WMI query in C# does not work on NON-English Machine

Question

I am creating an application that needs to track when a process starts, then raise an event when it's finished.

I have code that works perfectly, and does exactly what I need on an English machine, but when I run the same application on a French language machine it fails.

here's the code that fails

qstart = new WqlEventQuery("__InstanceCreationEvent",
            new TimeSpan(0, 0, 0, 0, 5),
            "TargetInstance isa \"Win32_Process\"");

qstop = new WqlEventQuery("__InstanceDeletionEvent",
            new TimeSpan(0, 0, 0, 0, 5),
            "TargetInstance isa \"Win32_Process\"");
        try
        {
            using (wstart = new ManagementEventWatcher(qstart))
            {
                wstart.EventArrived += new EventArrivedEventHandler(ProcessStarted);
                Log.DebugEntry("BeginProcess() - Starting wstart Event");
                wstart.Start();
            }
        }
        catch (Exception ex)
        {
            Log.DebugEntry("error on wstart: " + ex.Message);
        }

        using (wstop = new ManagementEventWatcher(qstop))
        {
            wstop.EventArrived += new EventArrivedEventHandler(ProcessStopped);
            Log.DebugEntry("BeginProcess() - Starting wstop Event");
            wstop.Start();
        }

the error hits when it tries to start the query: wstart.Start();

and does the same for wstop.Start();

I can only guess it has something to do with the language and the query string, but I'm clutching at straws.

The error it comes up with is: "demande non analysable"

Any help is gratefully recieved!

Martyn

Edit: Tested on 2 identical Machines, only difference being the language chosen on first startup.

Answer 1

Apparently its because the interval you specified is too small... I just tried it on a French Windows XP SP3, and got the same error. But if I change the interval to 1 second instead, it works fine... It seems you can't specify an interval smaller than 1 second. Not sure why this only happens on a non-English OS, though...

EDIT: actually I just realized it's probably a bug in WqlEventQuery. The qstart.QueryString looks like that with CurrentCulture = "en-US" :

select * from __InstanceCreationEvent within 0.005 where TargetInstance isa "Win32_Process"

But with CurrentCulture = "fr-FR" it looks like that:

select * from __InstanceCreationEvent within 0,005 where TargetInstance isa "Win32_Process"

(note the difference in the number format)

So apparently the code in WqlEventQuery doesn't force the use of the invariant culture to format the number, making the query incorrect in cultures where the decimal separator is not "."

If you force the CurrentCulture to CultureInfo.Invariant, the query works fine, even on a French OS. You can also write the WQL query manually...