Determining the Type of Event to Receive
Before you register to receive an event, you must determine the types of events to receive: intrinsic or extrinsic. For more information about how to receive events, see Receiving a WMI Event. For more information about providing events, see Developing a WMI Provider and Writing an Event Provider. For more information about the security concerns for receiving and providing events, see Securing WMI Events.
An intrinsic event is an event that occurs in response to a change in the standard WMI data model. Each intrinsic event class represents a specific type of change and occurs when WMI or a provider creates, deletes, or modifies a namespace, class, or class instance. For example, the creation of a Win32_LogicalDisk instance would result in an __InstanceCreationEvent instance.
WMI creates intrinsic events for objects stored in the WMI repository. A provider generates intrinsic events for dynamic classes, but WMI can create an instance for a dynamic class if no provider is available. WMI uses polling to detect the changes. The following table lists the system classes that WMI uses to report intrinsic events.
|Notifies a consumer when a class is created.
|Notifies a consumer when a class is deleted.
|Notifies a consumer when a class is modified.
|Notifies a consumer when a class instance is created.
|Notifies a consumer when any instance event occurs, such as creation, deletion, or modification of the instance. You can use this class in queries to get all types events associated with an instance.
|Notifies a consumer when an instance is deleted.
|Notifies a consumer when an instance is modified.
|Notifies a consumer when a namespace is created.
|Notifies a consumer when a namespace is deleted.
|Notifies a consumer when a namespace is modified.
|Notifies a consumer when some other event is dropped due to a failure on the part of an event consumer.
|Notifies a consumer when some other event is dropped instead of being delivered to the requesting event consumer.
|Notifies a consumer when an event is dropped as a result of a delivery queue overflow.
|Notifies a consumer when a method call event occurs.
An extrinsic event is a predefined occurrence that cannot be linked directly to changes in the WMI data model. Therefore, WMI enables an event provider to define an event class that describes the event. For example, an event that describes a computer switching to stand-by mode is an extrinsic event. A provider derives an extrinsic event from the __ExtrinsicEvent system class, which is a subclass of the __Event system class. The System Registry and SNMP providers define extrinsic event classes, such as RegistryKeyChangeEvent, which notifies a consumer when a registry key is changed. For more information, see Registering for System Registry Events and Writing an Event Provider.
In the following example, an event provider is reporting security violations to one or more buildings. The following class might be defined for the extrinsic event representing a security violation.
class SecurityViolationEvent : __ExtrinsicEvent
string Building; // building where violation occurred
sint32 EntranceNumber; // entrance where violation occurred
datetime TimeOfDetection; // date and time of violation
To receive the security violation notifications, a consumer registers for the SecurityViolationEvent event type. Unless otherwise specified, a consumer receives notification of all security violations during all time periods and in all buildings. The event class also contains information that consumers can use to ask for more specific events.
In the following example, the query registers the consumer for security violation events in building 24 only.
SELECT * FROM SecurityViolationEvent WHERE Building = 24;