Peramanent event consumer(WMI) in c#

[Dheeraj Joshi]

I have been trying to register a permanent event consumer in a remote machine, i am able to register for an event, but when the event occurs in remote machine it wont forward back the response...

Code for registering

connOptions = new ConnectionOptions();
connOptions.Username = "10.50.27.103\\testadmin";
connOptions.Password = "Tel12345";
connOptions.Authentication = AuthenticationLevel.PacketPrivacy;
connOptions.EnablePrivileges = true;
connOptions.Impersonation = ImpersonationLevel.Impersonate;
mScope = new ManagementScope("\\10.50.27.103\\root\\subsription", connOptions);
                mScope.Connect();
if (mScope.IsConnected)
{
Console.WriteLine(SystemName + "Connection Successfull");
 
ObjectGetOptions goption = new ObjectGetOptions();
 
ManagementClass objEventFilterClass = new                                                                       ManagementClass("\\\\10.50.27.103\\root\\subscription",
                                                        "__EventFilter", null);
                    objEventFilterClass.Scope = mScope;
 
ManagementObject mgmtobj = objEventFilterClass.CreateInstance();
mgmtobj["CreatorSID"] = null;
mgmtobj["EventNamespace"] = "\\\\10.50.27.103\\root\\cimv2";
mgmtobj["Name"] = "cmdListner";
mgmtobj["Query"] = "SELECT * FROM __InstanceCreationEvent WITHIN 10 WHERE " +
                        "TargetInstance ISA \"Win32_Process\"" +
                        " AND TargetInstance.Name = \"cmd.exe\"";
 
mgmtobj["QueryLanguage"] = "WQL";
mgmtobj.Put(options);
 
string[] strArr = { "10.50.26.217" };
 
 
ManagementClass objForwardingConsumerClass = new ManagementClass("\\\\10.50.27.103\\root\\subscription",
                                                                "MSFT_ForwardingConsumer", goption);
 
objForwardingConsumerClass.Scope = mScope;
Console.WriteLine("GET OPTION IS" + goption.Context.ToString());
ManagementObject mgmtobj1 = objForwardingConsumerClass.CreateInstance();
 
mgmtobj1["CreatorSID"] = null;
mgmtobj1["Name"] = "forwadingCMD";
mgmtobj1["Authenticate"] = false;
mgmtobj1["Targets"] = strArr;
mgmtobj1["Encryption"] = true;
mgmtobj1.Put(options);
 
 
ManagementClass objBindingclass = new ManagementClass("\\\\10.50.27.103\\root\\subscription",
                                                        "__FilterToConsumerBinding", null);
 
objBindingclass.Scope = mScope;
ManagementObject mgmtobjbind = objBindingclass.CreateInstance();
mgmtobjbind["CreatorSID"] = null;
mgmtobjbind["Consumer"] = mgmtobj1;
mgmtobjbind["Filter"] = mgmtobj;
mgmtobjbind.Put(options);
Console.WriteLine(" \\\\10.50.27.103 Registered SucccessFully ");
}
 
else
 
Console.WriteLine("CED4 Connection not succeeded");
 
 

And code for forwarding...

PutOptions options = new PutOptions();
options.Type = PutType.UpdateOrCreate;
 
 
ConnectionOptions connOptions1 = new ConnectionOptions();
connOptions1.Username = "santaji";
connOptions1.Password = "san@124421";
connOptions1.Authentication = AuthenticationLevel.PacketPrivacy;
connOptions1.Impersonation = System.Management.ImpersonationLevel.Impersonate;
connOptions1.EnablePrivileges = true;
connOptions1 = null;
localScope = new ManagementScope("\\\\10.50.26.115\\root\\subscription", connOptions1);
 
localScope.Connect();
if (localScope.IsConnected)
{
 
Console.WriteLine("10.50.26.115  Connection Successfull");
 
PutOptions option = new PutOptions();
option.Type = PutType.UpdateOrCreate;
ObjectGetOptions goption = new ObjectGetOptions();
 
ManagementClass objEventConsumer = new ManagementClass("\\\\10.50.26.115\\root\\subscription",
                                                                "LogFileEventConsumer", goption);
 
objEventConsumer.Scope = localScope;
ManagementObject mgmtoj1 = objEventConsumer.CreateInstance();
mgmtoj1["CreatorSID"] = arrint;
mgmtoj1["Name"] = "Logfile";
mgmtoj1["Filename"] = "D:\\FORWARDTraceLog.csv";
 
mgmtoj1["Text"] = "\"%TargetInstance.Name%\"," +
                                                    "\"%TIME_CREATED%\"" +
                                                    "\"%ProcessId%\"";
mgmtoj1.Put(options);
 
 
ManagementClass objEventFilter = new ManagementClass("\\\\10.50.26.115\\root\\subscription",
                                                        "__EventFilter", null);
 
objEventFilter.Scope = localScope;
 
