MSFT_WmiProvider_OperationEvent class

The MSFT_WmiProvider_OperationEvent base class is the root definition of all WMI provider events. A provider operation is defined as some execution on behalf of a client using WMI that results in one or more calls to a provider executable file. The properties of this class define the identity of the provider associated with the operation being executed and is uniquely associated with instances of the class MSFT_Providers. Each instance of __Win32Provider can have an associated operation and be identified using the properties below.

Internally, WMI can contain any number of objects that refer to a particular instance of __Win32Provider because it differentiates each object based on whether the provider supports per user or per locale instantiation and also depending on where the provider is being hosted. Currently, the TransactionIdentifier property is always an empty string.

The following syntax is simplified from Managed Object Format (MOF) code and includes all inherited properties. Properties are listed in alphabetic order, not MOF order.

Syntax

[AMENDMENT]
class MSFT_WmiProvider_OperationEvent : MSFT_WmiSelfEvent
{
  uint8  SECURITY_DESCRIPTOR[];
  uint64 TIME_CREATED;
  string HostingGroup;
  uint32 HostingSpecification;
  string Locale;
  string Namespace;
  string Provider;
  string TransactionIdentifier;
  string User;
  String TransactionIdentifer;
};

Members

The MSFT_WmiProvider_OperationEvent class has these types of members:

Properties

The MSFT_WmiProvider_OperationEvent class has these properties.

HostingGroup

Data type: string

Access type: Read-only

Second component of the __Win32Provider HostingModel property when the hosting model is one of "LocalSystemHost", "LocalSystemHostOrSelfHost", "NetworkServiceHost", or "LocalServiceHost". The hosting group defines a particular instantiation of a WMI provider host. Providers that share the same hosting model and hosting group share the same surrogate process.

HostingSpecification

Data type: uint32

Access type: Read-only

The first component of the __Win32Provider HostingModel property. For the possible values of this property, see the HostingSpecification property in the MSFT_Providers class.

Locale

Data type: string

Access type: Read-only

Particular instantiation of a provider instance when the provider is configured for per local initialization.

Namespace

Data type: string

Access type: Read-only

Namespace associated with a particular provider instance.

Provider

Data type: string

Access type: Read-only

Name associated with a particular provider instance. The name is identical to the __Win32Provider property.

SECURITY_DESCRIPTOR

Data type: uint8 array

Access type: Read-only

Descriptor that the event provider uses to determine which users can receive the event. For more information, see WMI Security Constants.

This property is inherited from __Event.

TIME_CREATED

Data type: uint64

Access type: Read-only

Unique value that indicates the time the event is generated. This is a 64-bit value that represents the number of 100-nanosecond intervals after January 1, 1601. The information is in the Coordinated Universal Time (UTC) format.

For more information about using uint64 values in scripts, see Scripting in WMI.

This property is inherited from __Event.

TransactionIdentifer

Data type: String

Access type: Read-only

The TransactionIdentifer property is for internal use, currently always empty.

TransactionIdentifier

Data type: string

Access type: Read-only

Internal use only. The current value is "{00000000-0000-0000-0000-000000000000}".

User

Data type: string

Access type: Read-only

Particular provider instance, configured for per user initialization.

Requirements

Minimum supported client
Windows Vista
Minimum supported server
Windows Server 2008
Namespace
Root\CIMV2
MOF
System.mof
DLL
WmiPrvSD.dll

See also

MSFT_WmiSelfEvent

Provider Event Troubleshooting Classes

MSFT_Providers

WMI Troubleshooting

WMI Troubleshooting

Receiving a WMI Event