我正在使用Win32_ProcessStartTrace(并停止跟踪),如下所示
m_ProcessStartEvent = new ManagementEventWatcher(m_Scope, new EventQuery("SELECT * FROM Win32_ProcessStartTrace"));
m_ProcessStartEvent.EventArrived += ProcessStartEvent_EventArrived;
m_ProcessStartEvent.Start();
...
m_ProcessStartEvent.Stop();
m_ProcessStartEvent.EventArrived -= ProcessStartEvent_EventArrived;
m_ProcessStartEvent.Dispose();
在事件日志中:应用程序和服务Logs => Micorosft => windows => Wmi-Activity =>运行,我有错误
System
- Provider
[ Name] Microsoft-Windows-WMI-Activity
[ Guid] {1418EF04-B0B4-4623-BF7E-D74AB47BBDAA}
EventID 5858
Version 0
Level 2
Task 0
Opcode 0
Keywords 0x4000000000000000
- TimeCreated
[ SystemTime] 2018-12-10T09:48:49.189515600Z
EventRecordID 161732
- Correlation
[ ActivityID] {73689ED9-87E0-0005-48B2-8073E087D401}
- Execution
[ ProcessID] 2532
[ ThreadID] 9116
Channel Microsoft-Windows-WMI-Activity/Operational
Computer ...
- Security
[ UserID] S-1-5-18
- UserData
- Operation_ClientFailure
Id {00000000-0000-0000-0000-000000000000}
ClientMachine ...
User ...
ClientProcessId 38256
Component Unknown
Operation Start IWbemServices::ExecNotificationQuery - root\cimv2 : SELECT * FROM Win32_ProcessStartTrace
ResultCode 0x80041032
PossibleCause Unknown
是什么原因导致它以及如何解决它?
我确实看到了
但我不明白这是否相关,如果是,那该怎么办呢 .
谢谢,