Recently I have been learning about WMI and WQL. I found out the list of Win32 classes (from MSDN) that I can query for but I am not able to find out the list of event classes (should be the subset of the list of Win32 classes isn't it ?) Does any one have a list or some kind of cheat sheet for this? I am jsut asking this out of curiosity.
Example for an event class - Win32_ProcessStartTrace
Here's how to list WMI event classes in the
root\cimv2
namespace with C# andSystem.Management
:root\cimv2
is the default WMI namespace so you don't have to use aManagementScope
instance. The WQL query passed toManagementObjectSearcher
is a WMI metadata query. It uses:Meta_Class
to designate the query as a schema query, and__This
property to recursively list__Event
subclasses(see here and here).
WMI class is an event class if its provider implemented as an event WMI provider and must be a subclass of
__Event
. This doesn't mean that you can't use 'ordinary' WMI classes likeWin32_Process
andWin32_Service
in WQL event queries. You just have to use one of the__InstanceOperationEvent
derived helper classes like__InstanceCreationEvent
or__InstanceDeletionEvent
, and WMI will use its own event subsystem to deliver events.Here is a sample WQL query that subscribes to
Win32_Process
creation events:In this case you have to use the
Within
clause.WMI Code Creator is a great tool for learning WMI that, among other things, lets you explore WMI event classes on the local or remote computer and generate code for receiving event notifications.
Edit: Since you tagged your question as C#, you might be interested in the code for getting the list of event classes derived from a particular class programmatically:
Doesn't MSDN have a list of all the MSMCA classes here
UPDATE:
I don't do tons of work with WMI, but I just found this WMI tool that would have been helpful. It gives you a GUI for viewing the WMI hierarchy of objects, and even allows you to register and consume events. This should give you the information you need.