Receiving Synchronous and Semisynchronous Event Notifications

Use SWbemServices.ExecQuery to request all existing events.

The following code example shows how to query for the events in a log.

Select * from Win32_NTLogEvent

For more information, see Determining the Type of Event to Receive, Receiving Event Notifications, and WQL (SQL for WMI).

The default call to SWbemServices.ExecNotificationQuery uses semisynchronous communication. The iflags parameter has the wbemFlagForwardOnly and wbemFlagReturnImmediately flags set by default. For more information, see Calling a Method.

The following procedure describes how to receive semisynchronous event notification using VBScript.

To receive semisynchronous event notification in VBScript

1. Create a query for the type of event that you want to receive. For more information, see Determining the Type of Event to Receive.

2. If you request an instance type of event such as __InstanceCreationEvent, indicate in the query a type of target instance, for example, Win32_LogicalDisk.

3. If necessary, specify an instance, for example, the name of a namespace when requesting future __NamespaceModificationEvent instances for a specific namespace.

4. Specify a polling interval for Windows Management Instrumentation (WMI) in a query, such as "WITHIN 10"—to poll every 10 seconds. For more information, see WITHIN Clause.

5. Call SWbemServices.ExecNotificationQuery using the query.

6. Loop through the collection you receive.

The following example shows how to monitor insertion and removal of disks from a floppy disk drive on a local machine. The script requests ___InstanceModificationEvent instances for the floppy drive Win32_LogicalDisk instance and polls every 10 seconds for new instances. This script is an example of a temporary event consumer, and continues running until it is stopped in Task Manager or the system is rebooted. For more information, see Receiving Events for the Duration of your Application.

Const FLOPPY_DISK = 2
Set colMonitoredDisks = GetObject("Winmgmts:").ExecNotificationQuery _
    ("Select * from __InstanceModificationEvent within 10 WHERE " _
        & "TargetInstance ISA 'Win32_LogicalDisk'")
i = 0
Do While i = 0
    Set strDiskChange = colMonitoredDisks.NextEvent
    If strDiskChange.TargetInstance.DriveType = FLOPPY_DISK Then
        If strDiskChange.TargetInstance.Size > 0 Then
            Wscript.Echo "A disk has been inserted" & _
                " into the floppy drive."
    Else
            Wscript.Echo "A disk has been removed" & _
                " from the floppy drive."
        End If
    End If
Loop

The following procedure describes how to receive semisynchronous event notification using C++.

To receive semisynchronous event notification in C++

1. Set up the application with calls to the CoInitializeEx and CoInitializeSecurity functions.

   Because WMI is COM based, calling CoInitializeEx and CoInitializeSecurity is a required step for a WMI application. For more information, see Creating a WMI Application or Script.

2. Determine the kind of events that you want to receive.

   WMI supports intrinsic and extrinsic events. An intrinsic event is an event predefined by WMI. An extrinsic event is an event defined by a third party provider. For more information, see Determining the Type of Event to Receive.

3. Register to receive a specific class of events with a call to the IWbemServices::ExecNotificationQuery method.

   Make each query very specific. The goal of registration is to register to receive only the required notifications. Notifications that are not required waste processing and delivery time.

   You can design an event consumer to receive multiple events. For example, a consumer might require notification of instance modification events for a specific class of device and security violation events. In this case, the tasks a consumer performs when receiving an instance modification event are different for the two events. Thus, the consumer should make one call to IWbemServices::ExecNotificationQuery to register for instance modification events, and another call to ExecNotificationQuery to register for security violation events.

   In the call to ExecNotificationQuery, set the lFlags parameter to WBEM_FLAG_RETURN_IMMEDIATELY and WBEM_FLAG_FORWARD_ONLY. The WBEM_FLAG_RETURN_IMMEDIATELY flag requests semisynchronous processing, and the WBEM_FLAG_FORWARD_ONLY flag requests a forward-only enumerator. For more information, see Calling a Method. The ExecNotificationQuery function returns a pointer to an IEnumWbemClassObject interface.

4. Poll for registered event notifications by making repeated calls to the IEnumWbemClassObject::Next method.

5. When finished, release the enumerator that points to the IEnumWbemClassObject object.

   You can release the IWbemServices pointer associated with the registration. Releasing the IWbemServices pointer causes WMI to stop delivering events to all associated temporary consumers.