5

I want to do something with WMI (receiving some event notification) so I start with simple example from MSDN website:

Receiving Event Notifications Through WMI

this program receives an event notification (process creation) through WMI, and calls the function EventSink::Indicate upon receiving the event.

I used the same code in the link above (copy/past) with one change: in the class EventSink, the function 

HRESULT EventSink::Indicate(long lObjectCount, IWbemClassObject **apObjArray)

I added few lines to retrieve a property of the object (the object is returned in apObjArray):

 for (int i = 0; i < lObjectCount; i++)
    {
        VARIANT varName;
        hres = apObjArray[i]->Get(_bstr_t(L"Name"),
            0, &varName, 0, 0);
//...
    }

now the Get(...) functions returns WBEM_E_NOT_FOUND (The specified property is not found) no matter what I look for (am sure from the documentation that the properties are there...)

please let me know what have I missed ?! any help is appreciated.

aiman09
  • 105
  • 8

2 Answers2

11

The Name property is part of the TargetInstance object, so you must get the value of the TargetInstance object and then retrieve the value of the Name property.

Try this sample

HRESULT EventSink::Indicate(long lObjectCount,
    IWbemClassObject **apObjArray)
{
   HRESULT hr = S_OK;
   _variant_t vtProp;

    for (int i = 0; i < lObjectCount; i++)
    {

    hr = apObjArray[i]->Get(_bstr_t(L"TargetInstance"), 0, &vtProp, 0, 0);
     if (!FAILED(hr))
     {
       IUnknown* str = vtProp;
       hr = str->QueryInterface( IID_IWbemClassObject, reinterpret_cast< void** >( &apObjArray[i] ) );
       if ( SUCCEEDED( hr ) )
       {
          _variant_t cn;
         hr = apObjArray[i]->Get( L"Name", 0, &cn, NULL, NULL );
          if ( SUCCEEDED( hr ) )
          {
            if ((cn.vt==VT_NULL) || (cn.vt==VT_EMPTY))
             wcout << "Name : " << ((cn.vt==VT_NULL) ? "NULL" : "EMPTY") << endl;
            else
             wcout << "Name : " << cn.bstrVal << endl;
          }
          VariantClear(&cn);


       }
     }
     VariantClear(&vtProp);

    }

    return WBEM_S_NO_ERROR;
}
RRUZ
  • 134,889
  • 20
  • 356
  • 483
  • if I have registered for more than one type of event, do you know how to find out the type in the callback ? – Pritesh Acharya Mar 04 '14 at 11:17
  • @RRUZ : Can u help me here : http://stackoverflow.com/questions/28897897/c-monitor-process-creation-and-termination-in-windows/28921442 – Jackzz Mar 09 '15 at 04:03
0

The example above seems to have a memory leak.

IUnknown* str = vtProp;

This assignment uses operator IUnknown* of the _variant_t class, which implicitly calls an AddRef() on the object. So str->Release() needs to be called after usage, since

VariantClear(&vtProp);

is not enough to decrement the ref count of the object.

jo be
  • 21
  • 2