Event Log Provider
The Event Log provider supplies the following:
- Access to data from the Event Log service.
- Notifications of events.
The Event Log service writes events to one of several log files. The Event Log provider uses the Win32_NTEventLogFile class to map data from the event logs to WMI objects. The Event Log provider also uses the Win32_NTLogEvent class to represent events. The two __Win32Provider instance names are MS_NT_EVENTLOG_PROVIDER and MS_NT_EVENTLOG_EVENT_PROVIDER.
As an instance, method, and event provider, the Event Log provider implements the standard IWbemProviderInit interface and the following IWbemServices methods:
- CreateInstanceEnumAsync
- ExecMethodAsync
- ExecNotificationQueryAsync
- ExecQueryAsync
- GetObjectAsync
- PutInstanceAsync
The Ntevt.mof file contains the Event Log provider, association, and registration classes. You can access the Event Log provider classes only in the root\cimv2 namespace.
The Event Log provider supports the following classes:
- Win32_NTEventlogFile
- Win32_NTLogEvent
- Win32_NTLogEventLog
- Win32_NTLogEventUser
- Win32_NTLogEventComputer
Related topics