You may receive errors similar to the following in the Event Log of a machine:
Event ID: 10
Source : WinMgmt
Type: Error
Description:
Event filter with query "Select * from _InstanceCreationEvent where
TargetInstance ISA "Win32_NTLogEvent†AND
Targetinstance.LogFile.â€System†AND
Tagetlnstance.SourceName="IMAService" AND
Tagetlnstance.EventCode=4035†could not be (re)activated in
namespace “//./root/CIMv2†because of error 0x80041010. Events may not be delvered through this filter until the problem is corrected.
From the wbemess.log
(Tue Apr 27 09:43:31 2010.211419593) : Could not activate filter select * from __InstanceCreationEvent where TargetInstance ISA "Win32_NTLogEvent" AND TargetInstance.LogFile="Application" AND TargetInstance.SourceName="CitrixHealthMon" AND TargetInstance.EventCode=1001 in namespace //./root/CIMv2. HR=0x80041010
(Tue Apr 27 09:43:31 2010.211419609) : Could not get class Win32_NTLogEvent for which intrinsic events are requested. Error code: 80041002
(Tue Apr 27 09:43:31 2010.211419609) : Failed to determine instance classes required by query 'select * from __InstanceCreationEvent where TargetInstance ISA "Win32_NTLogEvent" AND TargetInstance.LogFile="Application" AND TargetInstance.SourceName="Citrix Configuration Logging" AND TargetInstance.EventCode=1':0x80041010
(Tue Apr 27 09:43:31 2010.211419609) : Could not activate filter select * from __InstanceCreationEvent where TargetInstance ISA "Win32_NTLogEvent" AND TargetInstance.LogFile="Application" AND TargetInstance.SourceName="Citrix Configuration Logging" AND TargetInstance.EventCode=1 in namespace //./root/CIMv2. HR=0x80041010
(Tue Apr 27 09:43:31 2010.211419625) : Could not get class Win32_NTLogEvent for which intrinsic events are requested. Error code: 80041002
(Tue Apr 27 09:43:31 2010.211419625) : Failed to determine instance classes required by query 'select * from __InstanceCreationEvent where TargetInstance ISA "Win32_NTLogEvent" AND TargetInstance.LogFile="System" AND TargetInstance.SourceName="TermService" AND (TargetInstance.EventCode=1003 OR TargetInstance.EventCode=1004 OR TargetInstance.EventCode=1011 OR TargetInstance.EventCode=1028)':0x80041010
Per wbemcli.h, 0x80041010 translates to either WBEM_E_INVALID_CLASS or wbemErrInvalidClass. Based on the error, the Win32_NTLogEvent WMI class used to translate instances from the Windows NT event log is missing. It appears applications are using WMI to track errors in the application log and System log. They log the event 10 errors since they are unable to query the WMI class Win32_NTLogEvent.
According to MSDN, the MOF file that supports this class (Win32_NTLogEvent) is Ntevt.mof in the namespace \root\cimv2 using the DLL Ntevt.dll.
To confirm this issue :
1. Connect to the root\cimv2 namespace using WBEMTEST
2. Enumerate all classes recursively
3. Look for Win32_NTLogEvent () and the class would be missing.
To resolve the issue, recompile ntevt.mof and reregister ntevt.dll using the below commands:
mofcomp Ntevt.mof
regsvr32 Ntevt.dll
Note This is a "FAST PUBLISH" article created directly from within the Microsoft support organization. The information contained herein is provided as-is in response to emerging issues. As a result of the speed in making it available, the materials may include typographical errors and may be revised at any time without notice. See
Terms of Use
(http://go.microsoft.com/fwlink/?LinkId=151500)
for other considerations.