Have you ever needed to monitor the size of a file to ensure you were alerted when it’s size changed beyond certain values?  I had to help address this recently and at first glance, this may seem to be a good job for a script – and a script definitely could be used.  Scripts are great but I like to avoid them when I can and this is a perfect scenario for using a custom WMI performance counter.  After all, tracking a threshold is ultimately what we are after.  So how can this be done?  I wrote a sample monitor and rule to demonstrate.   Let’s walk through the monitor since both are similar – the reason for both is that a monitor will track live data but will not collect it; a rule collects performance data.

The first things is to configure the WMI query to specify which file we want to monitor and the properties.  We can do this through a very simple WMI query to the root\cimv2 namespace as shown below.  All files on a system can be accessed using this same query, Just change the filename and modify the properties being monitored if interested in something other than filesize.  For this example, I chose the pagefile.sys.

image

So we have the data through the WMI query, now we need to map this data and use it to create a custom performance counter.  We do that on the performance mapper screen as shown below.  Note that the Counter name and value name match.

image

For a rule, thats all you need to configure.  For a monitor, we need to specify the thresholds where we want to generate alerts.  This is done on the Threshold Range page.

image

We also need to map our thresholds to the appropriate health state.

image

And decide whether or not to alert.  With all of this configured, we are in business!  After our rule starts to run for a while we will see performance data start to show up for the custom counter.

image