locked
WMI issue with LogFileEventConsumer RRS feed

  • Question

  • Hi all,
    I hope this is the correct forum for this question; if not, please indicate where I should post!
    I have a WMI MOF file with the following content:

    #pragma namespace ("\\\\.\\Root\\Subscription")
    instance of LogFileEventConsumer as $CONSUMER
    {
        Filename = "c:\\TestLogfile.log"; 
        IsUnicode = FALSE;
        Name = "TestLogfileEventConsumer"; 
        Text = "%TargetInstance.ExitCode%,%TargetInstance.ProcessID%,%TargetInstance.DisplayName%,%TargetInstance.Name%";
    };
    instance of __EventFilter as $FILTER
    {
        EventNamespace = "root\\cimv2";
        Name = "ServicesFilter";
        Query = "SELECT * FROM __InstanceModificationEvent WITHIN 20 WHERE TargetInstance ISA \"Win32_Service\"";
        QueryLanguage = "WQL";
    };
    instance of __FilterToConsumerBinding
    {
        Consumer=$CONSUMER;
        Filter=$FILTER;
        DeliverSynchronously=FALSE;
    };

    When I compile it using mofcomp.exe, the logfile is created correctly, but the content isn’t correct;

    whenever a String or DateTime value is used in the logfile, the rest of the line is not present. So the log file contains lines like:

    0,11120,Adobe Acrobat Update Servic

    Instead of

    0,11120,Adobe Acrobat Update Service,AdobeARMservice

    This is just an example to reproduce the issue that occurs; the actual log file is based on other classes!

    • Edited by Myddvai Tuesday, March 19, 2019 5:30 AM
    Monday, March 18, 2019 6:27 AM

All replies

  • Please post your code correctly using the code posting tool provided.

    \_(ツ)_/

    Monday, March 18, 2019 9:57 AM