Chillout Lounge

Yikes….. WMI dependent on Event Log Service ?!!

Recently, one of my friend had a requirement to check for the Eventlog Service state and the startup type. Though I was pretty sure that event log service state cannot be changed and only startup type can be changed, still passed on the code to check the state for the service

strComputer = "."



Set objWMIService = GetObject("winmgmts:" &

 "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")



Set colServices = objWMIService.ExecNotificationQuery("Select 

* from __instancemodificationevent " & "within 10 where TargetInstance 

isa 'Win32_Service'")



i = 0

Do While i = 0

    Set objService = colServices.NextEvent

    If objService.TargetInstance.State <> _ 

        objService.PreviousInstance.State Then

        Wscript.Echo objService.TargetInstance.Name &  " is " & 

objService.TargetInstance.State & ". The service previously was " & 

objService.PreviousInstance.State & "."

        		

    If objService.TargetInstance.Name="Alerter" Then

        Set objWMIService = GetObject("winmgmts:" 

& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

 Set colProcessList = objWMIService.ExecQuery ("Select * from Win32_Process

Where Name = 'Notepad.exe'")

	

		For Each objProcess in colProcessList

			objProcess.Terminate()

		Next

End if

    End If

Loop

And the following to check the Service Startup state,

strComputer = "."

Set objWMIService = GetObject("winmgmts:" _

& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colServiceList = objWMIService.ExecQuery _

("Select * from Win32_Service where StartMode = 'Manual'")

For Each objService in colServiceList

Msgbox objService.Name

Next

and was pretty sure on the code, so I tested with “Alerter” service as I was lazy to reboot the machine. That guy was pretty cool and used in his code….

He started testing the code by changing the startup type of the event log service, immedietly the code plunked !!! It threw an error “Dependent Service Not Found!!!”

I was little confused, and when I checked the WMI Service, the service was dependent on Eventlog service !!!!!!!!!!!!!! I really do not know this….

Man… Still I Could not find out the reason why WMI is dependent on Event Log Service ????!!! Anybody ???? To me there are no logical reasons behind this ??? alternative checking @ registry…. Somehow I always consider touching registry is ugly !!!

Finally, WMI Dosen’t work if my eventlog is stopped…. Huh….. learned something new !!!!


Can somebody tell me the reason behind this behaviour ? Any Takers ?!!!


posted by Logu Krishnan : 7:54 AM