__EventFilter class
The registration of a permanent event consumer requires an instance of the __EventFilter system class.
The following syntax is simplified from Managed Object Format (MOF) code and includes all inherited properties. Properties are listed in alphabetic order, not MOF order.
Syntax
class __EventFilter : __IndicationRelated
{
uint8 CreatorSID[] = {1,1,0,0,0,0,0,5,18,0,0,0};
string EventAccess;
string EventNamespace;
string Name;
string Query;
string QueryLanguage;
};
Members
The __EventFilter class has these types of members:
Properties
The __EventFilter class has these properties.
-
CreatorSID
-
-
Data type: uint8 array
-
Access type: Read/write
Security identifier (SID) that uniquely identifies the user who creates this filter. Windows Management Instrumentation (WMI) stores the SID of the user that creates an instance of __EventFilter or the Administrator SID, depending on the operating system. For more information, see Binding an Event Filter with a Logical Consumer and Monitoring and Responding to Events with Standard Consumers.
-
-
EventAccess
-
-
Data type: string
-
Access type: Read/write
Security descriptor (SD) in Security Descriptor Definition Language (SDDL) that controls access for events delivered to the filter. Use this property to specify that only events in the security context of specific accounts can be delivered to this filter. For example, a permanent event consumer may clear the security logs only when a specific event is generated by a specific user. To specify who can publish events to this filter, use the WBEM_RIGHT_PUBLISH mask in the Access Control Entry (ACE) for the SECURITY_DESCRIPTOR property. For more information, see Security Descriptor Definition Language. For more information about constants used to set this security descriptor, see WMI Security Constants. For more information and examples, see replace:Receiving Events Securely.
You can configure an event access security descriptor to allow an event to be delivered only when the local system account generates the event. For more information about creating security descriptor and authorizing access, see Access Control.
Example: The following SDDL string allows only administrators to provide events to the filter. The right required to provide events is WBEM_RIGHT_PUBLISH (x80).
O:BAG:BAD:(A;;0x80;;;BA) -
-
EventNamespace
-
-
Data type: string
-
Access type: Read/write
Namespace of the event instance used for cross-namespace subscriptions.
-
-
Name
-
-
Data type: string
-
Access type: Read/write
-
Qualifiers: Key
Unique identifier of an event filter. Because an event filter is only used internally by WMI, it is recommended that you set this property to a globally unique identifier (GUID) converted to a string. However, consumers can use any private scheme for a filter name as long as there is not a conflict with other filters.
-
-
Query
-
-
Data type: string
-
Access type: Read/write
Windows Management Instrumentation Query Language (WQL) event query that specifies the set of events for consumer notification, and the specific conditions for notification.
-
-
QueryLanguage
-
-
Data type: string
-
Access type: Read/write
Language used for the query. Because WMI currently supports only WMI Query Language (WQL) as a query language, this property must be set to "WQL".
-
Remarks
The __EventFilter class is derived from __IndicationRelated.
Requirements
| Requirement | Value |
|---|---|
| Minimum supported client |
Windows Vista |
| Minimum supported server |
Windows Server 2008 |
| Namespace |
All WMI namespaces |