I am queuing some WMI event watchers (using
System.Management.ManagementEventWatcher) on the ThreadPool.  I cannot
start two ManagementEventWatchers that vary only by their queries on the
same thread.  If I try, I get an AccessDenied error - only on the first
one.  

<snip1>
using System;
using System.Management;

public class EventWatcherAsync {
        public static int Main(string[] args) {
                // Set up the event consumer 1
                WqlEventQuery query = 
                        new WqlEventQuery("SELECT * FROM
__InstanceOperationEvent WITHIN 5 WHERE TargetInstance ISA
\"Win32_NTLogEvent\"");

                // Initialize an event watcher and subscribe to 
                // events that match this query
                ManagementEventWatcher watcher = new
ManagementEventWatcher(query);

                // Set up a listener for events
                watcher.EventArrived += 
                        new EventArrivedEventHandler((new
EventHandler()).HandleEvent);
                watcher.Scope.Options.EnablePrivileges = true;
                watcher.Scope.Options.Impersonation =
ImpersonationLevel.Impersonate;

                // Start listening
                watcher.Start();

                // The following code results in AccessDenied
                // Set up the event consumer 2
                WqlEventQuery query2 = 
                        new WqlEventQuery("SELECT * FROM
__InstanceOperationEvent WITHIN 5 WHERE TargetInstance ISA
\"Win32_NTLogEvent\"");

                // Initialize an event watcher and subscribe to 
                // events that match this query
                ManagementEventWatcher watcher2 = new
ManagementEventWatcher(query2);

                // Set up a listener for events
                watcher2.EventArrived += 
                        new EventArrivedEventHandler((new
EventHandler2()).HandleEvent);
                watcher.Scope.Options.EnablePrivileges = true;
                watcher.Scope.Options.Impersonation =
ImpersonationLevel.Impersonate;


                // Start listening
                watcher2.Start();
                Console.Read();
                watcher.Stop();
                return 0;
        }
}

public class EventHandler {
        public void HandleEvent(object sender, EventArrivedEventArgs e)
{
                Console.WriteLine("Event Handler 1 get an event from " +
sender);
        }
}

public class EventHandler2 {
        public void HandleEvent(object sender, EventArrivedEventArgs e)
{
                Console.WriteLine("Event Handler 2 get an event from " +
sender);
        }
}
</snip1>

I thought that putting the watchers on different threads may help, but
the code sample below still results in AccessDenied.  Note that for
demonstration purposes the queries are the same, but I have tried
various queries with the same result when watching the same object (in
this case the NTEventLogEvent).  I need to be able to perform multiple
event queries.  Any advice?

<snip2>
using System;
using System.Management;
using System.Threading;

public class EventWatcherAsync {
        public static int Main(string[] args) {

                WqlEventQuery query = new WqlEventQuery("SELECT * FROM
__InstanceOperationEvent WITHIN 5 WHERE TargetInstance ISA
\"Win32_NTLogEvent\"");
                object oQry = (object)query;
                
                WaitCallback callback1 = new
WaitCallback(EventWatcherAsyncWorker.Callback1);
                AutoResetEvent ev = new AutoResetEvent(false);

                ThreadPool.QueueUserWorkItem(callback1, oQry);
                
                // The following results in an AccessDenied error

                WqlEventQuery query2 = new WqlEventQuery("SELECT * FROM
__InstanceOperationEvent WITHIN 5 WHERE TargetInstance ISA
\"Win32_NTLogEvent\"");
                object oQry2 = (object)query;
                WaitCallback callback2 = new
WaitCallback(EventWatcherAsyncWorker.Callback2);
                ThreadPool.QueueUserWorkItem(callback2, oQry2);

                Console.Read();
                return 0;
        }
}
public class EventWatcherAsyncWorker {
        private EventWatcherAsyncWorker() {}
        
        public static void Callback1(object oQuery) {
                WqlEventQuery query = (WqlEventQuery)oQuery;
                ManagementEventWatcher watcher = new
ManagementEventWatcher(query);
                watcher.EventArrived += new
EventArrivedEventHandler(EventHandler2.HandleEvent);
                watcher.Scope.Options.EnablePrivileges = true;
                watcher.Scope.Options.Impersonation =
ImpersonationLevel.Impersonate;
                watcher.Start();

                do {} while (!EventHandler2.eventArrived);
                
                watcher.Stop();
        }
        public static void Callback2(object oQuery) {
                WqlEventQuery query = (WqlEventQuery)oQuery;
                ManagementEventWatcher watcher = new
ManagementEventWatcher(query);
                watcher.EventArrived += new
EventArrivedEventHandler(EventHandler3.HandleEvent);
                watcher.Scope.Options.EnablePrivileges = true;
                watcher.Scope.Options.Impersonation =
ImpersonationLevel.Impersonate;
                watcher.Start();
                
                // AccessDenied!

                do {} while (!EventHandler3.eventArrived);
                
                watcher.Stop();
        }
}
public class EventHandler2 {
        public static bool eventArrived;
        public static void HandleEvent(object sender,
EventArrivedEventArgs e)   {
                eventArrived = true;
                Console.WriteLine("Event Handler 1 get an event from " +
sender);
        }
}

public class EventHandler3 {
        public static bool eventArrived;
        public static void HandleEvent(object sender,
EventArrivedEventArgs e)   {
                eventArrived = true;
                Console.WriteLine("Event Handler 2 get an event from " +
sender);
        }
}
</snip2>


Richard A. Hein
Software Developer
Level Platforms Inc.
36 Antares Drive, Suite 200, Ottawa, Ontario
* 613-232-0098
* [EMAIL PROTECTED]

Please visit us at http://www.levelplatforms.com

You can read messages from the Advanced DOTNET archive, unsubscribe from Advanced 
DOTNET, or
subscribe to other DevelopMentor lists at http://discuss.develop.com.

Reply via email to