WMI太慢了

Question

有沒有辦法限制WMI用WQL語句檢索的條目數？ 我這樣說是因爲運行一個查詢來檢索所有的Win32_NTLogEvent實例正在取得永久！我真正需要的是最近的事件（大約一週，或2000條目）

這是我用來獲取日誌數據的代碼片段。其他查詢，如Win32_Processor，很好，很快。

  if (Configuration.OnlyErrorLogs) 
      { 
       // If Information logs should be suppressed, only get events where event type is not 3 
       WMIDataTemp1 = DataRetriever.GetWMIData("Win32_NTLogEvent", "EventType<>3"); 
      } 
      else 
      { 
       WMIDataTemp1 = DataRetriever.GetWMIData("Win32_NTLogEvent"); 
      } 
      foreach (ManagementObject Object in WMIDataTemp1) 
      { 
       this.Log.Add(new Log(Object)); 
      } 

而且功能獲得WMI數據如下：

public static ManagementObject[] GetWMIData(string wmiClass) { return GetWMIData(wmiClass, "", "CIMV2"); } 
    public static ManagementObject[] GetWMIData(string wmiClass, string whereClause) { return GetWMIData(wmiClass, whereClause, "CIMV2"); } 
    public static ManagementObject[] GetWMIData(string wmiClass, string whereClause, string nameSpace) 
    { 
     try 
     { 
      // If a where clause has been set, prepare the clause to add to the query string 
      if (whereClause != "") 
      { 
       whereClause = " WHERE " + whereClause; 
      } 
      // Create a search query 
      string query = "SELECT * FROM " + wmiClass + whereClause; 
      ManagementObjectSearcher wmiSearcher = new ManagementObjectSearcher("root\\" + nameSpace, query); 
      ManagementObjectCollection matches = wmiSearcher.Get(); 

      // Create an array to hold the matches 
      ManagementObject[] matchArray = new ManagementObject[matches.Count]; 

      // If matches found, copy to output 
      if(matches.Count > 0) 
      { 
       // Copy the search matches into this array 
       matches.CopyTo(matchArray, 0); 
      } 

      // Return array 
      return matchArray; 
     } 
     catch (Exception e) 
     { 
      ErrorDialogue errorReporter = new ErrorDialogue(e); 
      return null; 
     } 
    } 

如果每個日誌被存儲：

public class Log 
{ 
    public string Category = "N/A"; 
    public string DateTime = "N/A"; 
    public UInt16 ID = 0; 
    public string Level = "N/A"; 
    public string Message = "N/A"; 
    public string Source = "N/A"; 

    public Log() { } 
    public Log(ManagementObject wmiLogEvent) 
    { 
     this.GetInfo(wmiLogEvent); 
    } 

    public void GetInfo(ManagementObject wmiLogEvent) 
    { 
     try 
     { 
      this.Category = DataRetriever.GetValue(wmiLogEvent, "CategoryString"); 
      this.DateTime = DataRetriever.GetValue(wmiLogEvent, "TimeGenerated"); 
      this.ID = DataRetriever.GetValueUInt16(wmiLogEvent, "EventIdentifier"); 
      this.Level = DataRetriever.ConvertEventType(DataRetriever.GetValueUInt16(wmiLogEvent, "CategoryString")); 
      this.Message = DataRetriever.GetValue(wmiLogEvent, "Message"); 
      this.Source = DataRetriever.GetValue(wmiLogEvent, "SourceName"); 
     } 
     catch (Exception e) 
     { 
      ErrorDialogue errorReporter = new ErrorDialogue(e); 
     } 
    } 
} 

Answer 1

現在使用System.Diagnostics.EventLog類作爲更快的選擇。與WMI相比，該計劃更有益處。

http://msdn.microsoft.com/en-us/library/system.diagnostics.eventlog.aspx

Answer 2

一種選擇是使用WHERE子句指定的範圍內你想要的條目...

例如，你可以使用TimeGenerated在WHERE子句中指定基於時間的範圍...

另一個選項是在創建ManagementObjectSearcher時相應地設置BlockSize。

您可以使用它來指定您想要每次調用2000個條目 - 例如與ORDER BY TimeGenerated DESC一起，這應該會給出一個很好的結果。

Answer 3

速度對於WMI來說並不是一個強項。它往往是相當記憶密集的。但是，這個問題已經得到解決，您可以做幾件事情。從Microsoft TechNet檢出Why are my queries taking such a long time to complete?。