__EventFilter class

The registration of a permanent event consumer requires an instance of the __EventFilter system class.

The following syntax is simplified from Managed Object Format (MOF) code and includes all inherited properties. Properties are listed in alphabetic order, not MOF order.


class __EventFilter : __IndicationRelated
  uint8  CreatorSID[] = {1,1,0,0,0,0,0,5,18,0,0,0};
  string EventAccess;
  string EventNamespace;
  string Name;
  string Query;
  string QueryLanguage;


The __EventFilter class has these types of members:


The __EventFilter class has these properties.


Data type: uint8 array

Access type: Read/write

Security identifier (SID) that uniquely identifies the user who creates this filter. Windows Management Instrumentation (WMI) stores the SID of the user that creates an instance of __EventFilter or the Administrator SID, depending on the operating system. For more information, see Binding an Event Filter with a Logical Consumer and Monitoring and Responding to Events with Standard Consumers.


Data type: string

Access type: Read/write

Security descriptor (SD) in Security Descriptor Definition Language (SDDL) that controls access for events delivered to the filter. Use this property to specify that only events in the security context of specific accounts can be delivered to this filter. For example, a permanent event consumer may clear the security logs only when a specific event is generated by a specific user. To specify who can publish events to this filter, use the WBEM_RIGHT_PUBLISH mask in the Access Control Entry (ACE) for the SECURITY_DESCRIPTOR property. For more information, see Security Descriptor Definition Language. For more information about constants used to set this security descriptor, see WMI Security Constants. For more information and examples, see replace:Receiving Events Securely.

You can configure an event access security descriptor to allow an event to be delivered only when the local system account generates the event. For more information about creating security descriptor and authorizing access, see Access Control.

Example: The following SDDL string allows only administrators to provide events to the filter. The right required to provide events is WBEM_RIGHT_PUBLISH (x80).



Data type: string

Access type: Read/write

Namespace of the event instance used for cross-namespace subscriptions.


Data type: string

Access type: Read/write

Qualifiers: Key

Unique identifier of an event filter. Because an event filter is only used internally by WMI, it is recommended that you set this property to a globally unique identifier (GUID) converted to a string. However, consumers can use any private scheme for a filter name as long as there is not a conflict with other filters.


Data type: string

Access type: Read/write

Windows Management Instrumentation Query Language (WQL) event query that specifies the set of events for consumer notification, and the specific conditions for notification.


Data type: string

Access type: Read/write

Language used for the query. Because WMI currently supports only WMI Query Language (WQL) as a query language, this property must be set to "WQL".


The __EventFilter class is derived from __IndicationRelated.


Requirement Value
Minimum supported client
Windows Vista
Minimum supported server
Windows Server 2008
All WMI namespaces

See also


WMI System Classes

Creating an Event Filter

Receiving Events at All Times

Monitoring and Responding to Events with Standard Consumers

Monitoring Events

Standard Consumer Classes

Securing WMI Events