WQL - EVENT QUERY

最新推荐文章于 2025-09-12 02:29:22 发布

最新推荐文章于 2025-09-12 02:29:22 发布 · 146 阅读

本文详细介绍了WMIEVENTQUERY语法及使用方法，包括如何构建WMI查询以接收事件，如实例创建事件，并设置条件筛选特定事件。此外还展示了如何注册事件并指定动作。

WMI EVENT QUERY

EVENT-WQL = “SELECT” <PROPERTY-LIST> “FROM” /
<EVENT-CLASS-NAME> <OPTIONAL-WITHIN> <EVENT-WHERE>

OPTIONAL-WITHIN = ["WITHIN" <INTERVAL>]
INTERVAL = 1*DIGIT
EVENT-WHERE = ["WHERE" <EVENT-EXPR>]

EVENT-EXPR = ( (<INSTANCE-STATE> “ISA” <CLASS-NAME> <EXPR2>) /
< EXPR> )
["GROUP WITHIN" <INTERVAL>
( ["BY" [<INSTANCE-STATE> DOT] <PROPERTY-NAME>]
["HAVING" <EXPR>]] )
INSTANCE-STATE = “TARGETINSTANCE” / “PREVIOUSINSTANCE”

WITHIN

SELECT * FROM eventclass WITHIN interval WHERE property = value

GROUP

SELECT * FROM EventClass [WHERE property = value] GROUP WITHIN interval

#Build a WMI query for receiving an event$query = "Select * from __instanceCreationEvent WHERE TargetInstance ISA 'Win32_NTLogEvent' ANDTargetInstance.EventCode=1980 GROUP WITHIN 300"#Register the eventRegister-WmiEvent -Query $query -Action {Write-Host "Eventlog Arrived" }

HAVING

#Build a WMI query for receiving an event$query = "Select * from __instanceCreationEvent WHERE TargetInstance ISA 'Win32_NTLogEvent' ANDTargetInstance.EventCode=1980 GROUP WITHIN 300 HAVING NumberOfEvents > 10"#Register the eventRegister-WmiEvent -Query $query -Action {Write-Host "Eventlog Arrived" }

SELECT * FROM EventClass [WHERE property = value]
GROUP WITHIN interval HAVING NumberOfEvents operator constant

SELECT * FROM EventClass [WHERE property = value]
GROUP WITHIN interval [BY property_list]

#Build a WMI query for receiving an event$query = "Select * from __instanceCreationEvent WHERE TargetInstance ISA 'Win32_NTLogEvent' ` GROUP WITHIN 300 BY TargetInstance.SourceName ` HAVING NumberOfEvents > 10"#Register the eventRegister-WmiEvent -Query $query -Action {Write-Host "Eventlog Arrived" }