2

When querying for large ammount of data through WMI (say the windows events log Win32_NTLogEvent) it is very useful to know what kind of numbers you are getting yourself into before downloading all the content. Is there a way two do this?

From what i know there is no "Select Count(*) FROM Win32_NTLogEvent" in WQL.

From what i know the Count property of the ManagementObjectCollection actually enumerates through all the results whether you have the Rewindable property set to true or false.

If it cannot be done in .NET, can it be done by directly using the underlying IWbem objects Thanks

Mark
  • 5,223
  • 11
  • 51
  • 81

2 Answers2

4

The underlying IWbem objects also return an enumeration.
E.g. The IWbemServices::ExecQuery Method returns an IEnumWbemClassObject

However, see Improving Enumeration Performance for a couple of ideas.
Notably, the WBEM_FLAG_FORWARD_ONLY.
If you're in C# I'm guessing it would be calling ManagementObjectSearcher with EnumerationOptions.Rewindable set to false. Rewindable is true by default, so turning it off should give some improvement.

(You could also profile to see if there's any performance improvement if you just ask for one (key) property in your query. E.g. Select RecordNumber FROM Win32_NTLogEvent instead of Select * FROM Win32_NTLogEvent.
In theory not as much info would need to be instantiated, though in realityit still has to enumerate everything, and I don't remember if I ever saw any improvement from that. Worth a timing check, though.)

Daryn
  • 4,791
  • 4
  • 39
  • 52
  • Selecting only single field does improve speed compared to '*' in some cases. For example, "select * from Win32_Processor" for the first time takes about 1 sec (win7 x64, with intel core i5-2400). Selecting only "Name" takes only n-ths of a second. Subsequent selects perform fast. This makes sense when you need WMI information only once, and don't want to wait. – mistika May 16 '13 at 00:33
  • Yep, the big culprit there is `Win32_Processor.LoadPercentage`, which [gathers samples of the CPU load over one second and presents the average load](http://msdn.microsoft.com/en-us/library/windows/desktop/aa394373.aspx). So that particular property will block for a second when queried synchronously. – Daryn May 16 '13 at 18:51
1

It appears that it cannot be done. The next best thing is the answer provided above by Daryn.

Mark
  • 5,223
  • 11
  • 51
  • 81
  • 1
    then why didn't you accept his answer instead of posting this and then answering your own question? – Jimmy D Jan 23 '12 at 20:39
  • 2
    I thought since the answer is "it cannot be done" that would be more useful to viewers searching for whether this can be done or not. – Mark Jan 24 '12 at 15:02