Trying to group __InstanceCreationEvents from WMI Query -

Question

I have a WMI query that notifies me on USB insertions, but I am trying to group the results of this query so that my handler can operate on a batch of these insertions, as opposed to one by one as they come in. WQL supports a GROUP WITHIN clause that I am trying to use, but anytime I try to use it, I get exceptions after I start my ManagementEventWatcher.

   //Working Query, But Doesn't Group
    string query = 
            "SELECT * FROM __InstanceCreationEvent " + 
            "WITHIN 2 " +
            "WHERE TargetInstance ISA 'Win32_PnpEntity'";
            

What I am trying to do is use GROUP WITHIN to group these insertion events so that instead of having my handler deal with one at a time, it can do it in batches.

Update: I have redone the query to match the syntax as shown on the documentation, however I still get an exception: "System.Runtime.InteropServices.COMException: 'Exception from HRESULT: 0x80042002'"

       //Doesn't work
       string insertionQuery =
     "SELECT * FROM __InstanceCreationEvent " +
     "WHERE TargetInstance ISA 'Win32_PnPEntity' GROUP WITHIN 60";

How I'm using the query:

            ManagementEventWatcher insertWatcher = new ManagementEventWatcher(query);
            insertWatcher.EventArrived += new EventArrivedEventHandler(USB_Insertion_EventArrived);
            insertWatcher.Start(); //Exception gets thrown 

Any help is appreciated!

Answer 1

Take a look at the documented syntax:

SELECT * FROM EventClass [WHERE property = value] 
    GROUP WITHIN interval [BY property_list]
    [HAVING NumberOfEvents operator integer]

The WHERE clause must go immediately after the class name, the GROUP WITHIN statement goes at the end:

   string insertionQuery =
        "SELECT * FROM __InstanceCreationEvent " +
        "WHERE TargetInstance ISA 'Win32_PnPEntity' " +
        "GROUP WITHIN 60";