Implementing the Primary Interface for an Event Provider

An event provider must implement the IWbemEventProvider interface to generate event notifications. WMI calls the IWbemEventProvider::ProvideEvents method of the provider and passes in a pointer to the sink object, which is an implementation of the IWbemObjectSink interface. When the event provider is ready to generate a notification, the provider calls the IWbemObjectSink::Indicate method.

An event provider should place the notifications generated through IWbemEventProvider in event objects. You should implement event objects as entries in an array of IWbemClassObject interfaces represented by the ppObjArray parameter of the Indicate method. Because IWbemClassObjects are COM objects, the provider must increment the reference count for the sink by calling the IWbemObjectSink::AddRef method. Event providers that must supply many notifications (for example, 400 events) should create a unique event object for each notification by either spawning a new instance or cloning an existing one. WMI never holds onto an event object past the completion of the Indicate call, and has no special requirements for AddRef above and beyond the COM standard.

Consider the following guidelines when implementing an event provider:

• Do not make any class changes while servicing a client call.

• Do not issue any event-related calls, such as a call that modifies an event filter.

• Process any requests that the Windows Management service issues, such as CancelQuery, before refiring an event.

  If you do not process the request, then refiring the event might block the event from ever being accepted.

• Never call IWbemObjectSink::SetStatus from within a provider.