WMI-Activity Event 5858 logged frequently with ResultCode = 0x80041032


Symptoms


When using Windows Server 2012 R2 with applications that issue WMI queries using IWbemServices:ExecQuery, the administrator may observe the following event in Event Viewer:

Log Name:  Microsoft-Windows-WMI-Activity/Operational
Source:    WMI-Activity
Event ID:  5858
Level:     Error

Id = {guid}; ClientMachine = <computer>; User = <user>; ClientProcessId = <process ID>; Component = Unknown; Operation = Start IWbemServices::ExecQuery - <WMI namespace> : <Select Query Statement>; ResultCode = 0x80041032; PossibleCause = Unknown

where 0x80041032 indicates WBEM_E_CALL_CANCELLED.

NOTE: This event can occur with many different ResultCode values. The problem described in this article only applies when ResultCode = 0x80041032 (WBEM_E_CALL_CANCELLED).

Cause


WMI-Activity Error 5858 with ResultCode = 0x80041032 (WBEM_E_CALL_CANCELLED) indicates that the WMI caller has successfully issued IWbemServices:ExecQuery, but has released the IWbemContext object before retrieving the full result set using the IEnumWbemClassObject::Next method.  If the WMI service is still holding data for the client when the client terminates the link (by releasing the IWbemContext object), this event will be logged.

This error can happen if the WMI application calls IEnumWbemClassObject::Next with a timeout value (lTimeout) that is not long enough to retrieve the object being queried, and is not checking for a return code of WBEM_S_TIMEDOUT (0x40004) in order to issue the request again.

Resolution


The WMI client application should be modified to issue calls to IEnumWbemClassObject::Next to retrieve the full result set, before releasing the IWbemContext object. If no objects are received, make sure that the timeout value (lTimeout) is greater than 0 and that WBEM_S_TIMEDOUT (0x40004) is not being returned.

More Information


See the following MSDN links for more information:

IEnumWbemClassObject interface
https://msdn.microsoft.com/en-us/library/aa390857(v=vs.85).aspx

NOTE: The sample code included at the end of this page shows IEnumWbemClassObject::Next being called with a timeout value (lTimeout) of 0, and is not checking for the WBEM_S_TIMEDOUT error.

IWbemServices::ExecQuery method
https://msdn.microsoft.com/en-us/library/aa392107(v=vs.85).aspx

IEnumWbemClassObject::Next method
https://msdn.microsoft.com/en-us/library/aa390860(v=vs.85).aspx