Introduction
I haven’t written any articles in a while, and the last major stuff I had been working with involved permanent WMI event subscriptions. I’ve been itching to write an article like this for a while now, but just had never gotten around to it. The purpose of this article is to describe how to use PowerShell with WMI eventing to monitor changes in CPU speed. Unlike early generation CPUs, modern CPUs have embedded technology that can dynamically change the processor’s clock speed dependent on load (eg. Intel SpeedStep or AMD’s Cool ‘n Quiet).
WMI Events
Thankfully, the Windows Management Instrumentation (WMI) service, built into Microsoft Windows, offers information about CPU speed, as well as For some background on temporary WMI event subscriptions with PowerShell, check out my article on WMI events. If you’re interested in permanent event subscriptions, that don’t depend on PowerShell running in the background, check out the PowerShell PowerEvents module.
Temporary: Monitoring CPU Speed
Using a temporary event subscription, we can easily monitor CPU speed by running the following PowerShell command:
Register-WmiEvent –Query "select * from __InstanceModificationEvent within 2 where TargetInstance ISA 'Win32_Processor' and TargetInstance.CurrentClockSpeed <> PreviousInstance.CurrentClockSpeed" –Action { Write-Host "Clock speed changed" }
This will simply echo the text “Clock speed changed,” at each occurrence, to the PowerShell console. If you want to do something more fancy, you can dynamically retrieve the new clock speed from the event object in the Action block.
Register-WmiEvent –Query "select * from __InstanceModificationEvent within 2 where TargetInstance ISA 'Win32_Processor' and TargetInstance.CurrentClockSpeed <> PreviousInstance.CurrentClockSpeed" –Action { Write-Host ("Clock speed changed to: " + $Event.SourceEventArgs.NewEvent.TargetInstance.CurrentClockSpeed + "Mhz") }
To make things even more dynamic, we can set up a PowerShell function to respond to our event, and then call that function in the event handler. By doing this, we now allow ourselves the flexibility of redefining the event handler function, without having to delete and re-create the event registration.
function ClockSpeedChanged($tEvent)
{
Write-Host $tEvent.SourceEventArgs.NewEvent.TargetInstance.CurrentClockSpeed
}
Register-WmiEvent –Query "select * from __InstanceModificationEvent within 2 where TargetInstance ISA 'Win32_Processor' and TargetInstance.CurrentClockSpeed <> PreviousInstance.CurrentClockSpeed" –Action { ClockSpeedChanged $Event }
Permanent: Monitoring CPU Speed
So, now we’ve looked at how to create a temporary event registration to monitor CPU speed, but this depends on having PowerShell.exe running all the time. What if we wanted to perform some action in response to the CPU speed changing, but not have to worry about invoking, and leaving, a PowerShell session? This is where the power of WMI permanent event subscriptions comes into play. The PowerEvents module for PowerShell makes these quite easy to work with.
To recap on permanent event consumers, you need to create three objects:
- A filter that defines the events you’re catching / responding to
- A consumer which defines the action that will be taken in response to event instances
- A binding which binds a filter to a consumer, and enables the flow of events
First, we need to create a filter object. Filters in WMI are simply objects that define which events you want to capture and respond to. The actually action of responding is handled by a different object, called a consumer. Here’s what our filter would look like:
$Filter = New-WmiEventFilter –Name CPUClockSpeedChanged –Query "select * from __InstanceModificationEvent within 2 where TargetInstance ISA 'Win32_Processor' and TargetInstance.CurrentClockSpeed <> PreviousInstance.CurrentClockSpeed"
Next, we need to create a WMI event consumer. The consumer’s purpose is to respond to the events defined in our filter. Let’s say in this case, that we want to simply log the clock speed change to a text file:
$Consumer = New-WmiEventConsumer -Name CPUClockSpeedChanged -ConsumerType LogFile -FileName c:tempClockSpeed.log -Text "Clock speed on %TargetInstance.SocketDesignation% changed to: %TargetInstance.CurrentClockSpeed%"
Note: For the above example, make sure that the folder c:temp exists, otherwise it will not be created. The consumer will only create the text file, if it does not exist.
Finally, we create a binding between the filter and the consumer:
New-WmiFilterToConsumerBinding -Filter $Filter -Consumer $Consumer
And that’s all there is to it! Now you should start seeing events get logged to c:tempClockSpeed.log when your processor’s speed changes. If you’re on a laptop, try unplugging your AC adapter to invoke a speed change. If you’re on a desktop computer, try putting it under load by starting a bunch of programs, and then letting it settle. Assuming that you’ve not disabled power saving features in your BIOS, you should see the clock speeds changing, and getting logged.
