Debugging (tracing) WMI requests?

Question

I have a third-party program that makes WMI requests to local WMI providers (therefore, it does not use DCOM, therefore there are no sniffer packets). I would like to know what it is.

It is also on XP, so the new WMI Vista tracking infrastructure is missing, unfortunately.

Any pointers?

Answer 1

Have you tried setting WMI logging level in Verbose using wmimgmt.msc? (More Information on the WMI Logging Page on MSDN )

Then you should look at the requests registered in the% windir% \ system32 \ wbem \ logs \ wbemcore.log file.

-dave

Answer 2

, WMI DCOM , WireShark DCOM. , WireShark DCOM , (, ).

WMI localhost, , .

, MSDN WMI.