Why would WMI not return a full result set in ManagementObjectCollection?

Running a WMI query using C# .net

Any ideas on why this would not always return all the same events in the time range when the query is run multiple times and also not raise an exception when doing so?

ConnectionOptions opts = new ConnectionOptions();

if (EncryptConnections)
{
    opts.Authentication = AuthenticationLevel.PacketPrivacy;
}

opts.Username = eventSource.user;
opts.SecurePassword = eventSource.password;
opts.Impersonation = ImpersonationLevel.Impersonate;

string location = string.Format("\\\\{0}\\root\\cimv2", eventSource.machine);
ManagementScope scope = new ManagementScope(location, opts);
scope.Connect();

EnumerationOptions enumOptions = new EnumerationOptions();
enum开发者_运维知识库Options.DirectRead = false;
enumOptions.EnumerateDeep = false;
enumOptions.ReturnImmediately = true;
enumOptions.Rewindable = false; 
enumOptions.Timeout = TimeSpan.MaxValue;
enumOptions.BlockSize = 10;

WqlObjectQuery query = new WqlObjectQuery("Select * from Win32_NTLogEvent Where Logfile = 'Security' AND TimeWritten >= '20110614025212.000000+000' AND TimeWritten <= '20110614030712.000000+000'");

ManagementObjectSearcher searcher = new ManagementObjectSearcher(scope, query, enumOptions);

foreach (ManagementBaseObject mbo in searcher.Get() ) {
   // do Stuff
}

In actual code the query would change each time to get a different time range, but the incomplete results are shown without that.

Each time you run this the ManagementObjectCollection returned from searcher.Get() enumerates the list succesfully - no exceptions raised, however the collection is not always the same.

The collection may be ordered differently each time, this is expected. The collection doesn't always contain the same count of events for the same time range, this is unexepected.

The collection appears to fail in getting complete WMI results once every couple of hundred queries. It does so silently, no exception or error messages that I've found yet.

We identified that the 'logic' operators <= and < against time don't behave as expected either for some log files types (notable at least was Security) so we already have to deal with overlapping end time points using inclusive <= at each end.

The issue of lost results above is not due to the logic operator failing to include times that are ==.

I ran into the same problem (SELECT * FROM Win32_PerfFormattedData_PerfOS_Processor returns empty result. wbemtest shows 2 intances).

Seems the problem appears when using enumOptions.Rewindable = false; on WMI connection which is used from different threads.

Removing enumOptions.Rewindable = false solves problem for me.