从 C# 使用 Win32_ProcessStartTrace 时 Wmi-Activity 事件日志中的错误

Question

I am using Win32_ProcessStartTrace (and stop trace) as follows

m_ProcessStartEvent = new ManagementEventWatcher(m_Scope, new EventQuery("SELECT * FROM Win32_ProcessStartTrace"));
m_ProcessStartEvent.EventArrived += ProcessStartEvent_EventArrived;
m_ProcessStartEvent.Start();

...

m_ProcessStartEvent.Stop();
m_ProcessStartEvent.EventArrived -= ProcessStartEvent_EventArrived;
m_ProcessStartEvent.Dispose();

In the event log: Application and service Logs => Micorosft => windows => Wmi-Activity => Operational, I have the error

    System 
  - Provider 
   [ Name]  Microsoft-Windows-WMI-Activity 
   [ Guid]  {1418EF04-B0B4-4623-BF7E-D74AB47BBDAA} 
   EventID 5858 
   Version 0 
   Level 2 
   Task 0 
   Opcode 0 
   Keywords 0x4000000000000000 
  - TimeCreated 
   [ SystemTime]  2018-12-10T09:48:49.189515600Z 
   EventRecordID 161732 
  - Correlation 
   [ ActivityID]  {73689ED9-87E0-0005-48B2-8073E087D401} 
  - Execution 
   [ ProcessID]  2532 
   [ ThreadID]  9116 
   Channel Microsoft-Windows-WMI-Activity/Operational 
   Computer ...
  - Security 
   [ UserID]  S-1-5-18 
- UserData 
  - Operation_ClientFailure 
   Id {00000000-0000-0000-0000-000000000000} 
   ClientMachine ...
   User ...
   ClientProcessId 38256 
   Component Unknown 
   Operation Start IWbemServices::ExecNotificationQuery - root\cimv2 : SELECT * FROM Win32_ProcessStartTrace 
   ResultCode 0x80041032 
   PossibleCause Unknown 

Any ideas what is causing it and how to resolve it?

I do see

https://support.microsoft.com/en-ca/help/3124914/wmi-activity-event-5858-logged-frequently-with-resultcode-0x80041032

but I don't understand if this is relevant and if so, what to do about it.

Thanks,

Answer 1

For my situation on a windows 7 system it was a file in System32\\DRIVERS\\vdbus.sys left by comodo. Deleted it and my wmi activity errors went away.