Example: Correlation Without Templates

The following code sample shows you how to use the Event Correlator to determine whether or not two different events, A and B, occur within five seconds of each other. In this example, the A event is any instance change event for the A instance of a test class; and the B event is the instance change event for the B instance of a test class. In the following sample the state is kept transiently.

For more information about support and installation of this component on a specific operating system, see Operating System Availability of WMI Components.

// Example classes and instances.

class ExampleClass
{
    [key] string Name;
    boolean Prop;
};

instance of ExampleClass
{
    Name = "A";
    Prop = TRUE;
};

instance of ExampleClass
{
    Name = "B";
    Prop = FALSE;
};

// the correlation scenario definition

[ dynamic, provider("Microsoft WMI Transient Provider")]
class ExampleCorrelationState : MSFT_TransientStateBase 
{

    [Key] String ID;  
    [Key] String Scenario; 

    boolean ReceivedEventA;
    boolean ReceivedEventB;
    [trns_egg_timer] uint32 Timer;
};


Class BothAandBEvent : MSFT_UCEventBase
{
    string Name;
};

instance of  MSFT_UpdatingConsumer as $UI
{
    Id = "Initializer";
    Scenario = "ExampleCorrelationScenario";
    Commands = { "INSERT INTO ExampleCorrelationState "
                 "( Id, Scenario, ReceivedEventA, 
                 "ReceivedEventB, Timer ) "
                 "( 'ExampleCorrelationState', 
                 "'ExampleCorrelationScenario', "
                    " FALSE, FALSE, 0 )"};
};

instance of MSFT_UpdatingConsumer as $UA
{
    Id = "SetEventA";
    Scenario = "ExampleCorrelationScenario";
    Commands = { "UPDATE ExampleCorrelationState "
                 "SET ReceivedEventA = TRUE,  Timer = 5 "
                 "WHERE Scenario = 'ExampleCorrelationScenario' "};
};


instance of MSFT_UpdatingConsumer as $UB
{
    Id = "SetEventB";
    Scenario = "ExampleCorrelationScenario";
    Commands = { "UPDATE ExampleCorrelationState "
                 "SET ReceivedEventB = TRUE, Timer = 5 "
                 "WHERE Scenario = 'ExampleCorrelationScenario' "};
};

// The $UA and $UB updating consumers cause the timer to be reset 
// to 5 seconds whenever either EventA or EventB occurs.

// The next updating consumer causes the ReceivedEventA and 
// ReceivedEventB to be reset when the timer expires.  

instance of MSFT_UpdatingConsumer as $UTE
{
    Id = "ResetTimer";
    Scenario = "ExampleCorrelationScenario";
    Commands = { "UPDATE ExampleCorrelationState "
                 "SET ReceivedEventA = FALSE, ReceivedEventB = FALSE "
                 "WHERE Scenario = 'ExampleCorrelationScenario' "};
};

// Now define filters and bindings to fully define the scenario.  

instance of __EventFilter as $FSC
{
    Name = "ScenarioCreation";
    Query = "SELECT * FROM __InstanceCreationEvent "
            "WHERE TargetInstance ISA 'MSFT_UCScenario' "
            "AND TargetInstance.Id = 'ExampleCorrelationScenario'";
    QueryLanguage = "WQL";
};

instance of __EventFilter as $FSM
{
    Name = "ScenarioModification";
    Query = "SELECT * FROM __InstanceModificationEvent "
            "WHERE TargetInstance ISA 'MSFT_UCScenario' "
            "AND TargetInstance.Id = 'ExampleCorrelationScenario'";
    QueryLanguage = "WQL";
};

instance of __EventFilter as $FBOOT
{
    Name = "OnBoot";
    Query = "SELECT * FROM MSFT_TransientRebootEvent ";
    QueryLanguage = "WQL";
};

instance of __EventFilter as $FA
{
    Name = "EventAFilter";
    Query = "SELECT * FROM __InstanceModificationEvent " 
            "WHERE TargetInstance ISA 'ExampleClass' "
            "AND TargetInstance.Name = 'A'";
    QueryLanguage = "WQL";
};

instance of __EventFilter as $FB
{
    Name = "EventBFilter";
    Query = "SELECT * FROM __InstanceModificationEvent " 
            "WHERE TargetInstance ISA 'ExampleClass' "
            "AND TargetInstance.Name = 'B'";
    QueryLanguage = "WQL";
};

instance of __EventFilter as $FTE
{
    Name = "TimerExpiredEvent";
    Query = "SELECT * FROM MSFT_TransientEggTimerEvent "
            "WHERE Object ISA \"ExampleCorrelationState\" "
            "AND Object.Scenario = 'ExampleCorrelationScenario'";
    QueryLanguage = "WQL";
};

// Now define the bindings.

instance of __FilterToConsumerBinding
{
    Filter = $FSC;
    Consumer = $UI;
};

instance of __FilterToConsumerBinding
{
    Filter = $FSM;
    Consumer = $UI;
};

instance of __FilterToConsumerBinding
{
    Filter = $FBOOT;
    Consumer = $UI;
};

instance of __FilterToConsumerBinding
{
    Filter = $FA;
    Consumer = $UA;
};

instance of __FilterToConsumerBinding
{
    Filter = $FB;
    Consumer = $UB;
};

instance of __FilterToConsumerBinding
{
    Filter = $FTE;
    Consumer = $UTE;
};

// When creating this updating consumer scenario,
// you can trigger activation to occur using
// the MSFT_UCScenario instance. 
// Because, in this example, you have the
// $CI consumer tied to the creation 
// of the MSFT_UCScenario instance, the following
// instantiation would cause the initialization to occur.

instance of MSFT_UCScenario
{
    Id = "ExampleCorrelationScenario";
    Name = "ExampleCorrelationScenario";
};

//
// This instance helps the updating consumer assoc
// provider determine how 
// state instances relate to the scenario.
//

instance of MSFT_UCScenarioAssociationInfo
{  
    Id = "StateAssociation";
    Scenario = "ExampleCorrelationScenario";
    Query = "SELECT * FROM ExampleCorrelationState "
            "WHERE Scenario = 'ExampleCorrelationScenario'";   
};    

// The filter to determine when both events occurred in the 
// windows. 

instance of __EventFilter as $FBOTH
{
    Name = "BothEventsOccurred";
    Query = "SELECT * FROM __InstanceModificationEvent "
            "WHERE TargetInstance ISA \"ExampleCorrelationState\" "
            "AND TargetInstance.ReceivedEventA = TRUE "
            "AND TargetInstance.ReceivedEventB = TRUE "
            "AND TargetInstance.Scenario = "
                "'ExampleCorrelationScenario' ";
    QueryLanguage = "WQL";
};

// If you want a custom event to be fired when
// this condition is met, then 
// you can subscribe an updating consumer to it.

instance of MSFT_UpdatingConsumer as $UBOTH
{
    Id = "BothEventsOccurred";
    Scenario = "ExampleCorrelationScenario";
    Commands = { "INSERT INTO BothAandBEvent ( Name ) "
                 "( 'ExampleCorrelationScenario' ) " };
};

instance of __FilterToConsumerBinding
{
    Filter = $FBOTH;
    Consumer = $UBOTH;
};

 

 

Show: