Question

我正在为“SMS_UpdateGroupAssignment”类注册对象创建事件以监控部署，代码片段如下：

_dhGCreation =  SINGLETON (CWMIEventManager)->subscribeToObjectCreation (L"SMS_UpdateGroupAssignment", this); 

void* CWMIEventManager::subscribeToObjectCreation (CComBSTR wmiClass, IWMIEventHandler* eh)
{

IUnsecuredApartment* pUnsecApp = NULL;
//IWbemUnsecuredApartment* pUnsecApp = NULL; 

HRESULT hres = CoCreateInstance (CLSID_UnsecuredApartment,
NULL, 
CLSCTX_LOCAL_SERVER,
IID_IUnsecuredApartment, 
(void**)&pUnsecApp);

DWORD dwErr = GetLastError();

LOG_DEBUG_2("CoCreateInstance done, GetLastError = %d, HRESULT = %d", dwErr, hres);
CEventSink* pSink = new CCreationEventSink (eh);
pSink->AddRef ();
LOG_DEBUG_0("pSink->AddRef");

IUnknown* pStubUnk = NULL; 

LOG_DEBUG_1("pUnsecApp = %d", &pUnsecApp);
pUnsecApp->CreateObjectStub (pSink, &pStubUnk);
LOG_DEBUG_0("pUnsecApp->CreateObjectStub");

IWbemObjectSink* pStubSink = NULL;
pStubUnk->QueryInterface (IID_IWbemObjectSink,
(void **) &pStubSink);
LOG_DEBUG_0("pStubUnk->QueryInterface");

/*
* The ExecNotificationQueryAsync method will call
* EventSink::Indicate method when an event occurs
*/
CComBSTR query =  L" SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA '";
query += wmiClass + "'";

CW2A printstr(query);

        // here smsProv is an instance to root/sms/site_<siteCode>
hres = smsProv->getWbemSvc ()->ExecNotificationQueryAsync (
CComBSTR (L"WQL"), 
query, 
WBEM_FLAG_SEND_STATUS, 
NULL, 
pStubSink);

/* Check for errors.*/
if (FAILED(hres))
{
pUnsecApp->Release ();
pStubUnk->Release ();
pSink->Release ();
pStubSink->Release ();
return 0;
}

return (void*) pSink;
}

发生此注册时，我收到SMSProv.log中的以下错误：

执行WQL = select * from SMS_UpdateGroupAssignment~ $$＆lt; 02-14-2017 13：59：55.472-330＆gt;执行 SQL =全选 SMS_UpdateGroupAssignment.AssignmentID，SMS_UpdateGroupAssignment.LocaleID，SMS_UpdateGroupAssignment.AssignedUpdateGroup，SMS_UpdateGroupAssignment.AssignmentAction，SMS_UpdateGroupAssignment.Description，SMS_UpdateGroupAssignment.AssignmentID，SMS_UpdateGroupAssignment.AssignmentName，SMS_UpdateGroupAssignment.AssignmentType，SMS_UpdateGroupAssignment.Assignment_UniqueID，SMS_UpdateGroupAssignment.ContainsExpiredUpdates，SMS_UpdateGroupAssignment.CreationTime，SMS_UpdateGroupAssignment.DesiredConfigType，SMS_UpdateGroupAssignment。 DisableMomAlerts，SMS_UpdateGroupAssignment.DPLocality，SMS_UpdateGroupAssignment.AssignmentEnabled，SMS_UpdateGroupAssignment.EnforcementDeadline，SMS_UpdateGroupAssignment.EvaluationSchedule，SMS_UpdateGroupAssignment.ExpirationTime，SMS_UpdateGroupAssignment.LastModificationTime，SMS_UpdateGroupAssignment.LastModifiedBy，SMS_UpdateGroupAssignment.LimitStateMessageVerbosity，SMS_UpdateGroupAssignment.LocaleID，SMS_UpdateGroupAssignment.LogComplianceToWinEvent ... 〜〜〜E：\ nts_sccm_release \ SMS \ SITESERVER \ sdk_provider \ extnprov \ extproviderclassobject.cpp（2190）：错误显示 - 可能已取消〜〜〜$$＆lt; 02-14-2017 13：59：55.667-330＆gt;错误 INDICATE =（WBEM_E_CALL_CANCELLED）〜$$＆lt; 02-14-2017 13：59：55.669-330＆GT;结果返回：170〜-1 $$＆lt; 02-14-2017 13：59：55.675-330＆gt;

这种失败的原因是什么？

Answer 1

不要做eventinks。我试过了，SMSProv.log产生了很多东西。为什么？恕我直言，数据库调用不是基于事件的，因此接收器每15ms左右生成一次数据库查询。这将排队，你必须等待一个小时sccm才能恢复正常功能。当然，您所有控制台的连接都将被取消，因为服务器有很多数据库查询要做。

另一个想法是，你的wbem提供程序被重载了。我也经历过这种情况，我不知道为什么。 scom也有同样的问题。也许我们的WMI命名空间坏了...我希望不会，这将是一场灾难......

未收到WMI创建实例事件

1 个答案: