2017-02-17 80 views
0

我注册为类“SMS_UpdateGroupAssignment”来监控部署对象创建事件,代码段是下面:WMI创建实例事件

_dhGCreation = SINGLETON (CWMIEventManager)->subscribeToObjectCreation (L"SMS_UpdateGroupAssignment", this); 

void* CWMIEventManager::subscribeToObjectCreation (CComBSTR wmiClass, IWMIEventHandler* eh) 
{ 

IUnsecuredApartment* pUnsecApp = NULL; 
//IWbemUnsecuredApartment* pUnsecApp = NULL; 

HRESULT hres = CoCreateInstance (CLSID_UnsecuredApartment, 
NULL, 
CLSCTX_LOCAL_SERVER, 
IID_IUnsecuredApartment, 
(void**)&pUnsecApp); 

DWORD dwErr = GetLastError(); 

LOG_DEBUG_2("CoCreateInstance done, GetLastError = %d, HRESULT = %d", dwErr, hres); 
CEventSink* pSink = new CCreationEventSink (eh); 
pSink->AddRef(); 
LOG_DEBUG_0("pSink->AddRef"); 

IUnknown* pStubUnk = NULL; 

LOG_DEBUG_1("pUnsecApp = %d", &pUnsecApp); 
pUnsecApp->CreateObjectStub (pSink, &pStubUnk); 
LOG_DEBUG_0("pUnsecApp->CreateObjectStub"); 

IWbemObjectSink* pStubSink = NULL; 
pStubUnk->QueryInterface (IID_IWbemObjectSink, 
(void **) &pStubSink); 
LOG_DEBUG_0("pStubUnk->QueryInterface"); 

/* 
* The ExecNotificationQueryAsync method will call 
* EventSink::Indicate method when an event occurs 
*/ 
CComBSTR query = L" SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA '"; 
query += wmiClass + "'"; 

CW2A printstr(query); 

     // here smsProv is an instance to root/sms/site_<siteCode> 
hres = smsProv->getWbemSvc()->ExecNotificationQueryAsync (
CComBSTR (L"WQL"), 
query, 
WBEM_FLAG_SEND_STATUS, 
NULL, 
pStubSink); 

/* Check for errors.*/ 
if (FAILED(hres)) 
{ 
pUnsecApp->Release(); 
pStubUnk->Release(); 
pSink->Release(); 
pStubSink->Release(); 
return 0; 
} 

return (void*) pSink; 
} 

当该登记发生时,我收到以下在SMSPROV.LOG错误:

执行WQL = SELECT * FROM SMS_UpdateGroupAssignment〜$$ < 2017年2月14日13:59:55.472-330>执行 SQL =选择所有 SMS_UpdateGroupAssignment.AssignmentID,SMS_UpdateGroupAssignment.LocaleID,SMS _UpdateGroupAssignment.AssignedUpdateGroup,SMS_UpdateGroupAssignment.AssignmentAction,SMS_UpdateGroupAssignment.Description,SMS_UpdateGroupAssignment.AssignmentID,SMS_UpdateGroupAssignment.AssignmentName,SMS_UpdateGroupAssignment.AssignmentType,SMS_UpdateGroupAssignment.Assignment_UniqueID,SMS_UpdateGroupAssignment.ContainsExpiredUpdates,SMS_UpdateGroupAssignment.CreationTime,SMS_UpdateGroupAssignment.DesiredConfigType,SMS_UpdateGroupAssignment.DisableMomAlerts,SMS_UpdateGroupAssignment.DPLocality,SMS_UpdateGroupAssignment。 AssignmentEnabled,SMS_UpdateGroupAssignment.EnforcementDeadline,SMS_UpdateGroupAssignment.EvaluationSchedule,SMS_UpdateGroupAssignment.ExpirationTime,SMS_UpdateGroupAssignment.LastModificationTime,SMS_UpdateGroupAssignment.LastModifiedBy,SMS_UpdateGroupAssignment.LimitStateMessageVerbosity,SMS_UpdateGroupAssignment.LocaleID,SMS_UpdateGroupAssignment.LogComplianceToWinEvent ... 〜〜e:\ nts_sccm_release \ sms \ siteserver \ sdk_provider \ extnprov \ extproviderclassobject.cpp(2190) :错误显示 - 可能取消〜〜$$ < 02-14-2017 13:59:55.667-330> ERROR ON INDICATE =(WBEM_E_CALL_CANCELLED)〜$$ < 02-14-2017 13:59:55.669-330>返回的结果:170的-1〜 $$ < 02-14-2017 13:59:55.675-330 >

这可能是什么原因导致这种故障?

回答

0

不做事件链接。我试过了,SMSProv.log生成了很多entrys。 为什么? 恕我直言,数据库调用不是基于事件的,因此接收器每15ms左右生成一次数据库查询。这将排队,你必须等待一个小时,sccm才能恢复正常功能。当然你的连接到所有控制台将被取消,因为服务器有很多数据库查询要做。

另一个想法是,你的wbem提供程序是超载的。我在体验这一点时也不知道为什么。 scom有同样的问题。或者我们的WMI命名空间被打破了......我希望不会,这将是一场灾难......