How to Use and Configure the PERFMIB.DLL SNMP Extension Agent

The information in this article applies to:
  • Microsoft Windows NT version 4.0
  • Microsoft Windows 2000

SUMMARY

By correctly implementing the perfmib.dll and perfmib.ini files into an NT/Win2K system you can expose many native PerfMon metrics to the SNMP service. PerfMon has many system and service performance counters that can adequately summarize the health and usage of an NT system.

The PERFMIB files use to ship with earlier versions of the Windows NT4 Resource Kit but were depreciated (around SP4 I belive) and are no longer supported. This article is here to show how to hack this older PERFMIB functionality into new NT4 or Windows 2000 systems.

Windows 2000 has incorporated some of the more interesting PerfMon metrics into the MIB-II HOSTS MIB. Use of the HOSTS MIB is recommended over PERFMIB for simplicity. In addition, there are rumors that the HOSTS MIB functionality can also be hacked into NT systems (although I've never tried it and I suspect that some WMI pieces need to be in place for this to work).

Note: Some of the PerfMon counters do not get accurately exposed to SNMP or do not work at all.

MORE INFORMATION

There are 3 steps required to implement PERFMIB functionality:
  1. Copy perfmib.dll and perfmib.ini to the %system32% directory.
  2. Add 2 registry keys which link the perfmib.dll as an SNMP Extension Agent
  3. Restart the SNMP Service

Step 1: Copy PERFMIB Files

Copy perfmib.dll and perfmib.ini to the %system32% directory. These files are located at:

ftp://snmpboy.rte.microsoft.com/pub/perfmib/

The perfmib.ini file above controls which PerfMon counters are exposed to SNMP via perfmib.dll. This file was created using perf2mib.exe (available at the ftp link above). If there are other PerfMon counters that you would like to expose (these vary from system to system depending on the applications and services installed), look at the perfmib.bat file on the ftp site above for the syntax used to created the associated perfmib.ini file. Note that the OID reference is flexible under the performance tree depending on the parameters you feed perf2mib.exe. Perf2mib.exe also generates a MIB that can be compiled into your SNMP utility of choice (with rich OID descriptions).

Step 2: Add Registry Keys

Using RegEdit (or RegEdt32) you will need to add the following keys (w/appropriate values) to your registry. Editing the registry is an advanced task and not for the timid. If you're new to editing the registry it would be wise to backup your registry before making these changes.

Go To Tree: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNMP\Parameters\ExtensionAgents]
Add String: "PerfAgent"
With Value: "SOFTWARE\Microsoft\PerformanceAgent\CurrentVersion"

Add Key: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PerformanceAgent\CurrentVersion]
Add String: "Pathname"
With Value: "%SystemRoot%\System32\perfmib.dll"

You can alternatively try to import these strings from the following links. Note: I haven't tried these on all permutations of Windows NT or 2000, so they may not work on your system or reek havoc on your registry, so use at your own risk (although I use these all the time).

ftp://snmpboy.rte.microsoft.com/pub/perfmib/perfmib-reg1.reg
ftp://snmpboy.rte.microsoft.com/pub/perfmib/perfmib-reg2.reg

When finished, they should look like the following:




By adding these keys you will be configuring the perfmib.dll as an SNMP Extension Agent. The Windows SNMP Service is quite extensible. When the service is started, it queries for the existence of each Extension Agent and the MIB tree that each Agent supports. Based on the MIB tree result set that the SNMP Agent gets at startup determines what OIDs are exposed during an SNMP walk. Note that if there's a broken SNMP Extension Agent DLL, the walk may break because the SNMP Agent currently relies on the Extension Agent DLL to respond accordingly.

Step 3: Restart the SNMP Service

Restart (or Stop & Start) the SNMP Service in order to recognize the registry changes you've just made.

Be sure to check the Event Log for errors from the SNMP Service.

You will also want to test for the existence of the .1.3.6.1.4.1.311.1.1.3.1.1. or .private.enterprises.microsoft.software.systems.os.winnt.performance. tree. There are many SNMP utilities available to test with. Snmputil.exe comes with the Window's Resource Kit and there's snmptool.exe that is somewhere in the public domain.

For additional information about SNMP and Traps, click the article number below to view the article in the Microsoft Knowledge Base:
Q172879 Simple Network Management Protocol (SNMP) and Traps

KNOWN ISSUES

The following is a list of the known issues with the PERFMIB Extension Agent:

  • The Processor Utilization MIB only accurately reports metrics for the first processor (in multi-processor systems). You must use the HOSTS MIB (if available) to get processor utilization on multi-proc machines or use your vendor's private MIB (if applicable). For example, Compaq servers expose good processor utilization OIDs in thier private MIB via the Compaq Insight Manager Agent.
  • The Current ftp connections value seems to grow over time until it's restarted. This is also true for it's sister HOSTS MIB OID so I suspect that either the ftp service is not reporting this value correctly or it's not closing dead connections.
  • The Used/Free Memory MIBs don't seem to work on systems that have more than 1GB of memory.
  • The Disk Utilization HOSTS MIB does not update until the SNMP service is restarted (technically this is a HOSTS MIB issue but I thought it was worth mentioning since enough folks have reported it).
  • The TCP Connections MIBs don't seem to work as counters or guages.