5

I am creating an application that needs to track when a process starts, then raise an event when it's finished.

I have code that works perfectly, and does exactly what I need on an English machine, but when I run the same application on a French language machine it fails.

here's the code that fails

qstart = new WqlEventQuery("__InstanceCreationEvent",
            new TimeSpan(0, 0, 0, 0, 5),
            "TargetInstance isa \"Win32_Process\"");

qstop = new WqlEventQuery("__InstanceDeletionEvent",
            new TimeSpan(0, 0, 0, 0, 5),
            "TargetInstance isa \"Win32_Process\"");
        try
        {
            using (wstart = new ManagementEventWatcher(qstart))
            {
                wstart.EventArrived += new EventArrivedEventHandler(ProcessStarted);
                Log.DebugEntry("BeginProcess() - Starting wstart Event");
                wstart.Start();
            }
        }
        catch (Exception ex)
        {
            Log.DebugEntry("error on wstart: " + ex.Message);
        }

        using (wstop = new ManagementEventWatcher(qstop))
        {
            wstop.EventArrived += new EventArrivedEventHandler(ProcessStopped);
            Log.DebugEntry("BeginProcess() - Starting wstop Event");
            wstop.Start();
        }

the error hits when it tries to start the query: wstart.Start();

and does the same for wstop.Start();

I can only guess it has something to do with the language and the query string, but I'm clutching at straws.

The error it comes up with is: "demande non analysable"

Any help is gratefully recieved!

Martyn

Edit: Tested on 2 identical Machines, only difference being the language chosen on first startup.

RRUZ
  • 134,889
  • 20
  • 356
  • 483
SmithMart
  • 2,731
  • 18
  • 35
  • Are you sure it's locale that is the only difference? What about operating system version and Service Pack? As far as I know, locale won't impact if a query could be parsed (The English error is "Unparsable query"). – vcsjones May 10 '11 at 16:54
  • I can't be 100% sure, But both machines have the same .net 3.5 and are both out of the box new. They are also both running windows 7 starter. I'll see if I can find another machine that I can start in a different language to test. – SmithMart May 10 '11 at 19:11
  • I have 2 of the same laptop and have tested this on one started with english. So definitly something to do with the language the machine is started with. – SmithMart May 11 '11 at 08:47

1 Answers1

7

Apparently its because the interval you specified is too small... I just tried it on a French Windows XP SP3, and got the same error. But if I change the interval to 1 second instead, it works fine... It seems you can't specify an interval smaller than 1 second. Not sure why this only happens on a non-English OS, though...

EDIT: actually I just realized it's probably a bug in WqlEventQuery. The qstart.QueryString looks like that with CurrentCulture = "en-US" :

select * from __InstanceCreationEvent within 0.005 where TargetInstance isa "Win32_Process"

But with CurrentCulture = "fr-FR" it looks like that:

select * from __InstanceCreationEvent within 0,005 where TargetInstance isa "Win32_Process"

(note the difference in the number format)

So apparently the code in WqlEventQuery doesn't force the use of the invariant culture to format the number, making the query incorrect in cultures where the decimal separator is not "."

If you force the CurrentCulture to CultureInfo.Invariant, the query works fine, even on a French OS. You can also write the WQL query manually...

Thomas Levesque
  • 286,951
  • 70
  • 623
  • 758
  • Wow, Thats annoying! I have to admit it hadn't crossed my mind that it would be affected by that, as it's been working perfectly fine on english! Well, you're answer is correct, I changed it to 1 second and it works. Massive thanks – SmithMart May 11 '11 at 10:06
  • @SmithSmart: actually it seems to be a culture-related bug in WqlEventQuery, see my updated answer – Thomas Levesque May 11 '11 at 10:15
  • Awesome, I'd accept your answer twice if I could, being able to check in less than a second helps as I check the start process then all child processes. Great information. – SmithMart May 11 '11 at 10:20
  • Why don't you raise a bug at http://connect.microsoft.com/ so that it can be fixed in the framework. – softveda May 11 '11 at 11:11
  • @Pratik, I did, but I had to leave so I didn't post the link at once... https://connect.microsoft.com/VisualStudio/feedback/details/667894/wqleventquery-doesnt-format-the-interval-correctly-in-some-non-english-cultures-leading-to-unparsablequery-error – Thomas Levesque May 11 '11 at 11:26