Retrieving Event Data
To consume event specific data, the consumer must know the format of the event data. This is not an issue if you are consuming events from your own provider because you know the format of the data. However, to consume an event from any provider, the provider must publish the layout of the event data.
A provider can use a MOF class to publish the event layout. On Windows Vista, a provider should use a manifest to publish its events. For details on publishing your events, see Publishing Your Event Schema. Note that all kernel events are published using MOF.
To consume events on Windows Vista that were published using a manifest, MOF, or TMF files, see Retrieving Event Data Using TDH.
To consume events prior to Windows Vista that were published using MOF, see Retrieving Event Data Using MOF.