WMIEvent Class List

Question

I recently learned about WMI and WQL. I found out a list of Win32 classes (from MSDN) that I can request, but I can’t find out a list of event classes (should it be a subset of the Win32 class list, right?) Is there a list or some kind of cheat sheet for this? I ask about this out of curiosity.

An example for an event class is Win32_ProcessStartTrace

Answer 1

Here's how to list the WMI event classes in a namespace root\cimv2with C # and System.Management:

using System;
using System.Management;

class Program
{
    static void Main()
    {
        string query =
            @"Select * From Meta_Class Where __This Isa '__Event'";

        ManagementObjectSearcher searcher =
            new ManagementObjectSearcher(query);

        foreach (ManagementBaseObject cimv2Class in searcher.Get())
        {
            Console.WriteLine(cimv2Class.ClassPath.ClassName);
        }
    }
}

root\cimv2 - WMI , ManagementScope. WQL, ManagementObjectSearcher, WMI. :

• Meta_Class
• __This __Event

( ).

WMI - , WMI __Event. , "" WMI, Win32_Process Win32_Service WQL. __InstanceOperationEvent, __InstanceCreationEvent __InstanceDeletionEvent, WMI .

WQL, Win32_Process :

Select * From __InstanceCreationEvent Within 5 Where TargetInstance Isa 'Win32_Process'

Within.

Answer 2

WMI Code Creator - WMI, , , WMI .

:. #, , , :

using System.Management;
...

string ancestor = "WMIEvent";     // the ancestor class
string scope = "root\\wmi";       // the WMI namespace to search within

try
{
    EnumerationOptions options = new EnumerationOptions();
    options.ReturnImmediately = true;
    options.Rewindable = false;

    ManagementObjectSearcher searcher =
        new ManagementObjectSearcher(scope, "SELECT * FROM meta_class", options);

    foreach (ManagementClass cls in searcher.Get())
    {
        if (cls.Derivation.Contains(ancestor))
        {
            Console.WriteLine(cls["__CLASS"].ToString());
        }
    }
}
catch (ManagementException exception)
{
    Console.WriteLine(exception.Message);
}

Answer 3

MSDN MSMCA

UPDATE:
I do not do thin work with WMI, but I found this WMI tool that would be useful. It gives you a graphical interface for viewing the hierarchy of WMI objects and even allows you to register and consume events. This should provide you with the necessary information.