Event ID 23 — Event Filter Query Functionality

  • Article

Applies To: Windows Server 2008 R2

WMI supports a query language called the WMI Query Language (WQL). WQL is a subset of structured query language (SQL) that is used by most relational database management systems. An event filter query is a WQL query that is used when processing WMI events.

Event Details

Product: Windows Operating System
ID: 23
Source: Microsoft-Windows-WMI
Version: 6.1
Symbolic Name: WBEM_MC_EVENT_PROVIDER_QUERY_TOO_BROAD
Message: Event provider %1 attempted to register query "%2" %3 namespace which is too broad. Event providers cannot provide events that are provided by the system. The query will be ignored. Contact the application vendor.

Resolve

Narrow the scope of the WQL query

You can reduce the query scope of a WQL query by using a more restrictive WHERE clause. The query can be corrected by examining the event registration from the WMI Event Registration tool that comes as part of CIM Studio and by updating the permanent subscriptions for the listed provider and query. If the permanent subscription is created by using a MOF file that was included with an installed product, you must contact the application vendor to correct the faulty registration.

Verify

Send events through the Event Provider that satisfies the Event Filter query in question and to verify that they were delivered successfully.

Event Filter Query Functionality

Management Infrastructure