11 Discovery using WMI queries

Overview

WMI is a powerful interface in Windows that can be used for retrieving various information about Windows components, services, state and software installed.

It can be used for physical disk discovery and their performance data collection, network interface discovery, Hyper-V guest discovery, monitoring Windows services and many other things in Windows OS.

This type of low-level discovery is done using WQL queries whose results get automatically transformed into a JSON object suitable for low-level discovery.

Item key

The item to use in the discovery rule is

  1. wmi.getall[<namespace>,<query>]

This item transforms the query result into a JSON array. For example:

  1. select * from Win32_DiskDrive where Name like '%PHYSICALDRIVE%'

may return something like this:

  1. [
  2.            {
  3.                "DeviceID" : "\\.\PHYSICALDRIVE0",
  4.                "BytesPerSector" : 512,
  5.                "Capabilities" : [
  6.                    3,
  7.                    4
  8.                ],
  9.                "CapabilityDescriptions" : [
  10.                    "Random Access",
  11.                    "Supports Writing"
  12.                ],
  13.                "Caption" : "VBOX HARDDISK ATA Device",
  14.                "ConfigManagerErrorCode" : "0",
  15.                "ConfigManagerUserConfig" : "false",
  16.                "CreationClassName" : "Win32_DiskDrive",
  17.                "Description" : "Disk drive",
  18.                "FirmwareRevision" : "1.0",
  19.                "Index" : 0,
  20.                "InterfaceType" : "IDE"
  21.            },
  22.            {
  23.                "DeviceID" : "\\.\PHYSICALDRIVE1",
  24.                "BytesPerSector" : 512,
  25.                "Capabilities" : [
  26.                    3,
  27.                    4
  28.                ],
  29.                "CapabilityDescriptions" : [
  30.                    "Random Access",
  31.                    "Supports Writing"
  32.                ],
  33.                "Caption" : "VBOX HARDDISK ATA Device",
  34.                "ConfigManagerErrorCode" : "0",
  35.                "ConfigManagerUserConfig" : "false",
  36.                "CreationClassName" : "Win32_DiskDrive",
  37.                "Description" : "Disk drive",
  38.                "FirmwareRevision" : "1.0",
  39.                "Index" : 1,
  40.                "InterfaceType" : "IDE"
  41.            }
  42.        ]

This item is supported since Zabbix Windows agent 4.4.

Low-level discovery macros

Even though no low-level discovery macros are created in the returned JSON, these macros can be defined by the user as an additional step, using the custom LLD macro functionality with JSONPath pointing to the discovered values in the returned JSON.

The macros then can be used to create item, trigger, etc prototypes.