Receiving Event Notifications
Event queries are used by temporary event consumers, permanent event consumers, and event providers. Event consumers use event queries to specify events of interest, and event providers use the queries to specify the events that they provide.
Temporary consumers place queries in calls to the IWbemServices::ExecNotificationQuery or IWbemServices::ExecNotificationQueryAsync method. Permanent event consumers place queries in the Query property of an instance of the __EventFilter system class.
Event providers use event queries to register to support one or more types of events. They place queries in the EventQueryList property of an instance of the __EventProviderRegistration system class. All event providers create an __EventProviderRegistration instance to register with Windows Management Instrumentation (WMI). For more information, see Registering an Event Provider.
Event consumers and providers use the SELECT statement and a related WHERE clause for event queries, plus a variety of extensions specific to the WMI Query Language (WQL). The extensions are used to protect consumers from being flooded with notifications that occur too frequently to be useful.
Consumers that do not require notification each time an event occurs can specify the following clauses in their queries:
The WITHIN and HAVING clauses affect the timing of events, and the GROUP clause causes a representative event to be sent in place of a frequently occurring event.