WMIC on Linux examples

In a previous post I showed how to install the Windows Management Instrumentation (WMI) client for Linux (wmic). In this post, I wish to show a few ways on how to query a Windows-based host using the WMI client.

Using WQL, we can query almost any aspect of the Operating System. Using the available WMI Classes (for example the WMI Win32 Classes), we can easily query performance indicators such as Memory Usage, Disk Usage or the status of a certain process.

Get process ID for process

Using this query, one can get the process ID of a process. This ID can then for example be used to get other metrics with another WQL query.

$ wmic -U Administrator%mysecret //10.140.10.10 "Select ProcessId from Win32_Process Where CommandLine like '%java.exe%'"

Get WorkingSetSize for process

When monitoring certain processes, this query can help you find memory leaks or other memory-related problems.

$ wmic -U Administrator%mysecret //10.140.10.10 "Select WorkingSetSize from Win32_Process Where CommandLine like '%java.exe%'"

Get thread count for process

$ wmic -U Administrator%mysecret //10.140.10.10 "Select ThreadCount from Win32_Process Where CommandLine like '%java.exe%'"

Get private bytes for process

$ wmic -U Administrator%mysecret //10.140.10.10 "Select PrivateBytes from Win32_PerfFormattedData_PerfProc_Process Where IDProcess='%java.exe%'"

Get free physical memory for host

$ wmic -U Administrator%mysecret //10.140.10.10 "Select FreePhysicalMemory from Win32_OperatingSystem"

WQL (SQL for WMI) is a subset of SQL and features some of the important SQL keywords such as WHERE, LIKE, GROUP and HAVING.

Microsoft has an excellent documentation of WMI and also has a library of examples.

Comments

Oh no, new comments are currently disabled.
If you want to get in touch with me, please do so via e-mail:

Workaround for WMI client over IPv6 – Simon Krenger, on 2017-05-18 18:23:19 (Website)

[…] years ago, I wrote some examples for the WMI client on Linux. I still get a lot of queries from people trying to use the WMI client to access Windows hosts and […]

Jorden, on 2015-06-08 17:26:31

Hi Simon, It might be too late to ask, but it's better late than never so. From Microsoft Command Line i can run a romte proccess using the "process create call " Does linux wmic have this possibility? Could you show me an example? Thanks for the grate post anyway.

Simon Krenger, on 2014-12-15 19:20:40 (Website)

Hello Noam, no, not that I know of. Refer to the WMI documentation for more information.

Noam, on 2014-11-17 15:04:20

Hi, Can I use the wmic tool to run other commands than queries? I see that you can use command like "computersystem list full" also can I run batch commands like "cmd /c echo 1>C:\2.txt" Thanks in Advanced

Simon Krenger, on 2014-06-23 09:13:55 (Website)

I have never run into memory leak troubles, no. Since this is open-source software, feel free to investigate this yourself or log a bug in the developers bugtracking tool.

B Gee, on 2014-06-21 22:18:47

When I have wmic in a loop to repeatedly get some counter data from windows, i notice that it grows substantially in memory size suggesting a memory leak of some sort. Have you run into this?

Simon Krenger, on 2014-06-02 09:42:27 (Website)

You should be able to use ">" to redirect the output of the command into a file. For example: ls -l > my-output.txt

kannan, on 2014-06-02 08:47:50

Hi mates, i am using this command in cent os, this is working perfectly. but i want save the result in text file. please help any way to save output in txt file. Thanks in Advance.

Simon Krenger, on 2014-02-20 19:34:11 (Website)

Hello Leo, Good question. You could try to construct a wmic command and then try to parse the output of the program. Otherwise, I do not think that there is a native way to call WQL from Java. However, there is a CIMClient class here, so this would be your best bet.

Leo, on 2014-02-19 08:05:28

Hi Simon, Is there any way to get the wmic session by the wmic-client? I want to use java program invoke the wmic client to get the session , and then to run some WQLs. So I can do it in one session. If not,do you have some better ideas to implement the function. Beg for your answer. Leo

Simon Krenger, on 2013-06-23 13:59:22 (Website)

Hello Felix, I personally would place the question in the Samba Mailing List, since WMIC is a part of the samba package. Sadly I only experimented with WMIC for a short while and did not investigate the tool further. Nonetheless, at least the kerberos authentication should work, but it seems you already have a deeper understanding of WMIC than I do :).

Felix D, on 2013-06-21 08:18:39

Thanks for the reply, Simon. Do you know where is a good place to ask them? Is there a forum for wmic? Or is samba forum good for this? I have another question on wmic regarding the authentication mechanism it uses, in case you know the answer. Does wmic support NTLMv2 or Kerberos? I see it has cmdline options --kerberos and--use-security-mechanisms, but kerberos didn't work for me and the source code for the other option seems empty. Thanks, Felix

Simon Krenger, on 2013-06-19 21:29:17 (Website)

Hello Felix, Sadly I do not know if the WMI client supports UTF-8, it seems not. You might have better luck reaching out to Andrzej Hajda or Jelmer Vernooij, the contributors for the tools.

