从C#使用Win32_ProcessStartTrace时Wmi-Activity事件日志出错

loading...


0

我正在使用Win32_ProcessStartTrace(并停止跟踪),如下所示

m_ProcessStartEvent = new ManagementEventWatcher(m_Scope, new EventQuery("SELECT * FROM Win32_ProcessStartTrace"));
m_ProcessStartEvent.EventArrived += ProcessStartEvent_EventArrived;
m_ProcessStartEvent.Start();

...

m_ProcessStartEvent.Stop();
m_ProcessStartEvent.EventArrived -= ProcessStartEvent_EventArrived;
m_ProcessStartEvent.Dispose();

在事件日志中:应用程序和服务Logs => Micorosft => windows => Wmi-Activity =>运行,我有错误

System 
  - Provider 
   [ Name]  Microsoft-Windows-WMI-Activity 
   [ Guid]  {1418EF04-B0B4-4623-BF7E-D74AB47BBDAA} 
   EventID 5858 
   Version 0 
   Level 2 
   Task 0 
   Opcode 0 
   Keywords 0x4000000000000000 
  - TimeCreated 
   [ SystemTime]  2018-12-10T09:48:49.189515600Z 
   EventRecordID 161732 
  - Correlation 
   [ ActivityID]  {73689ED9-87E0-0005-48B2-8073E087D401} 
  - Execution 
   [ ProcessID]  2532 
   [ ThreadID]  9116 
   Channel Microsoft-Windows-WMI-Activity/Operational 
   Computer ...
  - Security 
   [ UserID]  S-1-5-18 
- UserData 
  - Operation_ClientFailure 
   Id {00000000-0000-0000-0000-000000000000} 
   ClientMachine ...
   User ...
   ClientProcessId 38256 
   Component Unknown 
   Operation Start IWbemServices::ExecNotificationQuery - root\cimv2 : SELECT * FROM Win32_ProcessStartTrace 
   ResultCode 0x80041032 
   PossibleCause Unknown

是什么原因导致它以及如何解决它?

我确实看到了

https://support.microsoft.com/en-ca/help/3124914/wmi-activity-event-5858-logged-frequently-with-resultcode-0x80041032

但我不明白这是否相关,如果是,那该怎么办呢 .

谢谢,

loading...

0回答

No Data

评论

暂时没有评论!