WMIPrvSE.exe causes the CPU Peaks while the BrokerAgent.exe starts performance Queries through the WMI Performance Adapter

You can also see error 5858 from WMI on the VDIs.

While looking at WMI Activity logs, you will see that the BrokerAgent is sending out a query which is failing:

10.04.2017 10:48:55           5858 Error            Id = {02CC1C48-F800-0001-B700-9D2A7EB1D201}; ClientMachine = XXXXXX; User = NT AUTHORITY\NETWORK SERVICE; ClientProcessId = 1888; Component = Unknown; Operation = Start IWbemServices::ExecQuery - ROOT\cimv2 : select AvailableBytes from Win32_PerfFormattedData_PerfOS_Memory; ResultCode = 0x80041017; PossibleCause = Unknown

Now if you have scout output, you can confirm that the process ID 1888 (in this case) is of BrokerAgent.exe.

Hence we can deduce that BrokerAgent is trying to query cimv2 repository with the query “select AvailableBytes from Win32_PerfFormattedData_PerfOS_Memory” and gets a result of 0x80041017.

0x80041017 means :
 
WBEM_E_INVALID_QUERY
2147749911 (0x80041017)
Query was not syntactically valid.

 

Rebuilding the counters:-
cd c:\windows\system32
lodctr /R
cd c:\windows\sysWOW64
lodctr /R

Resyncing the counters with Windows Management Instrumentation (WMI):-

WINMGMT.EXE /RESYNCPERF

Problem Cause