Recently I have been learning about WMI and WQL. I found out the list of Win32 classes (from MSDN) that I can query for but I am not able to find out the list of event classes (should be the subset of the list of Win32 classes isn't it ?) Does any one have a list or some kind of cheat sheet for this? I am jsut asking this out of curiosity.
Example for an event class - Win32_ProcessStartTrace
Here's how to list WMI event classes in the root\cimv2
namespace with C# and System.Management
:
using System;
using System.Management;
class Program
{
static void Main()
{
string query =
@"Select * From Meta_Class Where __This Isa '__Event'";
ManagementObjectSearcher searcher =
new ManagementObjectSearcher(query);
foreach (ManagementBaseObject cimv2Class in searcher.Get())
{
Console.WriteLine(cimv2Class.ClassPath.ClassName);
}
}
}
root\cimv2
is the default WMI namespace so you don't have to use a ManagementScope
instance. The WQL query passed to ManagementObjectSearcher
is a WMI metadata query. It uses:
Meta_Class
to designate the query as a schema query, and
__This
property to recursively list __Event
subclasses
(see here and here).
WMI class is an event class if its provider implemented as an event WMI provider and must be a subclass of __Event
. This doesn't mean that you can't use 'ordinary' WMI classes like Win32_Process
and Win32_Service
in WQL event queries. You just have to use one of the __InstanceOperationEvent
derived helper classes like __InstanceCreationEvent
or __InstanceDeletionEvent
, and WMI will use its own event subsystem to deliver events.
Here is a sample WQL query that subscribes to Win32_Process
creation events:
Select * From __InstanceCreationEvent Within 5 Where TargetInstance Isa 'Win32_Process'
In this case you have to use the Within
clause.
WMI Code Creator is a great tool for learning WMI that, among other things, lets you explore WMI event classes on the local or remote computer and generate code for receiving event notifications.
Edit: Since you tagged your question as C#, you might be interested in the code for getting the list of event classes derived from a particular class programmatically:
using System.Management;
...
string ancestor = "WMIEvent"; // the ancestor class
string scope = "root\\wmi"; // the WMI namespace to search within
try
{
EnumerationOptions options = new EnumerationOptions();
options.ReturnImmediately = true;
options.Rewindable = false;
ManagementObjectSearcher searcher =
new ManagementObjectSearcher(scope, "SELECT * FROM meta_class", options);
foreach (ManagementClass cls in searcher.Get())
{
if (cls.Derivation.Contains(ancestor))
{
Console.WriteLine(cls["__CLASS"].ToString());
}
}
}
catch (ManagementException exception)
{
Console.WriteLine(exception.Message);
}
Doesn't MSDN have a list of all the MSMCA classes here
UPDATE:
I don't do tons of work with WMI, but I just found this WMI tool that would have been helpful. It gives you a GUI for viewing the WMI hierarchy of objects, and even allows you to register and consume events. This should give you the information you need.