3.1.6.1 Indication Event Is Generated

The server MUST execute the following algorithm for each row of the EventBindingTable.

1. Check whether the indication matches the EventFilter. If not, then skip to the next row.

2. If the SECURITY_DESCRIPTOR property of indication is available, check whether client has access to this indication by Validating the SECURITY_DESCRIPTOR property of the indication against ClientSecurityContext. If the client does not have access, the server MUST ignore this indication.

3. If an EventGroupingTimer exists in this row, search the EventGroupAggregateQueue for an event that meets the matching criteria specified in the "BY" clause of the filter (or any event, if no "BY" clause was specified). If no matching event is found, create a new __AggregateEvent with a copy of the indication in the Representative property and one in the NumberOfEvents property; otherwise, increment the event's NumberOfEvents property. If the number of rows in the EventGroupAggregateQueue is more than EventDropLimit, return WBEM_E_QUEUE_OVERFLOW to the client.  If the EventGroupingTimer is not currently active, then start it.

4. Otherwise, if an EventPollingTimer exists in this row, then add the indication to the EventQueue.  If the number of rows in the EventQueue is more than EventDropLimit, return WBEM_E_QUEUE_OVERFLOW to the client.

5. Otherwise, deliver the indication to the client via the EventConsumer interface in that row.