LogFileEventConsumer class
The LogFileEventConsumer class writes customized strings to a text log file when events are delivered to it. The strings are separated by end-of-line sequences. This class is one of the standard event consumers that WMI provides. For more information, see Monitoring and Responding to Events with Standard Consumers.
Syntax
[AMENDMENT]
class LogFileEventConsumer : __EventConsumer
{
uint8 CreatorSID[];
string MachineName;
uint32 MaximumQueueSize;
string Filename;
boolean IsUnicode;
uint64 MaximumFileSize = 65535;
string Name;
string Text;
};
Members
The LogFileEventConsumer class has these types of members:
Properties
The LogFileEventConsumer class has these properties.
-
CreatorSID
-
-
Data type: uint8 array
-
Access type: Read-only
Security identifier (SID) that uniquely identifies the user who creates a filter. WMI stores the SID of the user who creates an instance of __EventConsumer or the Administrator SID, depending on the operating system. For more information, see Binding an Event Filter with a Logical Consumer and Monitoring and Responding to Events with Standard Consumers.
This property is inherited from __EventConsumer.
-
-
Filename
-
-
Data type: string
-
Access type: Read-only
Name of a file that includes the path to which the log entries are appended. If the file does not exist, LogFileEventConsumer attempts to create it. The consumer fails when the path does not exist, or when the user who creates the consumer does not have write permissions for the file or path.
-
-
IsUnicode
-
-
Data type: boolean
-
Access type: Read-only
If TRUE, the log file is a Unicode text file. If FALSE, the log file is a multibyte code text file. If the file exists, this property is ignored and the current file setting is used. For example, if IsUnicode is FALSE, but the existing file is a Unicode file, then Unicode is used. If IsUnicode is TRUE, but the file is multibyte code, then multibyte code is used.
-
-
MachineName
-
-
Data type: string
-
Access type: Read-only
Name of the computer to which Windows Management Instrumentation (WMI) sends events.
This property is inherited from __EventConsumer.
-
-
MaximumFileSize
-
-
Data type: uint64
-
Access type: Read-only
Maximum size of a log file in bytes. If the primary file exceeds its maximum size, the contents are moved to a different file and the primary file is emptied. A value of 0 (zero) means there is no size limit. The default value is 65,535 bytes. The size of the file is checked before a write operation. Therefore, you can have a file that is slightly larger than the specified size limit. The next write operation catches it and starts a new file.
The following list identifies the naming structure for the backup file:
- If the original filename is 8.3, the extension is replaced by a string in the format of "001", "002", and so on with the smallest number larger than all the previously used and chosen numbers. If "999" is used, then the number chosen is the smallest unused number.
- If the original filename is not 8.3, a string in the format of "001", "002", and so on is appended to the file name.
For more information about using uint64 values in scripts, see Scripting in WMI.
-
-
MaximumQueueSize
-
-
Data type: uint32
-
Access type: Read-only
Maximum queue for a specific consumer, in bytes.
This property is inherited from __EventConsumer.
-
-
Name
-
-
Data type: string
-
Access type: Read-only
-
Qualifiers: key
Unique name for this consumer.
-
-
Text
-
-
Data type: string
-
Access type: Read-only
Standard string template for the text of a log entry.
-
Remarks
Note
The LogFileEventConsumer does not secure the log file. Therefore, when you configure the LogFileEventConsumer, it is important to specify a directory that is secured to the level that you require.
The LogFileEventConsumer class is derived from the __EventConsumer abstract class.
Examples
For an example of using LogFileEventConsumer to create a consumer, see Writing to a Log File Based on an Event.
Requirements
| Requirement | Value |
|---|---|
| Minimum supported client |
Windows Vista |
| Minimum supported server |
Windows Server 2008 |
| Namespace |
Root\subscription |
| MOF |
|
| DLL |
|