Felix D, on 2013-06-18 19:22:23

Hi, Simon, Do you know if wmic supports UTF-8? In the source code tree, I see a lot of references to UTF-8, but when I run it, the output string is not in UTF-8. For example, 'Ü' is "0xe2 0x96 0x84" instead of "0xc3 0x9c" as it should be in UTF-8. Do you know if there is an option somewhere to change this? Thanks, Felix

Simon Krenger, on 2013-04-10 16:20:34 (Website)

Sadly, no. If you look at the sources for the Linux WMI client, you can see that objects default to the string "Unsupported":
char *string_CIMVAR(TALLOC_CTX *mem_ctx, union CIMVAR *v, enum CIMTYPE_ENUMERATION cimtype)
{
	switch (cimtype) {
	case CIM_SINT8: return talloc_asprintf(mem_ctx, "%d", v->v_sint8);
[..]
	case CIM_REFERENCE: return talloc_asprintf(mem_ctx, "%s", v->v_string);
	case CIM_CHAR16: return talloc_asprintf(mem_ctx, "Unsupported");
	case CIM_OBJECT: return talloc_asprintf(mem_ctx, "Unsupported");
	case CIM_ARR_SINT8: RETURN_CVAR_ARRAY_STR("%d", v->a_sint8);
[..]
	case CIM_ARR_REFERENCE: RETURN_CVAR_ARRAY_STR("%s", v->a_reference);
	default: return talloc_asprintf(mem_ctx, "Unsupported");
	}
}

Shan Jinlai, on 2013-04-10 09:35:00

Hi Simon, I am now trying to retrieve HBA adapter's port attributes using wmic. for example: $wmic -U admin%password //172.18.37.114 --namespace=Root\\WMI "SELECT * FROM MSFC_FibrePortHBAStatistics" On my machine, the command will return as following: CLASS: MSFC_FibrePortHBAStatistics Active|HBAStatus|InstanceName|Statistics|UniquePortId True|0|PCI\VEN_1077&DEV_2422&SUBSYS_01331077&REV_02\5&24554dfa&0&080310_0|Unsupported|18446744071695982596 the Statistics 's value is show as "unsupported". actually its type is MSFC_HBAPortAttributesResults. Is there a way to use WMIC to query the value of attribute defined as a class structure? Thanks, Shan

Alex, on 2013-02-10 02:25:19

WMI Active Directory Provider: http://msdn.microsoft.com/en-us/library/windows/desktop/aa384689(v=vs.85).aspx Example: http://www.winfrastructure.net/article.aspx?BlogEntry=Get-Active-Directory-users-using-WMI

Simon Krenger, on 2012-12-05 18:51:28 (Website)

Hello Ron, No, I am not aware of any WQL queries that can query AD or Exchange, sorry :(. If you find something, let me know.

Ron, on 2012-12-02 17:28:41

Hi Simon, is there a way to use WMIC for information about: - Active Directory functionality (fsmo, replication etc.) - Exchange Thanks, Ron

Simon Krenger, on 2012-10-09 23:19:35 (Website)

Hello Kevin, No, I do not know of a better way to format the output, I would have done it the same way you did it (with awk, sed etc.). For more information on WQL, see here: http://msdn.microsoft.com/en-us/library/aa394606%28VS.85%29.aspx Sadly there seems to be no good documentation for the "wmic" client :(.

Kevin D, on 2012-10-09 17:33:40

Is there a way via the APP for format the output? This is the only way I could format the output: wmic -U /\% // "select * from Win32_BIOS"|awk '{ FS=" |";RS="|"}{print $0}'

Simon Krenger, on 2012-10-02 21:54:22 (Website)

Hello Ken, thanks for your question. No, WMI (Windows Management Instrumentation) is a Microsoft Windows feature, therefore you are unable to do anything other than query Windows systems with these examples. However, you can use SSH or CIM to get Linux system data.

Ken Wimer, on 2012-10-02 21:04:55

Does your code provide the ability to read the linux system data from a windows client?

WMI client (WMIC) for Linux – Simon Krenger, on 2012-06-27 16:29:18 (Website)

[...] The following example shows how to get the size of the WorkingSet of the process “java.exe” running on the remote host 192.168.20.20: wmic -U Administrator%mysecret //192.168.20.20 "Select WorkingSetSize from Win32_Process Where CommandLine like '%java.exe%'" Update: I added a set of examples here. [...]