Why are WMI Queries so slow sometimes?

Question

I am using System.Management namespace in a .Net to execute various WMI queries against a remote server. In my logs I can see that sometimes the queries take 30 or 40 seconds to complete while other times the queries complete in less than a second.

When I see these slow queries, I try to connect to the box using wbemtest, but it always connects and executes the query quickly.

Any ideas, pointers, suggestions?

I did notice when looking at System.Management.ManagementScope in reflector that it seems to leak a IWbemServices pointer. It looks like this is a COM Interface that needs to have Release called on it (Marshal.ReleaseComObject()). I'm not sure if that is related or not. I do connect to lots of different servers during the life of the process.

Answer 1

I have the same kind of application that does multiple WMI queries on all different kinds of devices and I experience the same behavior. Using wbemtest is sometimes faster but not necessarily. I also find some queries on the same machine behave differently then other queries on the same machine simply because a different class is queries.

There is a ReturnImmediately property belonging to the EnumerationOptions class which might help you get the results faster if you get them in one batch instead of enumerating them over the network.

EnumerationOptions options = new EnumerationOptions();
options.ReturnImmediately = false;

You can try that and see if it helps. I know this is not what you want to hear but my personal opinion is that there is not much you can do. You need to write code to work arround the issue. The real answer lies somewhere deep burried in the bowls of DCOM, the WMI protocol and the WMI repository.

Answer 2

You could try and set the WITHIN field to see if it forces the query to happen sooner. Could you post the query you are using? That might help debug any further issues

Answer 3

Is the problem specific to one box? I once had this same problem with a remoting scenario. I fixed it by rebuilding the TCP/IP stack on the box making the remoting call.