Windows Management Instrumentation (WMI) is a scalable, extensible management infrastructure included as part of Windows 2000 and later. It’s an implementation of Web-Based Enterprise Management (WBEM) and is based on the Common Information Model (CIM).

WMI includes a rich set of powerful classes that can be used for, among other things, performance monitoring of any Windows application that supports WMI.

To list the performance monitoring classes, the following command of Windows PowerShell code can be used:

Get-WmiObject -List  | Where-Object { $_.name -match ‘perf’ }

NOTE: above script was processed on WinXP SP3.

Please note that some of the WMI class names include the word “PerfRawData” but others include the word “PerfFormattedData”. The reason is that these classes are derived from Win32_PerfRawData and from Win32_PerfFormattedData abstract classes (available only on Windows XP and later).

The difference between these two classes is that, for the most part, the raw data classes provide pure counters/values while the formatted data classes provide pre-calculated data, and therefore data based on the dynamic behavior of monitored objects over a sampling period.

The formatted data counters can be of various counter types depending on the calculation method and the nature of the value. Fortunately, they are based on a limited number of generic types. The most important generic types are the following:

• Average. These counters calculate the average of the last two measurements. For instance, the PERF_AVERAGE_TIMER counter type, which is derived from the generic Average, measures the average time it takes to complete a process or operation by using the formula ((N1 – N0) / F) / (D1 – D0), where the numerator (N) represents the number of ticks counted during the last sample interval, the variable F represents the number of ticks per second, and the denominator (D) represents the number of operations completed during the last sample interval. Thus, the formula calculates the average time it takes to process one operation (in seconds).
• Difference. These counters subtract the last measurement from the previous one and display the difference. A typical representative is PERF_COUNTER_COUNTER which calculates the average number of operations completed during each second of the sample interval by using the formula (N1- N0) / ( (D1-D0) / F), where the numerator (N) represents the number of operations performed during the last sample interval, the denominator (D) represents the number of ticks elapsed during the last sample interval, and F represents the number of ticks per second. Thus, the formula calculates how many operations, on average, were processed in one second.
• Percentage. These counters display calculated values as a percentage. A typical representative is PERF_COUNTER_TIMER which calculates the average time that a component was active as a percentage of the total sampling time by using the formula (N1 – N0) / (D1 – D0) * 100, where the denominator (D) represents the total elapsed time of the sample interval, and the numerator (N) represents the portion of the sample interval during which the monitored components were active.
• Rate. Similar to an average counter, these counters sample an increasing count of events over time. The count is divided by the change in time to display a rate of activity.
• Instantaneous. These counters display the most recent measurement. As an example, the PERF_COUNTER_RAWCOUNT shows the last observed value only.