Filemon Windowx XP System32 WBEM wmiprov & wbemess log
 

Tom,

Yes. For the average user these logs make no sense and can just as well be
disabled.

To discover more about WMI...

There is a super secret hidden very little known item on your machine. It
is called Help and Support. Accessed from the Start Menu.

Type or paste in the Search box and click the arrow.

WMI
WMI overview

WMI Control HELP
Start | Run | Paste this in the box and click OK...

hh newfeat1.chm::/wmi_s0.htm

How To Use Computer Management in Windows XP
http://support.microsoft.com/default...b;en-us;308423

wmi logging
http://search.msdn.microsoft.com/sea...=4&s=1 &swc=4

(Note the table of contents pane on the left)
Windows Management Instrumentation
http://msdn.microsoft.com/library/de...start_page.asp

Support articles for Windows Management Instrumentation
http://search.msdn.microsoft.com/sea...tion&s=1&swc=4

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In ,
Tom Quan hunted and pecked:
On Sun, 18 Dec 2005 12:50:28 -0700, Wesley Vogel wrote:
I did not post anything about the Windows Management Instrumentation
service. Leave it set to Automatic in services.msc.
I suggested disabling WMI logging.

Oh. OK. I am less confused now. Thank you for your patience. I've never
encountered this thing called windows management instrumentation before so
I'm starting with a knowledge base of zero (other than what I glean from
google and learn from you from your kind efforts).

I right clicked on the WinXP SP2 "My Computer", pressed "Manage",
"Services and Applications", and right clicked on "WMI Control",
"Properties" which then said "Connecting to Windows Management" and
brought up a 5-tab "WMI Control Properties" form.

Pressing on the "Logging" tab for the first time, I see it was actually
set to "Errors only". As a test, I set it next to "Verbose" and noticed
LOTS of new logs showed up in C:\windows\system32\wbem\Logs, e.g.,
Framework.log, provss.log, wbemcore.log, WinMgmt.log, wbemprox.log, etc.

Looking in the various logs, I find strange reports such as:
CWbemProviderGlue::Init 12/18/2005 11:14:14.228 thread:3982
[d:\xpsprtm\admin\wmi\wbem\sdk\framedyn\wbemglue.cp p.199]
Failed to open thread token: (1008) 12/18/2005 11:14:14.228 thread:3984
But my D: drive is almost wholly empty (except for something hidden called
"System Volume Information" and "MSOCache".

Do these tell us anything?