Friday, September 03, 2004

Yikes….. WMI dependent on Event Log Service ?!!

Recently, one of my friend had a requirement to check for the Eventlog Service state and the startup type. Though I was pretty sure that event log service state cannot be changed and only startup type can be changed, still passed on the code to check the state for the service

strComputer = "."

Set objWMIService = GetObject("winmgmts:" &
"{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colServices = objWMIService.ExecNotificationQuery("Select
* from __instancemodificationevent " & "within 10 where TargetInstance
isa 'Win32_Service'")

i = 0
Do While i = 0
Set objService = colServices.NextEvent
If objService.TargetInstance.State <> _
objService.PreviousInstance.State Then
Wscript.Echo objService.TargetInstance.Name & " is " &
objService.TargetInstance.State & ". The service previously was " &
objService.PreviousInstance.State & "."

If objService.TargetInstance.Name="Alerter" Then
Set objWMIService = GetObject("winmgmts:"
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colProcessList = objWMIService.ExecQuery ("Select * from Win32_Process
Where Name = 'Notepad.exe'")

For Each objProcess in colProcessList
End if
End If

And the following to check the Service Startup state,

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colServiceList = objWMIService.ExecQuery _
("Select * from Win32_Service where StartMode = 'Manual'")
For Each objService in colServiceList
Msgbox objService.Name

and was pretty sure on the code, so I tested with “Alerter” service as I was lazy to reboot the machine. That guy was pretty cool and used in his code….

He started testing the code by changing the startup type of the event log service, immedietly the code plunked !!! It threw an error “Dependent Service Not Found!!!”

I was little confused, and when I checked the WMI Service, the service was dependent on Eventlog service !!!!!!!!!!!!!! I really do not know this….

Man… Still I Could not find out the reason why WMI is dependent on Event Log Service ????!!! Anybody ???? To me there are no logical reasons behind this ??? alternative checking @ registry…. Somehow I always consider touching registry is ugly !!!

Finally, WMI Dosen’t work if my eventlog is stopped…. Huh….. learned something new !!!!

Can somebody tell me the reason behind this behaviour ? Any Takers ?!!!

posted by Logu Krishnan : 7:54 AM

Comments: Post a Comment

This page is powered by Blogger. Isn't yours?