# WMI plugin query error: IEnumVARIANT::Next (memory leak?)

**URL:** <https://discuss.elastic.co/t/wmi-plugin-query-error-ienumvariant-next-memory-leak/1417>\
**Category:** Logstash\
**Created:** [May 27, 2015, 7:02pm UTC](https://discuss.elastic.co/t/wmi-plugin-query-error-ienumvariant-next-memory-leak/1417 "2015-05-27T19:02:29Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Daniel](https://avatars.discourse-cdn.com/v4/letter/d/3ec8ea/32.png) [@Daniel](https://discuss.elastic.co/u/Daniel)\
**Post date:** [May 27, 2015, 7:02pm UTC](https://discuss.elastic.co/t/wmi-plugin-query-error-ienumvariant-next-memory-leak/1417/1 "2015-05-27T19:02:29Z")

</div>

Hello, not sure if this is the right place for plugin support but I've encountered a possible memory leak or something that blocks the processing of WMI queries.

I've setup my LogStash config on 5 different machines all pointing to one ElasticSearch database.

For every machine, I encountered this error after 2-3 hours of running LogStash:  
WMI query error: IEnumVARIANT::Next  
And this is displayed many times over. From Kibana, I also see that there is no data coming into ElasticSearch after this error occurs.

I don't think my config file is the cause but here is one of my typical WMI inputs as an example:  
wmi {  
type =\> "WMI"  
tags =\> "PercentProcessorTime"  
query =\> "select PercentProcessorTime from Win32\_PerfFormattedData\_PerfProc\_Process where name = ''"  
}

I have about 8 of these.

Has anyone else had trouble with the WMI plugin or can think of any solutions?

Note: This person here has encountered the exact same thing except I run on Windows 7. [https://github.com/elastic/logstash/issues/2555](https://github.com/elastic/logstash/issues/2555)

---

<div class="post-metadata">

**Author:** ![Joost\_VdC](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joost_vdc/32/3564_2.png) [@Joost\_VdC](https://discuss.elastic.co/u/Joost_VdC)\
**Post date:** [July 3, 2015, 9:04am UTC](https://discuss.elastic.co/t/wmi-plugin-query-error-ienumvariant-next-memory-leak/1417/2 "2015-07-03T09:04:25Z")

</div>

I currently have exactly the same problem with similar WMI queries (logstash v1.5.1). Is there already any root cause identified or a known workaround? Running logstash on MS server 2012.

Thanks in advance for any advise!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:35am UTC](https://discuss.elastic.co/t/wmi-plugin-query-error-ienumvariant-next-memory-leak/1417/3 "2017-07-06T05:35:36Z")

</div>