c# - 通过 C# 和 WMI 的 RegistryTreeChangeEvent

Question

我收到这个错误:

未处理的异常:System.Runtime.InteropServices.COMException (0x80042001):HRESULT 异常:0x80042001 在 System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode，IntPtr errorInfo) 在 System.Management.ManagementEventWatcher.Start() 在 MyNamespace.Program.Main(String[] args) 在 {somedir}\Program.cs:line 16

这是我用来查看注册表的 C# 控制台应用程序:

using System;
using System.Management;

namespace MyNamespace
{
    class Program
    {
        static void Main(string[] args)
        {

        var watcher = new ManagementEventWatcher(new WqlEventQuery("SELECT * FROM RegistryTreeChangeEvent"));
        var handler = new MyHandler();
        watcher.EventArrived += handler.Arrived;

        //Start watching for events
        watcher.Start();

        while (handler.EventHasntFiredYet)
        {
            // Nothing.
        }

        //Stop watching
        watcher.Stop();
    }

    public class MyHandler
    {
        public bool EventHasntFiredYet;

        public MyHandler()
        {
            EventHasntFiredYet = true;
        }

        public void Arrived(object sender, EventArrivedEventArgs e)
        {
            var propertyDataCollection = e.NewEvent.Properties;
            foreach (var p in propertyDataCollection)
            {
                Console.WriteLine("{0} -- {1}",p.Name,p.Value);
            }
            EventHasntFiredYet = false;
        }
    }
}

我试图简单地观察注册表的变化。有没有人对为什么失败有任何建议？

Answer 1

这是一个内部 WMI 错误，WBEMESS_E_REGISTRATION_TOO_BROAD，“提供者注册与系统事件域重叠。”

当您离开 COM 时，这是一条很好的错误消息。引人注目的是 .NET 异常消息有多好。 Anyhoo，我相当确定它的意思是“你要求的事件太多了”。您必须在查询中更具选择性，使用 WHERE 子句。喜欢:

SELECT * FROM RegistryTreeChangeEvent
WHERE Hive='HKEY_LOCAL_MACHINE' AND'RootPath='SOFTWARE\Microsoft'

---

在 Giorgi 的提示下，我找到了 MSDN page记录问题:

The following is an example of an incorrect registration.

SELECT * FROM RegistryTreeChangeEventWHERE hive = hkey_local_machine" ORrootpath ="software"

Because there is no way to evaluate the possible values for each of the properties, WMI rejects with the error WBEM_E_TOO_BROAD any query that either does not have a WHERE clause or if the WHERE clause is too broad to be of any use.