Note that there are some explanatory texts on larger screens.

plurals
  1. POWMI, negative CPU usage value and Timestamp_Sys100NS in past
    primarykey
    data
    text
    <p>I am monitoring some machines using WMI, using .NET's <code>System.Management</code> stuff. The query I am using is this:</p> <pre><code>SELECT Timestamp_Sys100NS, PercentProcessorTime FROM Win32_PerfRawData_PerfOS_Processor WHERE Name='_Total' </code></pre> <p>From that I compute the CPU usage % using the well known formula:</p> <pre><code>double cpu_usage = (1 - (double)delta_cpu / delta_time) * 100; </code></pre> <p>It works very well every machine but one (so far).</p> <p>The problem is that for one machine, which is Windows 2003 server (with hyper-threading enabled, if it matters), I am sometimes getting negative CPU usage values. In other words, the <code>(double)delta_cpu / delta_time</code> expression yields number <code>&gt; 1</code>. I did search the web for hints as to why this could be happening but I found nothing.</p> <p>Is this Windows 2003 server specific? Or is it hyper-threading related problem? Or is it just expected and I should just clamp the CPU usage value or the <code>cpu_delta</code> value into some range?</p> <p><em>EDIT:</em> The second weird thing I am observing with this one machine is that the <code>Timestamp_Sys100NS</code> value does not indicate <code>FILETIME</code> like date (ticks since epoch January 1, 1600) but instead it looks like ticks since boot time.</p> <p><em>EDIT 2</em>: I have now verified that this problem is across a lot of Windows 2003 servers. And I am apparently <a href="http://www.ureader.com/msg/14773088.aspx" rel="nofollow">not the only one with the same problem</a>.</p> <p><em>EDIT 3</em>: I have solved the time stamp issue by querying <code>LastBootUpTime</code> from <code>Win32_OperatingSystem</code> and adding that to the <code>Timestamp_Sys100NS</code> when the value of <code>Timestamp_Sys100NS</code> is too far in the past. That seems to give correct date and time. The code manipulating the date after it is retrieved from <code>Win32_OperatingSystem</code> looks like this:</p> <pre><code>WbemScripting.SWbemDateTime swbem_time = new WbemScripting.SWbemDateTime(); swbem_time.Value = date_str; string time_as_file_time_str = swbem_time.GetFileTime(true); return new DateTimeOffset(epoch.Ticks + long.Parse(time_as_file_time_str), swbem_time.UTCSpecified ? TimeSpan.FromMinutes(swbem_time.UTC) : TimeSpan.Zero); </code></pre> <p>...then adjust to UTC...</p> <pre><code>boot_time = boot_time.UtcDateTime; </code></pre> <p>...then is <code>boot_time</code> simply added to the time stamp (<code>current</code>) returned in by WMI in the <code>Timestamp_Sys100NS</code> field... </p> <pre><code>if (time.Year &lt; 2000) time = boot_time + current; </code></pre> <p><em>EDIT 4</em>: It appears that there are 3 classes of system with respect to <code>Timestamp_Sys100NS</code>:</p> <ol> <li>First are Vista+ system where the <code>Timestamp_Sys100NS</code> is time in ticks since epoch in UTC.</li> <li>Second are some Windows 2003 systems where the <code>Timestamp_Sys100NS</code> needs to be added to <code>Win32_OperatingSystem.LastBootUpTime</code> to get reasonable time.</li> <li>Third class are systems where doing the above addition still results in a date days off of the right date and time.</li> </ol> <p><em>EDIT 5</em>: Some of the affected machines might have been VMs but not all of them. </p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload