title: Error in Wmi-Activity event log when using Win32_ProcessStartTrace from C#
body: <p>I am using Win32_ProcessStartTrace (and stop trace) as follows</p>
  
  <pre><code>m_ProcessStartEvent = new ManagementEventWatcher(m_Scope, new EventQuery("SELECT * FROM Win32_ProcessStartTrace"));
  m_ProcessStartEvent.EventArrived += ProcessStartEvent_EventArrived;
  m_ProcessStartEvent.Start();
  
  ...
  
  m_ProcessStartEvent.Stop();
  m_ProcessStartEvent.EventArrived -= ProcessStartEvent_EventArrived;
  m_ProcessStartEvent.Dispose();
  </code></pre>
  
  <p>In the event log: Application and service Logs => Micorosft => windows => Wmi-Activity => Operational, I have the error</p>
  
  <pre><code>    System 
    - Provider 
     [ Name]  Microsoft-Windows-WMI-Activity 
     [ Guid]  {1418EF04-B0B4-4623-BF7E-D74AB47BBDAA} 
     EventID 5858 
     Version 0 
     Level 2 
     Task 0 
     Opcode 0 
     Keywords 0x4000000000000000 
    - TimeCreated 
     [ SystemTime]  2018-12-10T09:48:49.189515600Z 
     EventRecordID 161732 
    - Correlation 
     [ ActivityID]  {73689ED9-87E0-0005-48B2-8073E087D401} 
    - Execution 
     [ ProcessID]  2532 
     [ ThreadID]  9116 
     Channel Microsoft-Windows-WMI-Activity/Operational 
     Computer ...
    - Security 
     [ UserID]  S-1-5-18 
  - UserData 
    - Operation_ClientFailure 
     Id {00000000-0000-0000-0000-000000000000} 
     ClientMachine ...
     User ...
     ClientProcessId 38256 
     Component Unknown 
     Operation Start IWbemServices::ExecNotificationQuery - root\cimv2 : SELECT * FROM Win32_ProcessStartTrace 
     ResultCode 0x80041032 
     PossibleCause Unknown 
  </code></pre>
  
  <p>Any ideas what is causing it and how to resolve it?</p>
  
  <p>I do see </p>
  
  <p><a href="https://support.microsoft.com/en-ca/help/3124914/wmi-activity-event-5858-logged-frequently-with-resultcode-0x80041032" rel="nofollow noreferrer">https://support.microsoft.com/en-ca/help/3124914/wmi-activity-event-5858-logged-frequently-with-resultcode-0x80041032</a></p>
  
  <p>but I don't understand if this is relevant and if so, what to do about it.</p>
  
  <p>Thanks,</p>