Determining the Type of Event to Receive

Before you register to receive an event, you must determine the types of events to receive: intrinsic or extrinsic. For more information about how to receive events, see Receiving a WMI Event. For more information about providing events, see Developing a WMI Provider and Writing an Event Provider. For more information about the security concerns for receiving and providing events, see Securing WMI Events.

Intrinsic Events

An intrinsic event is an event that occurs in response to a change in the standard WMI data model. Each intrinsic event class represents a specific type of change and occurs when WMI or a provider creates, deletes, or modifies a namespace, class, or class instance. For example, the creation of a Win32_LogicalDisk instance would result in an __InstanceCreationEvent instance.

WMI creates intrinsic events for objects stored in the WMI repository. A provider generates intrinsic events for dynamic classes, but WMI can create an instance for a dynamic class if no provider is available. WMI uses polling to detect the changes. The following table lists the system classes that WMI uses to report intrinsic events.

Extrinsic Events

An extrinsic event is a predefined occurrence that cannot be linked directly to changes in the WMI data model. Therefore, WMI enables an event provider to define an event class that describes the event. For example, an event that describes a computer switching to stand-by mode is an extrinsic event. A provider derives an extrinsic event from the __ExtrinsicEvent system class, which is a subclass of the __Event system class. The System Registry and SNMP providers define extrinsic event classes, such as RegistryKeyChangeEvent, which notifies a consumer when a registry key is changed. For more information, see Registering for System Registry Events and Writing an Event Provider.

In the following example, an event provider is reporting security violations to one or more buildings. The following class might be defined for the extrinsic event representing a security violation.

class SecurityViolationEvent : __ExtrinsicEvent
{
   string Building;           // building where violation occurred
   sint32 EntranceNumber;     // entrance where violation occurred
   datetime TimeOfDetection;  // date and time of violation
}

To receive the security violation notifications, a consumer registers for the SecurityViolationEvent event type. Unless otherwise specified, a consumer receives notification of all security violations during all time periods and in all buildings. The event class also contains information that consumers can use to ask for more specific events.

In the following example, the query registers the consumer for security violation events in building 24 only.

SELECT * FROM SecurityViolationEvent WHERE Building = 24;