Playing around with the RootMSCluster WMI Namespace and WMI Notifications


MSCS and Failover Clustering in Windows Server 2003 and Windows Server 2008/R2 respectively maintain their own WMI namespace called, unsurprisingly “MSCluster”. This namespace contains classes - for nodes, networks, resources and so on - which in turn have instances. These instances store information about the object they represent and the current state of these objects.

So let’s say we want to write a script that notifies you each time a resource goes offline and comes online on a  node. Before jumping straight in, I’ll answer a question that has probably popped into your head right now – Why? I can check the event log, the cluster log, the cluster management snap-in to determine the state of a resource. Why do I need to write a script? My answer: Because you can. And because you’ll learn some pretty neat stuff while you’re at it!

Writing a script that works with WMI is a window into the inner working of this magnificent but often underappreciated component of the Windows operating system. There are no tools available that allow you to monitor operations being performed on WMI data – in real-time – and for this reason, it is often appears shrouded in secrecy.

Alright, now that I have you hooked, let’s look at the script: 

strComputer = "."
Set objSWbemServices = GetObject("winmgmts:" &_
"{impersonationLevel=impersonate}!" &_
"\\" & strComputer & "\root\mscluster")

Set objEventSource = objSWbemServices.ExecNotificationQuery( _
"Select * From __InstanceModificationEvent Within 1 Where " _
    & "TargetInstance ISA 'MSCluster_Resource'")

Do
    Set objEventObject = objEventSource.NextEvent()

    If objEventObject.TargetInstance.State = 2 Then
       Wscript.Echo "Resource '" & _
       objEventObject.TargetInstance.Name & _
       "' Online. Time: " & Now
    End If
    If objEventObject.TargetInstance.State = 3 Then
       Wscript.Echo "Resource '" & _
       objEventObject.TargetInstance.Name & _
       "' Offline. Time: " & Now
    End If
Loop

“Wow”, I hear you say, “I’m outta here!”. Hang on just a sec though. I’ll explain the script line by line. My first bit of advice when looking at someone else’s script. Ignore the “_” (underscore). It tends to make a script look much more complex than it actually is. All the underscores do is tell cscript.exe or wscript.exe – the scripting hosts – that the command or query doesn’t end there, but continues onto the next  line. I’ve found it helpful to copy the script onto notepad, remove the underscores (make sure Word Wrap is turned off) and have the complete command or query on a single line.

Ok, let’s start at the beginning. First, we connect to WMI on the local system (indicated by “.”) to the root\mscluster namespace. This is done by these lines of the script:

strComputer = "."
Set objSWbemServices = GetObject("winmgmts:" &_
"{impersonationLevel=impersonate}!" &_
"\\" & strComputer & "\root\mscluster")

Next, we subscribe to some WMI events. To determine which events we need to subscribe to, we first need to determine what WMI classes exist for cluster resources. To do this, we use a nifty little inbuilt utility called wbemtest.exe

  1. Click Start, then Run, type wbemtest.exe and click OK.
  2. Click Connect and in the Namespace box, type root\mscluster and click Connect again.
  3. Click the Enum Classes… button, select the Recursive radio button and click OK.
  4. Scroll down through the list of classes till you locate a class that represents a cluster resource. You’ll find that MSCluster_Resource is your best bet.
  5. Double-click the MSCluster_Resource and then click the Instances button.
  6. Double-click any of the Instances – which are actually Cluster Resources – and scroll down in the list of Properties.
  7. Review the list of Properties and note that the State property most closely matches the state of a Cluster resource.
  8. If the resource is currently online, the state will be 2 and if it is offline, the state is 3. You can test this by exiting wbemtest, taking the resource online or offline and then following steps 1 to 7 above to check the state again.

We now know that the class we’re after is MSCluster_Resource and the property we’re after is State.

The next couple of lines require a little more attention than you’re probably been paying so far, because this is where the magic happens.

We want to be notified any time a new instance of the __InstanceModificationEvent class is created. A new instance of this class is created whenever a WMI object is modified. We also want the notifications to be limited to WMI objects that are Cluster Resources and therefore we specify the TargetInstance ISA 'MSCluster_Resource' condition. The Within 1 specifies the polling interval at which we check for new instances of the __InstanceModificationEvent class.

Set objEventSource = objSWbemServices.ExecNotificationQuery( _
"Select * From __InstanceModificationEvent Within 1 Where " _
& "TargetInstance ISA 'MSCluster_Resource'")

After we subscribe to the WMI event service we next use a loop to run forever. Inside, we use this line of code to instruct the script wait for the next instance modification event, where the class is MSCluster_Resource, to occur:

Set objEventObject = objEventSource.NextEvent()

Finally, we come to the simplest part of the script. When the next instance modification event occurs, using the TargetInstance object (TargetInstance is an object, created in response to an event, that has the same properties and values of the object that triggered the event), we check the value of the State property against predetermined values and print out the appropriate text and current time.

If objEventObject.TargetInstance.State = 2 Then
Wscript.Echo "Resource '" & _
objEventObject.TargetInstance.Name & _
"' Online. Time: " & Now
End If
If objEventObject.TargetInstance.State = 3 Then
Wscript.Echo "Resource '" & _
objEventObject.TargetInstance.Name & _
"' Offline. Time: " & Now
End If

So there you have it. A script that – more than its actual use – gives you some insight into how monitoring tools set up notifications in WMI to report certain conditions.

Here is an MSDN article that explains some of the terms I’ve used in this post:

http://technet.microsoft.com/en-us/library/ee156566.aspx

Comments (0)

Skip to main content