Search code examples
c++vbscriptwindows-7wmi

Unparsable MOF Query When Trying to Register Event


Update 2

I accepted an answer and asked a different question elsewhere, where I am still trying to get to the bottom of this.

I don't think that one-lining this query is the answer, as I am still not getting the required results (and multi-lining queries is allowed in .mof, as shown in the URLs in comments to the answer ...


Update

I rewrote the query as a one-liner as suggested, but still got the same error! As it was still talking about lines 11-19 I knew there must be another issue. After saving a new file with the change, I reran mofcomp and it appears to have loaded, but the event which I have subscribed to simply does not work.

I really feel that there is not enough documentation on this topic and it is hard to work out how I am meant to debug this - any help on this would be much appreciated, even if this means using a different more appropriate method.


I have the following .mof file, which I would like to use to register an event on my system :

#pragma namespace("\\\\.\\root\\subscription")

instance of __EventFilter as $EventFilter
{
    Name  = "Event Filter Instance Name";
    Query = "Select * from __InstanceCreationEvent within 1 "
            "where targetInstance isa \"Cim_DirectoryContainsFile\" "
            "and targetInstance.GroupComponent = \"Win32_Directory.Name=\"c:\\\\test\"\"";
    QueryLanguage = "WQL";
    EventNamespace = "Root\\Cimv2";
};

instance of ActiveScriptEventConsumer as $Consumer
{
    Name = "TestConsumer";
    ScriptingEngine = "VBScript";
    ScriptText =
    "Set objFSO = CreateObject(\"Scripting.FileSystemObject\")\n"
    "Set objFile = objFSO.OpenTextFile(\"c:\\test\\Log.txt\", 8, True)\n"
    "objFile.WriteLine Time & \" \" & \" File Created\"\n"
    "objFile.Close\n";
    
    // Specify any other relevant properties.
};

instance of __FilterToConsumerBinding
{
    Filter = $EventFilter;
    Consumer = $Consumer;
}; 

But whenever I run the command mfcomp myfile.mof I am getting this error:

Parsing MOF file: myfile.mof

MOF file has been successfully parsed

Storing data in the repository...

An error occurred while processing item 1 defined on lines 11 - 19 in file myfile.mof:

Error Number: 0x80041058, Facility: WMI

Description: Unparsable query.

Compiler returned error 0x80041058

This error appears to be caused by incorrect syntax in the query, but I don't understand where I have gone wrong with this - is anyone able to advise?


Solution

  • There are no string concatenation or line continuation characters being used in building "Query". To keep it simple, you could put the entire query on one line.