2.2.1.2 WQL Event Query

The following example shows the syntax for WQL event queries in ABNF notation.

 ; -----------------------------------
 ; WQL event queries
 ; -----------------------------------
  
 EVENT-WQL = "SELECT" <PROPERTY-LIST> "FROM" / 
               <EVENT-CLASS-NAME> <OPTIONAL-WITHIN> <EVENT-WHERE>
  
 OPTIONAL-WITHIN = ["WITHIN" <INTERVAL>]
 INTERVAL = 1*MODULOREAL
 EVENT-WHERE = ["WHERE" <EVENT-EXPR>]
  
 EVENT-EXPR = ( (<INSTANCE-STATE> "ISA" <CLASS-NAME> <EXPR2>) /
               <EXPR> )
               ["GROUP WITHIN" <INTERVAL> 
                     ( ["BY" [<INSTANCE-STATE> DOT] <PROPERTY-NAME>] 
                       ["HAVING" <EXPR>] )]
 INSTANCE-STATE = "TARGETINSTANCE" / "PREVIOUSINSTANCE"
  
 ; -----------------------------------
 ; Expression
 ; -----------------------------------
  
 EXPR =
  [OPEN-PARENTHESIS] <PROPERTY-EVALUATION> /
   <EXPR2> [CLOSE-PARENTHESIS] 
 EXPR2 = ( ["OR"  [OPEN-PARENTHESIS] <EXPR> / 
    [CLOSE-PARENTHESIS] ] ) /
         ( ["AND" [OPEN-PARENTHESIS] <EXPR> / 
    [CLOSE-PARENTHESIS] ] )
  
 PROPERTY-EVALUATION = 
  ( <PROPERTY-NAME> <OPERATOR> <TYPED-CONSTANT> ) / 
   ( <PROPERTY-NAME> <IS-OPERATOR> "NULL" )
  
 OPERATOR = <EQUIVALENT-OPERATOR> /
            <COMPARE-OPERATOR>
  
 EQUIVALENT-OPERATOR = "=" / "!=" / "<>"
 COMPARE-OPERATOR = "<=" / ">=" / "<" / ">" / "LIKE"
 IS-OPERATOR = "IS" / "IS NOT"
  
 ; -----------------------------------
 ; Characters
 ; -----------------------------------
  
 ALPHA = %x41-5A
 DIGIT = %x30-39
 DOT = ","
 COMMA = "."
 ASTERISK = "*"
 OPEN-PARENTHESIS = "("
 CLOSE-PARENTHESIS = ")"
 STRING-IDENTIFIER = ALPHA *(ALPHA / DIGIT / (*("_") ALPHA / DIGIT)) 
 DOUBLEUNDERSCORE = "__"
  
 CLASS-NAME = [DOUBLEUNDERSCORE] <STRING-IDENTIFIER>
 EVENT-CLASS-NAME = [DOUBLEUNDERSCORE] <STRING-IDENTIFIER>
 PROPERTY-NAME = [DOUBLEUNDERSCORE] <STRING-IDENTIFIER>
  
 TYPED-CONSTANT = INT /
                  REAL /
                  STRING / 
                  DATETIME / 
                  BOOL
  
 INT = "[-+]?\d*"
 REAL = "[-+]?\d*(\.\d+)?"
 MODULOREAL = "[+]?\d*(\.\d+)?"
 STRING = ["]([a-z][A-Z]\d)*["]
 ; DATETIME is specified in section 2.2.1 of [DMTF-DSP0004]
 BOOL = "TRUE" / "FALSE"
  
           

Objects and keywords	Description
CLASS-NAME	Identifies a CIM class name to be queried for events.
PROPERTY-NAME	Identifies the name of a CIM property of a CIM class.
EVENT-WQL	A string expressing the WQL event query. The WQL string uses different WQL reserved keywords to select the type of information wanted.
SELECT	A keyword expressing the selection of information requested (similar to SQL SELECT). SELECT expresses the CIM class or CIM instance to be queried. It MUST be specified in a WQL event query.
PROPERTY-LIST	A list of PROPERTY-NAME values. PROPERTY-NAME values in the list MUST be separated by a comma (",").
ASTERISK	Requires all properties of a CIM class or a CIM instance.
FROM	A keyword that MUST be specified with the SELECT statement to express the CIM class or CIM instance that the query MUST be run against.
EVENT-CLASS-NAME	MUST be specified and MUST be an intrinsic, an extrinsic, or a timer event class. An intrinsic event class is a class derived from __InstanceOperationEvent, __ClassOperationEvent, or __NamespaceOperationEvent, representing possible intrinsic events. An extrinsic event class is a class derived from __ExtrinsicEvent, representing possible extrinsic events. A timer event class is a class derived from __TimerEvent event class, representing possible timer events.
WITHIN	A keyword indicating the server to poll the system for an event. In case of an intrinsic EVENT-CLASS-NAME, the WITHIN keyword MUST be specified. The WITHIN keyword is optional for extrinsic EVENT-CLASS-NAME. If the WITHIN keyword is specified, the INTERVAL MUST be specified.
INTERVAL	INTERVAL specifies the polling interval. It MUST be expressed in seconds. If "WITHIN" is specified, the INTERVAL MUST be specified.
EVENT-WHERE	The WHERE statement narrows the scope of a SELECT event query if the EVENT-CLASS-NAME is an extrinsic or timer event CIM class. The WHERE statement MUST be specified to narrow the scope of a SELECT event query if the EVENT-CLASS-NAME is an intrinsic CIM class.
INSTANCE-STATE	Indicates the type of instance to be evaluated. INSTANCE-STATE MUST be specified if CLASS-NAME is an intrinsic CIM class. INSTANCE-STATE is optional if CLASS-NAME is an extrinsic CIM class. If specified, INSTANCE-STATE MUST be PREVIOUSINSTANCE (to indicate that the state of the CIM class or CIM instance before the event MUST be evaluated) or TARGETINSTANCE (to indicate that the state of the CIM class or CIM instance after the event MUST be evaluated).
ISA	A keyword that MUST be used in combination with the INSTANCE-STATE keyword. It is used as a comparative operator between the INSTANCE-STATE and a CLASS-NAME to reduce the scope of events returned to the CIM instances made out of the CLASS-NAME.
GROUP WITHIN	If the GROUP WITHIN keyword is used, the INTERVAL MUST be specified. This keyword indicates that all events occurring during the WITHIN INTERVAL period MUST be grouped as one event.
HAVING	If the HAVING keyword is specified, it MUST be followed by EXPR to filter the selection of events. This keyword indicates that all events grouped during the GROUP WITHIN period MUST meet the expression specified in EXPR before being returned as one event.
BY	A keyword that groups event instances sharing a same value on a specified PROPERTY-NAME. In such a case, events are returned that represent a group of events sharing the same PROPERTY-NAME value. The system MUST return as many events representing a group of events as there are PROPERTY-NAME values.
EVENT-EXPR	An expression for filtering WMI events.