Event Correlator Functionality

WMI event correlation consists of the correlator state object, updating consumer, and the transient provider.

Note  For more information about support and installation of this component on a specific operating system, see Operating System Availability of WMI Components.

The Event Correlator functions as a state machine in which changes in the state trigger other changes until a specified state is reached. For each state transition, the property values of the state object can be evaluated in determining the next operation.

The following procedure describes the operation of the Event Correlator.

1. The updating consumer is registered to receive incoming events.
2. Upon receiving an event, it updates the correlation state object through the Transient Provider using the Update Query Language (UQL).
3. Updating the correlation state object fires an instance modification event which forms a feedback loop to the filter engine.
4. If the instance modification event fired in Step 3 is of interest, it is passed to the updating consumer and the process continues at Step 2.- or - If the instance modification event fired in Step 3 satisfies the correlation scenario, it is passed to the action consumer, which then performs the action specified by the correlation scenario.

The following diagram illustrates the feedback loop the Event Correlator uses to correlate multiple disparate events or events over time.