windows服务器WMI错误事件Event filter with query造成死机重启的解决方法

只看楼主收藏回复

• 酷站领地

  主机因WMI的事件10出现自动重启或死机：
  

  错误日志：

  Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

  XML日志：

  <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System>  <Provider Name="Microsoft-Windows-WMI" Guid="{1edeee53-0afe-4609-b846-d8c0b2075b1f}" EventSourceName="WinMgmt" />  <EventID Qualifiers="49152">10</EventID>  <Version>0</Version>  <Level>2</Level>  <Task>0</Task>  <Opcode>0</Opcode>  <Keywords>0x80000000000000</Keywords>  <TimeCreated SystemTime="2023-12-28T17:17:53.000000000Z" />  <EventRecordID>16509</EventRecordID>  <Correlation />  <Execution ProcessID="0" ThreadID="0" />  <Channel>Application</Channel>  <Computer>A-201705061927</Computer>  <Security />  </System> <EventData>  <Data>//./root/CIMV2</Data>  <Data>SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99</Data>  <Data>0x80041003</Data>  </EventData>  </Event>

  解决办法：

  建立一个 test.vbs 文件，贴入如下内容，保存，然后以管理员模式运行cmd，在cmd里执行test.vbs

  strComputer = "."

  Set objWMIService = GetObject("winmgmts:" _

  & "{impersonationLevel=impersonate}!\\" _

  & strComputer & "\root\subscription")

  Set obj1 = objWMIService.ExecQuery("select * from __eventfilter where name='BVTFilter' and query='SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA ""Win32_Processor"" AND TargetInstance.LoadPercentage > 99'")

  For Each obj1elem in obj1

  set obj2set = obj1elem.Associators_("__FilterToConsumerBinding")

  set obj3set = obj1elem.References_("__FilterToConsumerBinding")

  For each obj2 in obj2set

  WScript.echo "Deleting the object"

  WScript.echo obj2.GetObjectText_

  obj2.Delete_

  next

  For each obj3 in obj3set

  WScript.echo "Deleting the object"

  WScript.echo obj3.GetObjectText_

  obj3.Delete_

  next

  WScript.echo "Deleting the object"

  WScript.echo obj1elem.GetObjectText_

  obj1elem.Delete_

  Next

  或者到这里下载VBS文件http://soft.jy6d.com/v/20240114104852.html

  
  

  1楼  2024/7/3 10:53:55  回复