LogFileEventConsumer class

The LogFileEventConsumer class writes customized strings to a text log file when events are delivered to it. The strings are separated by end-of-line sequences. This class is one of the standard event consumers that WMI provides. For more information, see Monitoring and Responding to Events with Standard Consumers.

Syntax

[AMENDMENT]
class LogFileEventConsumer : __EventConsumer
{
  uint8   CreatorSID[];
  string  MachineName;
  uint32  MaximumQueueSize;
  string  Filename;
  boolean IsUnicode;
  uint64  MaximumFileSize = 65535;
  string  Name;
  string  Text;
};

Members

The LogFileEventConsumer class has these types of members:

• Properties

Properties

The LogFileEventConsumer class has these properties.

CreatorSID

Data type: uint8 array

Access type: Read-only

Security identifier (SID) that uniquely identifies the user who creates a filter. WMI stores the SID of the user who creates an instance of __EventConsumer or the Administrator SID, depending on the operating system. For more information, see Binding an Event Filter with a Logical Consumer and Monitoring and Responding to Events with Standard Consumers.

This property is inherited from __EventConsumer.

Filename

Data type: string

Access type: Read-only

Name of a file that includes the path to which the log entries are appended. If the file does not exist, LogFileEventConsumer attempts to create it. The consumer fails when the path does not exist, or when the user who creates the consumer does not have write permissions for the file or path.

IsUnicode

Data type: boolean

Access type: Read-only

If TRUE, the log file is a Unicode text file. If FALSE, the log file is a multibyte code text file. If the file exists, this property is ignored and the current file setting is used. For example, if IsUnicode is FALSE, but the existing file is a Unicode file, then Unicode is used. If IsUnicode is TRUE, but the file is multibyte code, then multibyte code is used.

MachineName

Data type: string

Access type: Read-only

Name of the computer to which Windows Management Instrumentation (WMI) sends events.

This property is inherited from __EventConsumer.

MaximumFileSize

Data type: uint64

Access type: Read-only

Maximum size of a log file in bytes. If the primary file exceeds its maximum size, the contents are moved to a different file and the primary file is emptied. A value of 0 (zero) means there is no size limit. The default value is 65,535 bytes. The size of the file is checked before a write operation. Therefore, you can have a file that is slightly larger than the specified size limit. The next write operation catches it and starts a new file.

The following list identifies the naming structure for the backup file:

• If the original filename is 8.3, the extension is replaced by a string in the format of "001", "002", and so on with the smallest number larger than all the previously used and chosen numbers. If "999" is used, then the number chosen is the smallest unused number.
• If the original filename is not 8.3, a string in the format of "001", "002", and so on is appended to the file name.

For more information about using uint64 values in scripts, see Scripting in WMI.

MaximumQueueSize

Data type: uint32

Access type: Read-only

Maximum queue for a specific consumer, in bytes.

This property is inherited from __EventConsumer.

Name

Data type: string

Access type: Read-only

Qualifiers: key

Unique name for this consumer.

Text

Data type: string

Access type: Read-only

Standard string template for the text of a log entry.

Remarks

The LogFileEventConsumer class is derived from the __EventConsumer abstract class.

Examples

For an example of using LogFileEventConsumer to create a consumer, see Writing to a Log File Based on an Event.

Requirements

See also

Standard Consumer Classes

Writing to a Log File Based on an Event

Creating a Logical Consumer

Receiving Events At All Times

__EventConsumer