ManagementObject localmgmt = objEventFilter.CreateInstance();
localmgmt["CreatorSID"] = arrint;
localmgmt["EventNamespace"] = "\\\\10.50.26.115\\Root\\Cimv2";
localmgmt["Name"] = "cmdListnerLocal";
localmgmt["Query"] = "select * from MSFT_ForwardedEvent";
 
 
localmgmt["QueryLanguage"] = "WQL";
localmgmt.Put(options);
 
ManagementClass objBinding = new ManagementClass("\\\\10.50.26.115\\root\\subscription",
                                                        "__FilterToConsumerBinding", null);
 
objBinding.Scope = localScope;
ManagementObject mgmtbind = objBinding.CreateInstance();
mgmtbind["CreatorSID"] = arrint;
mgmtbind["Consumer"] = mgmtoj1;
mgmtbind["Filter"] = localmgmt;
mgmtbind.Put(options);
 
}
else
 
Console.WriteLine("10.50.26.115 Connection not succeeded");
 
 

I have posted entire code snippet.... Its bit long i know. I really appreciate any helps.

Regards
Dheeraj Joshi

[Dheeraj Joshi]

Adding to previous question...

There is no support for permanent event consumer after Windows 2003 server and Vista..

So can we still register permanent events?? If yes, is there any alternative methods? I could not find one.. Any help is appreciated...

Regards
Dheeraj Joshi

[Plater]

EDIT: whoops, that will teach me not to read
So your piece of software, listens for events on a remote machine, then attempts to fire the same event on a different remote machine?

[Dheeraj Joshi]

Basically i am trying to register for an event in PC2(Remote comp).. When event occurs there PC2 is supposed to forward the event notification to my software running on PC1(My machine).

Regards
Dheeraj Joshi

[Plater]

Hmm well I cannot seem to attach to any of the winXP Pro systems in my network (spent the last hour trying to deal with "RPC server not available" exception)
I could connect to my 2003 server computer, but I cannot find any events in the namespace that ever fire.

is your forwarded notification getting blocked by a firewall or anything?

[Dheeraj Joshi]

Nop.... In both machines firewall is disabled....

I do register fwdprov.dll by command

regsvr32 fwdprov.dll
 

In wbemess.log file in C:\WINDOWS\system32\wbem\Logs\ (In remote machine PC2)
I get following log entry

(Thu Sep 24 09:53:53 2009.658000) : Consumer provider Microsoft WMI Forwarding Consumer Provider does not support IWbemUnboundObjectSink: error code 80004002

So.. Any idea on this....

Regards
Dheeraj Joshi

[Plater]

I think you know more on the subject then I.

The only way I know how to get a remote event is with code something like this:

try
{
  ConnectionOptions connection = new ConnectionOptions();
  connection.Username = "username";
  connection.Password = "password";
  connection.Authority = "ntlmdomain:mydomain";
 
  ManagementScope scope = new ManagementScope("\\\\remotePC\\root\\CIMV2", connection);
  scope.Connect();
 
  WqlEventQuery query = new WqlEventQuery("SELECT * FROM Win32_DeviceChangeEvent");
 
  ManagementEventWatcher watcher = new ManagementEventWatcher(scope, query);
  ManagementBaseObject eventObj = watcher.WaitForNextEvent();
  Console.WriteLine("{0} event occurred.", eventObj["__CLASS"]);
  // Cancel the event subscription
  watcher.Stop();
 
  Close();
  return;
}
catch(ManagementException err)
{
  MessageBox.Show("An error occurred while trying to receive an event: " + err.Message);
}
catch(System.UnauthorizedAccessException unauthorizedErr)
{
  MessageBox.Show("Connection error (user name or password might be incorrect): " + unauthorizedErr.Message);
}
 

[Dheeraj Joshi]

Hey PLATER...

Your code works fine if it was temporary event consumer..and i have a working code with me... It is similar to your code...

But i want to solve this permanent event consumer :(

And one more info we need to register a MOF file before registering for permanent event.. I did that too..... But no luck yet....

Regards
Dheeraj Joshi

[Plater]

I guess I don't know what a permanent event consumer is.
With slight modifications, that code will receieve remote events as long as the program is running.

[Dheeraj Joshi]

I don't want to do re registration for events in remote machine every time when the machine stops and starts again... So i am trying to register for an event permanently(which notifies the event till it is externally unregistered.... )

Regards
Dheeraj Joshi

[Dheeraj Joshi]

Hi... Here are few updates on my problem.... I have tried to get the event notification via SMTP too.

I am able to see the instance of SMTPEventConsumer is getting created by wbemtest tool... But even this logs the same error as i mentioned in the previous post(When it tries to give notification) . So, i seriously doubt i am missing some configuration steps.
(I do register smtpconf.dll and mof file prior to registration...

Any inputs are appreciated.............. :(

Regards
Dheeraj Joshi

[sumitrawani]

I'm trying to connect to a remote machine and receive events. I'm able to run WMI queries on the remote machine but unable to get events (using temporary consumer method).
I tried the code by platter, still can't receive any events, any updates?

Thanks,
Sumit