I am using Win32_ProcessStartTrace (and stop trace) as follows
m_ProcessStartEvent = new ManagementEventWatcher(m_Scope, new EventQuery("SELECT * FROM Win32_ProcessStartTrace"));
m_ProcessStartEvent.EventArrived += ProcessStartEvent_EventArrived;
m_ProcessStartEvent.Start();
...
m_ProcessStartEvent.Stop();
m_ProcessStartEvent.EventArrived -= ProcessStartEvent_EventArrived;
m_ProcessStartEvent.Dispose();
In the event log: Application and service Logs => Micorosft => windows => Wmi-Activity => Operational, I have the error
System
- Provider
[ Name] Microsoft-Windows-WMI-Activity
[ Guid] {1418EF04-B0B4-4623-BF7E-D74AB47BBDAA}
EventID 5858
Version 0
Level 2
Task 0
Opcode 0
Keywords 0x4000000000000000
- TimeCreated
[ SystemTime] 2018-12-10T09:48:49.189515600Z
EventRecordID 161732
- Correlation
[ ActivityID] {73689ED9-87E0-0005-48B2-8073E087D401}
- Execution
[ ProcessID] 2532
[ ThreadID] 9116
Channel Microsoft-Windows-WMI-Activity/Operational
Computer ...
- Security
[ UserID] S-1-5-18
- UserData
- Operation_ClientFailure
Id {00000000-0000-0000-0000-000000000000}
ClientMachine ...
User ...
ClientProcessId 38256
Component Unknown
Operation Start IWbemServices::ExecNotificationQuery - root\cimv2 : SELECT * FROM Win32_ProcessStartTrace
ResultCode 0x80041032
PossibleCause Unknown
Any ideas what is causing it and how to resolve it?
I do see
but I don't understand if this is relevant and if so, what to do about it.
Thanks,
User contributions licensed under CC BY-SA 3.0