Uploaded image for project: 'ZABBIX BUGS AND ISSUES'
  1. ZABBIX BUGS AND ISSUES
  2. ZBX-18859

wmi.get commands cause event 5858

    XMLWordPrintable

Details

    • Problem report
    • Status: Confirmed
    • Major
    • Resolution: Unresolved
    • 5.2.3
    • None
    • Agent (G)
    • None
    • Windows 10 19042.685

    Description

      This is a regression from ZBX-11621, or at least that fixed bug looks extremely similar to this one. Apparently this error happens if a WMI client does not fully read the result set before closing it.

      My current hypothesis is that parse_first_first() should read the result until it gets a WBEM_S_NO_MORE_DATA result rather than returning after reading the first record. The current documentation for IWbemClassObject::Next() does not mention this protocol, but that for [IWbemClassObject::NextMethod() does.

      Steps to reproduce:

      1. zabbix_get -s ... -k wmi.get["root\cimv2","Select serialnumber from win32_bios"]
      2. On the target system, open Event Viewer and look at the Microsoft-Windows-WMI-Activity/Operational log.

      Result:
      There is an error event 5858 with event data similar to this:

      Id = {00000000-0000-0000-0000-000000000000}; ClientMachine = ...; User = NT AUTHORITY\SYSTEM; ClientProcessId = 10724; Component = Unknown; Operation = Start IWbemServices::ExecQuery - root\cimv2 : select AddressWidth from Win32_Processor; ResultCode = 0x80041032; PossibleCause = Unknown

      Expected:
      No error events.

      Attachments

        Activity

          People

            zabbix.dev Zabbix Development Team
            chrullrich Christian Ullrich
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated: