Multiple instances not sending name attribute

[ybookstaber]

I have more than one query in my config that has multiple instances. Documentation says that it should be sending the event with a name attribute, but this doesn't seem to be happening.

Config example -

{
            "query": "select DatabaseCopyRoleActive, DatabaseMounted from Win32_PerfFormattedData_MSExchangeActiveManager_MSExchangeActiveManager where Name like 'mdb%'",
            "eventname": "MSExchange",
            "counters": [
              {
                "counter": "DatabaseCopyRoleActive",
                "attrname": "exchange.mailbox.activemanager.DatabaseCopyRoleActive"
              },
              {
                "counter": "DatabaseMounted",
                "attrname": "exchange.mailbox.activemanager.DatabaseMounted"
              }
            ]
        }

Get-Ciminstance -

PS C:\> Get-CimInstance -Query "select DatabaseCopyRoleActive, DatabaseMounted from Win32_PerfFormattedData_MSExchangeActiveManager_MSExchangeActiveManager where Name like 'mdb%'" | ft Name,DatabaseCopyRoleActive,DatabaseMounted

Name                                                     DatabaseCopyRoleActive                         DatabaseMounted
----                                                     ----------------------                         ---------------
mdb127                                                                        0                                       0
mdb102                                                                        0                                       0
mdb126                                                                        1                                       1
mdb101                                                                        1                                       1
mdb117                                                                        0                                       0
mdb116                                                                        1                                       1

Verbose log sample -

{
      "event_type": "MSExchange",
      "exchange.mailbox.activemanager.DatabaseCopyRoleActive": 0,
      "exchange.mailbox.activemanager.DatabaseMounted": 0
    },
    {
      "event_type": "MSExchange",
      "exchange.mailbox.activemanager.DatabaseCopyRoleActive": 0,
      "exchange.mailbox.activemanager.DatabaseMounted": 0
    },
    {
      "event_type": "MSExchange",
      "exchange.mailbox.activemanager.DatabaseCopyRoleActive": 1,
      "exchange.mailbox.activemanager.DatabaseMounted": 1
    },
    {
      "event_type": "MSExchange",
      "exchange.mailbox.activemanager.DatabaseCopyRoleActive": 1,
      "exchange.mailbox.activemanager.DatabaseMounted": 1
    },
    {
      "event_type": "MSExchange",
      "exchange.mailbox.activemanager.DatabaseCopyRoleActive": 1,
      "exchange.mailbox.activemanager.DatabaseMounted": 1
    },
    {
      "event_type": "MSExchange",
      "exchange.mailbox.activemanager.DatabaseCopyRoleActive": 1,
      "exchange.mailbox.activemanager.DatabaseMounted": 1
    }

[sschwartzman]

I think it's because you're using the explicit "query", which is akin to manual/advanced instrumentation of perfmon. The other methods grab the multiple instances because they are building the query under the covers and so they add the "Name" field to the query automatically.

So, to fix what you have, try this:

{
            "query": "select Name, DatabaseCopyRoleActive, DatabaseMounted from Win32_PerfFormattedData_MSExchangeActiveManager_MSExchangeActiveManager where Name like 'mdb%'",
            "eventname": "MSExchange",
            "counters": [
              {
                "counter": "Name"
              },
              {
                "counter": "DatabaseCopyRoleActive",
                "attrname": "exchange.mailbox.activemanager.DatabaseCopyRoleActive"
              },
              {
                "counter": "DatabaseMounted",
                "attrname": "exchange.mailbox.activemanager.DatabaseMounted"
              }
            ]
        }