Correlating Events Without Templates

You can correlate events in Windows Management Instrumentation (WMI) by using the updating consumers and Transient Provider. The template-less paradigm is a set of optional guidelines to follow when you design a custom correlation scenario.

For more information about support and installation of this component on a specific operating system, see Operating System Availability of WMI Components.

The Event Correlator keeps a state that is manipulated by using the updating consumers. Because initialization of this state is performed by using normal updating consumers, initialization is event-driven.

Updating consumers that are responsible for initializing a correlation state are connected to the following two events: Scenario Activation/Deactivation and Windows Management Startup.

An updating consumer scenario can use any event to initialize a correlation, but most use __InstanceCreationEvent or __InstanceDeletionEvent events of the associated MSFT_UCScenario instance. These events alone are insufficient for initialization of a transient correlation state. This is because WMI can be restarted multiple times between the time a scenario instance is created at registration time and when the instance is deleted at the time it is unregistered. Thus, an event is fired on WMI startup that is called MSFT_TransientRebootEvent. To perform transient state initialization, updating consumers must subscribes to this event.

Updating consumers that subscribe to the MSFT_TransientRebootEvent event also subscribe to the Activation/Deactivation events so that WMI does not have to be restarted for the correlation to be initialized.

Note  There is nothing special about updating consumers that perform initialization. In an active system, events that trigger state changes and events that trigger initialization can occur in an arbitrary order.

The updating consumer does not place restrictions on the classes that can be manipulated by updating commands. However, the Transient Provider requires that classes with instances that are provided by the Transient Provider must be derived from MSFT_TransientStateBase if the Transient Provider is to provide instance operations events for them.

Correlation without a template requires creating a class that derives from MSFT_TransientStateBase.

Note  If an MSFT_UpdatingConsumer instance belongs to a Scenario (the Scenario property is not NULL), and there is not an associated MSFT_UCScenario instance (associated if its ID property has the same value as the MSFT_UpdatingConsumer Scenario property), then nothing happens when the consumer executes. You can determine this by observing an MSFT_UCExecutedTraceEvent with a status code of 1 (WBEM_S_FALSE).