WMI request in C # does not work on NON-English Machine

Question

I am creating an application that needs to be tracked when the process starts, and then raises an event when it ends.

I have code that works just fine and does exactly what I need on an English machine, but when I run the same application on a machine in French, it fails.

here is the code that doesn't work

qstart = new WqlEventQuery("__InstanceCreationEvent", new TimeSpan(0, 0, 0, 0, 5), "TargetInstance isa \"Win32_Process\""); qstop = new WqlEventQuery("__InstanceDeletionEvent", new TimeSpan(0, 0, 0, 0, 5), "TargetInstance isa \"Win32_Process\""); try { using (wstart = new ManagementEventWatcher(qstart)) { wstart.EventArrived += new EventArrivedEventHandler(ProcessStarted); Log.DebugEntry("BeginProcess() - Starting wstart Event"); wstart.Start(); } } catch (Exception ex) { Log.DebugEntry("error on wstart: " + ex.Message); } using (wstop = new ManagementEventWatcher(qstop)) { wstop.EventArrived += new EventArrivedEventHandler(ProcessStopped); Log.DebugEntry("BeginProcess() - Starting wstop Event"); wstop.Start(); } 

An error occurred while trying to start the request: wstart.Start ();

and does the same for wstop.Start ();

I can only guess that this has something to do with the language and query string, but I am squeezing a straw.

An error occurred: "require unanalyzable"

Any help gratefully received!

Martyn

Edit: tested on two identical machines, only the difference is the language selected at the first start.

Answer 1

Apparently, this is because the interval you specified is too small ... I just tried it on French Windows XP SP3 and got the same error. But if I change the interval to 1 second instead, it works fine ... It seems you cannot specify an interval less than 1 second. Not sure why this only happens on a non-English OS, though ...

EDIT: Actually, I just realized that this is a bug in WqlEventQuery . qstart.QueryString looks like this: CurrentCulture = "en-US":

 select * from __InstanceCreationEvent within 0.005 where TargetInstance isa "Win32_Process" 

But with CurrentCulture = "fr-FR" it looks like this:

 select * from __InstanceCreationEvent within 0,005 where TargetInstance isa "Win32_Process" 

(note the difference in number format)

Thus, it is obvious that the code in WqlEventQuery does not force you to use an invariant culture to format the number, making the request incorrect in cultures where the decimal separator is not "."

If you click CurrentCulture on CultureInfo.Invariant , the request works fine even on the French OS. You can also manually write a WQL query ...