Determining the Type of Event to Receive

Before you register to receive an event, you must determine the types of events to receive: intrinsic or extrinsic. For more information about how to receive events, see Receiving a WMI Event. For more information about providing events, see Developing a WMI Provider and Writing an Event Provider. For more information about the security concerns for receiving and providing events, see Securing WMI Events.

Intrinsic Events

An intrinsic event is an event that occurs in response to a change in the standard WMI data model. Each intrinsic event class represents a specific type of change and occurs when WMI or a provider creates, deletes, or modifies a namespace, class, or class instance. For example, the creation of a Win32_LogicalDisk instance would result in an __InstanceCreationEvent instance.

WMI creates intrinsic events for objects stored in the WMI repository. A provider generates intrinsic events for dynamic classes, but WMI can create an instance for a dynamic class if no provider is available. WMI uses polling to detect the changes. The following table lists the system classes that WMI uses to report intrinsic events.

System class	Description
__ClassCreationEvent	Notifies a consumer when a class is created.
__ClassDeletionEvent	Notifies a consumer when a class is deleted.
__ClassModificationEvent	Notifies a consumer when a class is modified.
__InstanceCreationEvent	Notifies a consumer when a class instance is created.
__InstanceOperationEvent	Notifies a consumer when any instance event occurs, such as creation, deletion, or modification of the instance. You can use this class in queries to get all types events associated with an instance.
__InstanceDeletionEvent	Notifies a consumer when an instance is deleted.
__InstanceModificationEvent	Notifies a consumer when an instance is modified.
__NamespaceCreationEvent	Notifies a consumer when a namespace is created.
__NamespaceDeletionEvent	Notifies a consumer when a namespace is deleted.
__NamespaceModificationEvent	Notifies a consumer when a namespace is modified.
__ConsumerFailureEvent	Notifies a consumer when some other event is dropped due to a failure on the part of an event consumer.
__EventDroppedEvent	Notifies a consumer when some other event is dropped instead of being delivered to the requesting event consumer.
__EventQueueOverflowEvent	Notifies a consumer when an event is dropped as a result of a delivery queue overflow.
__MethodInvocationEvent	Notifies a consumer when a method call event occurs.

 

Extrinsic Events

An extrinsic event is a predefined occurrence that cannot be linked directly to changes in the WMI data model. Therefore, WMI enables an event provider to define an event class that describes the event. For example, an event that describes a computer switching to stand-by mode is an extrinsic event. A provider derives an extrinsic event from the __ExtrinsicEvent system class, which is a subclass of the __Event system class. The System Registry and SNMP providers define extrinsic event classes, such as RegistryKeyChangeEvent, which notifies a consumer when a registry key is changed. For more information, see Registering for System Registry Events and Writing an Event Provider.

In the following example, an event provider is reporting security violations to one or more buildings. The following class might be defined for the extrinsic event representing a security violation.

class SecurityViolationEvent : __ExtrinsicEvent
{
   string Building;           // building where violation occurred
   sint32 EntranceNumber;     // entrance where violation occurred
   datetime TimeOfDetection;  // date and time of violation
}

To receive the security violation notifications, a consumer registers for the SecurityViolationEvent event type. Unless otherwise specified, a consumer receives notification of all security violations during all time periods and in all buildings. The event class also contains information that consumers can use to ask for more specific events.

In the following example, the query registers the consumer for security violation events in building 24 only.

SELECT * FROM SecurityViolationEvent WHERE Building = 24;