Edit

Writing to a Log File Based on an Event

  • Article

The LogFileEventConsumer class can write predefined text to a log file when a specified event occurs. This class is a standard event consumer that WMI provides.

The basic procedure for using standard consumers is always the same, and is located in Monitoring and Responding to Events with Standard Consumers.

The following procedure adds to the basic procedure, is specific to the LogFileEventConsumer class, and describes how to create an event consumer that runs a program.

To create an event consumer that writes to a log file

  1. In the Managed Object Format (MOF) file, create an instance of LogFileEventConsumer to receive the events you request in the query, name the instance in the Name property, and then place the path to the log file in the Filename property.

    For more information, see Designing Managed Object Format (MOF) Classes.

  2. Provide the text template to write to the log file in the Text property.

    For more information, see Using Standard String Templates.

  3. Create an instance of __EventFilter and define a query to specify the events that will activate the consumer.

    For more information, see Querying with WQL.

  4. Create an instance of __FilterToConsumerBinding to associate the filter with the instance of LogFileEventConsumer.

  5. To control who reads or writes to your log file, set the security on the directory where the log is located to the required level.

  6. Compile your MOF file using Mofcomp.exe.

Example

The example in this section is in MOF code, but you can create the instances programmatically by using the Scripting API for WMI or the COM API for WMI. The example uses the standard LogFileEventConsumer to create a consumer class named LogFileEvent that writes a line to the file c:\Logfile.log when an instance of the class LogFileEvent is created.

The following procedure describes how to use the example.

To use the example

  1. Copy the MOF listing below into a text file and save it with a .mof extension.

  2. In a command window, compile the MOF file by using the following command.

    Mofcomp filename**.mof**

  3. Open Logfile.log to see the line specified by LogFileEvent.Name: "Logfile Event Consumer event".

// Set the namespace as root\subscription.
// The LogFileEventConsumer is already compiled 
//     in the root\subscription namespace. 

#pragma namespace ("\\\\.\\Root\\subscription")

class LogFileEvent
{
    [key]string Name;
};

// Create an instance of the standard log
// file consumer and give it the alias $CONSUMER

instance of LogFileEventConsumer as $CONSUMER
{
    // If the file does not already exist, it is created.
    Filename = "c:\\Logfile.log";  
    IsUnicode = FALSE;
    // Name of this instance of LogFileEventConsumer
    Name = "LogfileEventConsumer_Example";  
    // See "Using Standard String Templates"; 
    Text = "%TargetInstance.Name%"; 
    // TargetInstance is the instance of LogFileEvent 
    //    requested in the filter        
                                         
};

// Create an instance of the event filter 
// and give it the alias $FILTER
// Query for any instance operation type,
// such as instance creation, for LogFileEvent class

instance of __EventFilter as $FILTER
{
    Name = "LogFileFilter";
    Query = "SELECT * FROM __InstanceOperationEvent "
        "WHERE TargetInstance.__class = \"LogFileEvent\"";
    QueryLanguage = "WQL";
};

// Create an instance of the binding.

instance of __FilterToConsumerBinding
{
    Consumer=$CONSUMER;
    Filter=$FILTER;
 DeliverSynchronously=FALSE;
};

// Create an instance of this class right now
// Look at the file c:\Logfile.log to see
// that a line has been written.

instance of LogFileEvent
{
 Name = "Logfile Event Consumer event";  
};

Monitoring and Responding to Events with Standard Consumers