Introduction to WQL: SQL for WMI - Event Queries
(Page 3 of 4 )
Event Queries
The second type of query is a little less common, but extremely powerful when used correctly. The Event query creates a temporary event request notification that is flagged each time a new instance of a class is created.
If we look at the last example, we were polling the Win32_NTLogEvent class for event log entries. We can use an Event Query to watch that class for any newly created instances as well.
strComputer = "."
Set objWMIService = GetObject("winmgmts:" & strComputer & "rootcimv2")
Set colEvents = objWMIService.ExecNotificationQuery _
("SELECT * FROM __InstanceCreationEvent WHERE " _
& "TargetInstance ISA 'Win32_NTLogEvent' " _
& "AND TargetInstance.Logfile = 'Application' ")
The structure of this query is a little more complex, but it’s not difficult. You’ll find that it’s very similar to the data query we used.
Again we’re going to SELECT all instances with our wildcard FROM the __InstanceCreationEvent event type. We’re looking for the request notification returned by our event so the FROM keyword should point to the event, not the class in which the event occurs.
Then we set up a WHERE clause to filter our results. This is where it looks a little funny. Notice how we’re not calling the properties directly this time? That’s because we can’t reference the class item directly. We’re only returning event results. So we use the TargetInstance moniker to refer to the returned event.
A moniker is like a pointer that cross references items in different classes.
The ISA is a keyword to refer to the referenced properties. So our query is looking for all events WHERE the TargetInstance is a member of the Win32_NTLogEvent class AND the TargetInstance’s Logfile property is set to “Application.”
So this event query would return any newly created events that fit the description in our first example. The data query returns any existing items when it is run and the event query returns any newly created items after it is run.
Next: Schema Queries >>
More Windows Scripting Articles
More By Nilpo/Developer Shed Staff Writer
/ 3 
