Share via

Microsoft.Windows.WmiProvider.EventProvider

  • Article

Applies To: System Center 2012 - Operations Manager, System Center 2012 R2 Operations Manager, System Center 2012 SP1 - Operations Manager

The Microsoft.Windows.WmiProvider.EventProvider module is a data source module type that queries a Windows Management Instrumentation (WMI) namespace at a scheduled frequency and returns the results as System.Event.Data type data.

Usage

Use this module to query WMI for object data and convert it into event data at a scheduled, recurring interval. This module can be implemented in a rule or monitor where the data can be collected and stored in the database and/or data warehouse or can trigger alert and state changes.

Type Definition

<DataSourceModuleType ID="Microsoft.Windows.WmiProvider.EventProvider" Accessibility="Public">
  <Configuration>
    <xsd:element name="NameSpace" type="xsd:string" />
    <xsd:element name="Query" type="xsd:string" />
    <xsd:element name="Frequency" type="xsd:integer" />
  </Configuration>
  <OverrideableParameters>
    <OverrideableParameter ID="Frequency" Selector="$Config/Frequency$" ParameterType="int" />
  </OverrideableParameters>
  <ModuleImplementation>
    <Composite>
      <MemberModules>
        <DataSource TypeID="Microsoft.Windows.WmiProvider" ID="DataSource">
          <NameSpace>$Config/NameSpace$</NameSpace>
          <Query>$Config/Query$</Query>
          <Frequency>$Config/Frequency$</Frequency>
        </DataSource>
        <ConditionDetection TypeID="System!System.Event.GenericDataMapper" ID="Mapper">
          <EventOriginId>$Target/Id$</EventOriginId>
          <PublisherId>$MPElement$</PublisherId>
          <PublisherName>WmiProvider</PublisherName>
          <Channel>WmiProvider</Channel>
          <LoggingComputer />
          <EventNumber>0</EventNumber>
          <EventCategory>3</EventCategory>
          <EventLevel>0</EventLevel>
          <UserName />
          <Params />
        </ConditionDetection>
      </MemberModules>
      <Composition>
        <Node ID="Mapper">
          <Node ID="DataSource" />
        </Node>
      </Composition>
    </Composite>
  </ModuleImplementation>
  <OutputType>System!System.Event.Data</OutputType>
</DataSourceModuleType>

Parameters

The Microsoft.Windows.WmiProvider.EventProvider module supports the configuration parameters described in the following table.

Parameter Type Overrideable Description

Namespace

String

False

Required parameter. Specifies the WMI namespace within which the module is to run the query.

Query

String

False

Required parameter. Specifies the SELECT WMI query to run.

Frequency

Unsigned Integer

True

Required parameter. Specifies the frequency in seconds at which to run the WMI query.

For more information about the Namespace and Query parameters, see the Microsoft.Windows.WmiProbe module.

Composition

The Microsoft.Windows.WmiProvider.EventProvider module is a composite module that contains the member modules described in the following table.

Workflow Run Order Module Type Usage

1

Microsoft.Windows.WmiProvider

Returns the queried WMI object data as System.PropertyBagData and passes it on to the subsequent mapper module.

2

System.Event.GenericDataMapper

Maps the incoming System.PropertyBagData data to the System.Event.Data data.
Module Type Usage

Microsoft.Windows.WmiProvider

Queries a WMI namespace at a scheduled frequency and returns filtered results as System.Event.Data type data.

External Module References

None.

Sample

The following XML sample illustrates a Rule element that queries WMI to see whether any of the targeted service instances are in a stop state. If the instance is in a stopped state, the rule generates an alert.


<Rule ID="ServiceStoppedEventRule" Enabled="true" Target="Microsoft.Sample.WindowsService" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">
  <Category>Custom</Category>
  <DataSources>
    <DataSource ID="WMIDS" TypeID="Windows!Microsoft.Windows.WmiProvider.EventProvider">
      <NameSpace>root\cimv2</NameSpace>
      <Query>SELECT * FROM __InstanceOperationEvent WITHIN 60 WHERE TargetInstance.Name=' Target/Property[Type="Microsoft.Sample.WindowsService"]/Name$' AND TargetInstance ISA 'Win32_Service' AND TargetInstance.StartMode = 'Auto' AND TargetInstance.State = 'Stopped’</Query>
      <Frequency>5000</Frequency>
    </DataSource>
  </DataSources>
  <WriteActions>
    <WriteAction ID="alert" TypeID="Health!System.Health.GenerateAlert">
      <AlertMessageId>$MPElement[Name="Microsoft.ModuleSamples.Alerts.AlertMessage"]$</AlertMessageId>
      <Priority>0</Priority>
      <Severity>0</Severity>
    </WriteAction>
  </WriteActions>
</Rule>

Information

   

Module Type

DataSourceModuleType

Input Type

None

Output Type

System.Event.Data

Implementation

Composite

Library

Microsoft.Windows.Library