__InstanceOperationEvent class
The __InstanceOperationEvent system class serves as a base class for all intrinsic events that relate to an instance.
The following syntax is simplified from Managed Object Format (MOF) code and includes all inherited properties. Properties are listed in alphabetic order, not MOF order.
Syntax
class __InstanceOperationEvent : __Event
{
uint8 SECURITY_DESCRIPTOR[];
object TargetInstance;
uint64 TIME_CREATED;
};
Members
The __InstanceOperationEvent class has these types of members:
Properties
The __InstanceOperationEvent class has these properties.
-
SECURITY_DESCRIPTOR
-
-
Data type: uint8 array
-
Access type: Read-only
Descriptor used by the event provider to determine which users can receive the event. This property is inherited from __Event.
-
-
TargetInstance
-
-
Data type: object
-
Access type: Read-only
Instance affected by the event. For creation events, this is the newly created instance. For modification events, this is the new version of the changed instance. For deletion events, this is the deleted instance.
-
-
TIME_CREATED
-
-
Data type: uint64
-
Access type: Read-only
Unique value that indicates the time at which the event was generated. This is a 64-bit value that represents the number of 100-nanosecond intervals after January 1, 1601. The information is in the Coordinated Universal Times (UTC) format. This property is inherited from __Event.
For more information about using uint64 values in scripts, see Scripting in WMI.
-
Remarks
The __InstanceOperationEvent class is derived from __Event.
Instances of __InstanceOperationEvent are not created; only instances of its subclasses are created. The following classes derive from __InstanceOperationEvent:
Overview
Just as there is a WMI class that represents each type of system resource that can be managed using WMI, there is a WMI class that represents each type of WMI event. When an event that can be monitored by WMI occurs, an instance of the corresponding WMI event class is created. A WMI event occurs when that instance is created.
There are three major types of WMI event classes, all of which are derived from the __Event WMI class: Intrinsic Events, Extrinsic Events, and Timer Events. Intrinsic Events, in turn, are represented by three distinct classes derived from the __Event class: __NamespaceOperationEvent, __InstanceOperationEvent, and __ClassOperationEvent.
Intrinsic Events
Intrinsic events are used to monitor a resource represented by a class in the CIM repository. Each resource is represented by an instance of a class. This means that monitoring a resource using WMI actually involves monitoring the instances that correspond to the resource.
Intrinsic events can also be used to monitor changes to a namespace or class in the repository. However, monitoring changes to namespaces or classes is of limited value to system administrators.
An intrinsic event is represented by an instance of a class derived from __InstanceOperationEvent, __NamespaceOperationEvent, or __ClassOperationEvent. Any changes to instances in WMI are represented by the __InstanceOperationEvent class and the classes derived from it: __InstanceCreationEvent, __InstanceModificationEvent, and __InstanceDeletionEvent.
Monitoring resources using WMI involves monitoring instances and all changes to instances are represented by __InstanceOperationEvent and the classes derived from it. This means that monitoring resources ultimately involves monitoring instances of __InstanceOperationEvent-derived classes.
You register interest in instances of one of these classes by issuing a notification query expressed in WQL. The query uses syntax similar to the following:
SELECT * FROM __InstanceOperationEventOrDerivedClass WITHIN PollingInterval WHERE TargetInstance ISA WMIClassName AND TargetInstance.WMIClassPropertyName = Value
For a longer discussion of using the WMI instance events to monitor computer activity, see How Can I Monitor for Different Types of Events With Just One Script?
Requirements
| Requirement | Value |
|---|---|
| Minimum supported client |
Windows Vista |
| Minimum supported server |
Windows Server 2008 |
| Namespace |
All WMI namespaces |