessels, submarines and targets.

Top
#139920 - 2005-05-19 01:28 AM Re: Is mining information from WMI slow or is just me?
NTDOC Administrator Offline
Administrator
*****

Registered: 2000-07-28
Posts: 11634
Loc: Space
The queries might be able to be optimized, but don't think the speed will improve all that much. In my experience the connection is often the slow link in the puzzle, but other items such as Antivirus can really interfere as well if it thinks some rouge operation is taking place.

In any case, would be nice to hear back the results of further testing from IanDubbelboer
 
Top
#139921 - 2005-05-19 07:15 PM Re: Is mining information from WMI slow or is just me?
IanDubbelboer Offline
Fresh Scripter

Registered: 2004-06-25
Posts: 24
kdyer> For your - c:\WINNT and your - ("\\" + $system + "\c$\WINNT..

Yup you’re right. This is still test code I haven't done much in the way of best practices on it yet.

NTDOC> However there must be something else to the picture because using the MyComputerInfo script gets the version of hundreds of files and it certainly can't be loading the entire program into memory just to read the version.


Don't know what is going on there exactly. I can only comment on what my bandwidth meter reports. The execution speed is quick with the Non-WMI method, but I'm working with an intent to run this script on 200 - 300 systems, so I don't want to tie up the network if I can avoid it. This is what attracted me to the WMI method in the first place.

I did think about using the remote execution method, but I kind of wanted to avoid putting anything on the remote systems.

We are using McAfee for our virus scanner and local firewall so interference from that is a real possibility. I will try running with them disabled on my local system.

Changing to the SWbemLocator connection method did give me about a 10% speed boost. I'm happy to say. Still takes 13-15 local and 38-42 remote.

I'm digging through My Computer Info - for Help Desk use PART 4 to see if I can spot a difference in your requests.

>sealeopard You could also run the query asynchronously or optimize the WQL queries.

I did some research on how to run the query Asyn. Either I'm doing it wrong or it doesn't help. As for optimizing the query. How would I go about doing that?
Top
Page 1 of 1 1


Moderator:  Glenn Barnas, NTDOC, Arend_, Jochen, Radimus, Allen, ShaneEP, Ruud van Velsen, Mart 
Hop to:
Shout Box

Who's Online
0 registered and 1219 anonymous users online.
details
Newest Members
Viginette, ManuvdWielNL, Sir_Barrington, batdk82, StuTheCoder
17888 Registered Users
My Cookies · Mark all read Powered by UBB.threads™ Contact Us · KiXtart.org website · Top

Generated in 0.187 seconds in which 0.155 seconds were spent on a total of 12 queries. Zlib compression enabled.
Search the board with:
superb Board Search
or try with google:
Google
Web kixtart.org