We have a Windows service that monitors for process start events and sends notifications to client applications.
We have discovered that the delay between when a process starts and when our EventArrivedEventHandler is called gets excessively long when the number of user sessions on the Windows server gets to about 80.
The delay gets worse as the number of user sessions gets higher.
The delays are not consistent. Even with 100 sessions some observed delays are short but most are too long and the maximum observed delay grows with the number of sessions.
Here is one example of the delay we are seeing.
A client application wrote its first log record to its log file at 11:05:34.076. Our EventArrivedEventHandler did not get notified of the process start event for the client application until 18 seconds later (at 11:05:52.188 ).
We need the delay to be less than 5 seconds to be tolerable and would like the delay to be less than 3 seconds if possible.
Is there something we can do to reduce the delay? Below are the details of our use of WMI.
We are using an instance of class WqlEventQuery to represent a WMI event query in WQL format.
We are constructing an instance of ManagementEventWatcher to consume events asynchronously.
Below is how we are instantiating and running the query. Variable m_PollingIntervalInMilliseconds is set to 1000 by default.
WqlEventQuery query = new WqlEventQuery("__InstanceCreationEvent", new TimeSpan(0, 0, 0, 0, m_PollingIntervalInMilliseconds), "TargetInstance isa \"Win32_Process\"");
m_ManagementEventWatcher = new ManagementEventWatcher(query);
m_ManagementEventWatcher.EventArrived += new EventArrivedEventHandler(managementEventWatcher_EventArrived);
m_ManagementEventWatcher.Start();
Our Windows service is not the only user of WMI services on the server. I do not know if there is contention with other users of WMI services or if there is something about the way we are consuming WMI services that is inefficient.