Export (0) Print
Expand All
Expand Minimize

__EventFilter class

The registration of a permanent event consumer requires an instance of the __EventFilter system class.

The following syntax is simplified from Managed Object Format (MOF) code and includes all inherited properties. Properties are listed in alphabetic order, not MOF order.

Syntax

class __EventFilter : __IndicationRelated
{
  uint8  CreatorSID[] = {1,1,0,0,0,0,0,5,18,0,0,0};
  string EventAccess;
  string EventNamespace;
  string Name;
  string Query;
  string QueryLanguage;
};

Members

The __EventFilter class has these types of members:

Properties

The __EventFilter class has these properties.

CreatorSID
Data type: uint8 array
Access type: Read/write

Security identifier (SID) that uniquely identifies the user who creates this filter. Windows Management Instrumentation (WMI) stores the SID of the user that creates an instance of __EventFilter or the Administrator SID, depending on the operating system. For more information, see Binding an Event Filter with a Logical Consumer and Monitoring and Responding to Events with Standard Consumers.

EventAccess
Data type: string
Access type: Read/write

Security descriptor (SD) in Security Descriptor Definition Language (SDDL) that controls access for events delivered to the filter. Use this property to specify that only events in the security context of specific accounts can be delivered to this filter. For example, a permanent event consumer may clear the security logs only when a specific event is generated by a specific user. To specify who can publish events to this filter, use the WBEM_RIGHT_PUBLISH mask in the Access Control Entry (ACE) for the SECURITY_DESCRIPTOR property. For more information, see Security Descriptor Definition Language. For more information about constants used to set this security descriptor, see WMI Security Constants. For more information and examples, see replace:Receiving Events Securely.

You can configure an event access security descriptor to allow an event to be delivered only when the local system account generates the event. For more information about creating security descriptor and authorizing access, see Access Control.

Example: The following SDDL string allows only administrators to provide events to the filter. The right required to provide events is WBEM_RIGHT_PUBLISH (x80).

O:BAG:BAD:(A;;0x80;;;BA)
EventNamespace
Data type: string
Access type: Read/write

Namespace of the event instance used for cross-namespace subscriptions.

Name
Data type: string
Access type: Read/write
Qualifiers: Key

Unique identifier of an event filter. Because an event filter is only used internally by WMI, it is recommended that you set this property to a globally unique identifier (GUID) converted to a string. However, consumers can use any private scheme for a filter name as long as there is not a conflict with other filters.

Query
Data type: string
Access type: Read/write

Windows Management Instrumentation Query Language (WQL) event query that specifies the set of events for consumer notification, and the specific conditions for notification.

QueryLanguage
Data type: string
Access type: Read/write

Language used for the query. Because WMI currently supports only WMI Query Language (WQL) as a query language, this property must be set to "WQL".

Remarks

The __EventFilter class is derived from __IndicationRelated.

Examples

For script code examples, see WMI Tasks for Scripts and Applications and the TechNet ScriptCenter Script Repository.

For C++ code examples, see WMI C++ Application Examples.

Requirements

Minimum supported client

Windows XP

Minimum supported server

Windows Server 2003

Namespace

all WMI namespaces

See also

WMI System Classes
Creating an Event Filter
Receiving Events at All Times
Monitoring and Responding to Events with Standard Consumers
Monitoring Events
Standard Consumer Classes
Securing WMI Events

 

 

Show:
© 2014 Microsoft