WMI contains an event infrastructure that produces notifications about changes in WMI data and services. WMI event classes provide notification when specific events occur.

User can create a semisynchronous or asynchronous query to monitor changes to event logs, process creation, service status, computer availability or disk drive free space, and other entities or events.

In C++, IWbemServices::ExecNotificationQueryAsync() is used to get the callback in case of event creation/deletion/modification.

 

AMPS (DASHService) uses WMI event registration mechanism to get notified about changes in deployment classes of SCCM. We observed following issues in large scale enterprise infrastructure while using this mechanism :

 

  • WMI Event Registration failed. While registration for change in event for class SMS_ApplicationAssignment,  ExecNotificationQueryAsync() method failed with error code WBEM_E_QUOTA_VIOLATION.

pic.png

  • WMI Event notification not received even if WMI Event registration was successful.Notification query failed with error code WBEM_E_CALL_CANCELLED.

Picture2.png

AMD discussed with Microsoft about the same and filed following bugs for these issues:

https://connect.microsoft.com/ConfigurationManagervnext/feedback/details/3126741/wmi-event-registration-failed

https://connect.microsoft.com/ConfigurationManagervnext/feedback/details/3126744/wmi-event-notification-issue

 

Workaround :We proposes to increase polling memory per user and polling memory total to solve this issue as workaround.

Please refer to below blog to change polling memory settings:

HOW TO CHANGE POLLING MEMORY IN WMI