CODEWITHSUNDEEP
performancewmiperformancecounter
Bruno Sonnino
Bruno Sonnino

Reputation: 61

Strange delay when querying WMI performance counter for the first time

I am querying WMI (win32_perfrawdata_perfproc_process class) and something strange happens: the first time you query it, it stops for almost 50 seconds to show an answer. The next times are almost immediate.

Did anybody see this behavior? Is there anything to avoid that?

To reproduce this, open a Powershell window and type

gwmi win32_perfrawdata_perfproc_process

The first time you run this command, it stops for almost 50 seconds. The second time is almost immediate.

Bruno

Upvotes: 4

Views: 721

Answers (1)

Daniel Widdis
Daniel Widdis

Reputation: 9091

Is six years later too late to answer this question? :)

A delay of about 20 seconds for the first WMI query (from any source, either powershell, wmic command line, or programmatically via COM calls) is normal. I've tracked this down to the RPC/TCP connection. According to Windows documentation:

Starting with Windows Vista, the service control manager (SCM) supports remote procedure calls over both Transmission Control Protocol (RPC/TCP) and named pipes (RPC/NP). Client-side SCM functions use RPC/TCP by default.

RPC/TCP is appropriate for most applications that use SCM functions remotely, such as remote administration or monitoring tools. However, for compatibility and performance, some applications might need to disable RPC/TCP by setting the registry values described in this topic.

When a service calls a remote SCM function, the client-side SCM first attempts to use RPC/TCP to communicate with the server-side SCM. If the server is running a version of Windows that supports RPC/TCP and allows RPC/TCP traffic, the RPC/TCPP connection will succeed. If the server is running a version of Windows that does not support RPC/TCP, or supports RPC/TCP but is operating behind a firewall which allows only named pipe traffic, the RPC/TCP connection times out and the SCM retries the connection with RPC/NP. This will succeed eventually but can take some time (typically more than 20 seconds), causing the OpenSCManager function to appear blocked.

The link above specifies registry values that can be changed to remove this delay. They are under HKLM\SYSTEM\CurrentControlSet\Control. I've been able to shorten the delay to only 5 seconds by changing the SCMApiConnectionParam timeout value to 5000.

Upvotes: 1

Related Questions