WMI Event Registration Leak (327542)
The information in this article applies to:
- Microsoft Windows 2000 Server
- Microsoft Windows 2000 Advanced Server
- Microsoft Windows 2000 Professional
This article was previously published under Q327542 SYMPTOMS Windows Management Instrumentation (WMI) does not tear down
temporary event registrations when the corresponding sink becomes invalid. An
invalid sink can occur in the following scenarios:
- A client did not cancel the event registration
(IWbemServices::CancelAsyncCall).
- The sink object was deleted before the reference count
reached zero.
- Hardware failure.
- The client process was not gracefully ended.
Because of the invalid sink, events are continually generated
to be queued for the consumer until the Winmgmt service is restarted. As a
result, the Winmgmt process uses a large amount of CPU and memory
resources. CAUSEWhen the Winmgmt service tries to call the sink on a client
that has quit unexpectedly, an "RPC Server Unavailable (0x800706BA)" error
occurs. (Alternatively, this behavior also occurs in Unsecapp.exe if the
callback is made through an IUnsecuredApartment interface.) WMI cannot
distinguish if the event delivery was unsuccessful because of a temporary
network issue or because the client system quit unexpectedly. This error
indicates that the target for the call was not currently available. Because the
client did not cancel the event registration, WMI continues to call the client
hoping to get events through when network connectivity is reestablished. Each
event is timed out and discarded in the internal WMI event queue for the
consumer, but the registration itself does not get timed out.RESOLUTIONService Pack InformationTo resolve this problem, obtain the latest service pack for Microsoft Windows 2000. For additional information, click the following article number to view the article in the Microsoft Knowledge Base: 260910 How to Obtain the Latest Windows 2000 Service Pack Hotfix InformationA supported fix is now available
from Microsoft, but it is only intended to correct the problem that is
described in this article. Apply it only to computers that are experiencing
this specific problem. This fix may receive additional testing. Therefore, if
you are not severely affected by this problem, Microsoft recommends that you
wait for the next Windows 2000 service pack that contains this hotfix. To
resolve this problem immediately, contact Microsoft Product Support Services to
obtain the fix. For a complete list of Microsoft Product Support Services phone
numbers and information about support costs, visit the following Microsoft Web
site: NOTE: In special cases, charges that are ordinarily incurred for
support calls may be canceled if a Microsoft Support Professional determines
that a specific update will resolve your problem. The typical support costs
will apply to additional support questions and issues that do not qualify for
the specific update in question. The English version of
this fix has the file attributes (or later) that are listed in the following
table. The dates and times for these files are listed in coordinated universal
time (UTC). When you view the file information, it is converted to local time.
To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.
Date Time Version Size File name
--------------------------------------------------------
25-Sep-2002 10:40 1.50.1085.88 643,146 Wbemcore.dll
STATUSMicrosoft
has confirmed that this is a problem in the Microsoft products that are listed
at the beginning of this article.
This problem was first corrected in Microsoft Windows 2000 Service Pack 4.
| Modification Type: | Minor | Last Reviewed: | 10/11/2005 |
|---|
| Keywords: | kbHotfixServer kbQFE kbQFE kbWin2kSP4fix kbSysAdmin kbbug kbfix kbWin2000preSP4Fix KB327542 |
|---|
|