CreateWmiEventSink returns empty *cim.WmiInstances onObjectReady
Open
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 58
- Forks
- 23
- PR merge metrics
- No merged PRs in 30d
Description
Trying to create a consumer for Events in the Security log as follows:
ctx := context.TODO()
sessionManager := wmi.NewWmiSessionManager()
defer sessionManager.Dispose()
session, err := sessionManager.GetLocalSession("ROOT\\CimV2")
if err != nil {
log.Printf("sessionManager.GetSession failed with error %v", err)
return
}
connected, err := session.Connect()
if !connected || err != nil {
log.Printf("session.Connect failed with error %v", err)
return
}
defer session.Close()
log.Print("Creating WMI Sink")
eventSink, err := wmi.CreateWmiEventSink(session, &ctx, onObjectReady, onCompleted, onProgress, onObjectPut)
if err != nil {
log.Printf("CreateWmiEventSink failed with error '%v'", err)
return
}
defer eventSink.Close()
_, err = eventSink.Connect()
if err != nil {
log.Printf("Connect failed with error '%v'", err)
return
}
log.Print("Subscribing to query")
_, err = session.ExecNotificationQueryAsync(eventSink, "SELECT * FROM __InstanceCreationEvent WITHIN 100 WHERE TargetInstance ISA 'Win32_NTLogEvent' AND TargetInstance.EventCode = '4742'")
if err != nil {
log.Printf("CallMethod failed with error '%v'", err)
return
}
log.Printf("Starting Main Loop")
for {
time.Sleep(1 * time.Second)
for eventSink.PeekAndDispatchMessages() {
}
}
wmInstances on the function arrives with an empty interface. The expected result would be a WMIInstance where I could retrieve the property TargetInstance
func onObjectReady(context interface{}, wmiInstances []*cim.WmiInstance) {
log.Print("ObjectReady")
fmt.Printf("context: %v\n", context)
target := wmiInstances[0]
}
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with CreateWmiEventSink, its onObjectReady callback, and the ExecNotificationQueryAsync path shown in the report. Reproduce the Win32_NTLogEvent query and inspect how the callback receives wmiInstances; done means onObjectReady receives a populated WmiInstance whose TargetInstance property can be retrieved.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- operating-systems
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100