2.3.1.2 MSFT_NetEventProvider Class

The MSFT_NetEventProvider MOF class is used for configuring an event session on a remote computer. A client can add event providers to a session by creating MSFT_NetEventProvider objects with the SessionGuid property equal to the GUID of an existing MSFT_NetEventSession object (section 2.3.1.1). 

After an instance is created, all properties are read-only via WS-Management [DMTF-DSP0226], except the Level, MatchAnyKeyword, and MatchAllKeyword properties which are read-write.

 class MSFT_NetEventProvider {
     string Guid;
     string SessionGuid;
     string Name;
     string SessionName;
     uint8 Level;
     uint64 MatchAnyKeyword;
     uint64 MatchAllKeyword;
 };

Guid:  This property specifies a GUID for the provider ID from a provider manifest.

SessionGuid:  This property specifies the identifier of an existing MSFT_NetEventSession object (section 2.3.1.1). The value of this member corresponds to the MSFT_NetEventSession.Guid property.

Name:  This property specifies a unique provider name from the provider manifest.

SessionName:  This property specifies a unique session name that corresponds to the value of the MSFT_NetEventSession.Name member (see section 2.3.1.1).

Level:  This property specifies the maximum level of events to include in the session, as shown in the following table. A value of 0x00 indicates that all levels are to be included in the session.

Value

Meaning

TRACE_LEVEL_CRITICAL

0x01

Only include abnormal exit or termination events.

TRACE_LEVEL_ERROR

0x02

Include all events corresponding to event level 1 and severe error events.

TRACE_LEVEL_WARNING

0x03

Include all events corresponding to lower event levels 1 and 2 and warning events, such as allocation failures.

TRACE_LEVEL_INFORMATION

0x04

Include all events corresponding to lower event levels 1 through 3 and non-error event, such as entry or exit events.

TRACE_LEVEL_VERBOSE

0x05

Include all events corresponding to lower event levels 1 through 4 and detailed trace events.

MatchAnyKeyword:  This property specifies a bitmask of keywords that is used to determine the category of events to include in the event session. The keyword values are event provider-specific and defined in the provider manifest. When any keyword assigned to an event matches any bit set in the MatchAnyKeyword property, then that event is included in the event session. A value of zero is equivalent to 0xFFFFFFFFFFFFFFFF and indicates to include all categories of events.   

MatchAllKeyword:  This property specifies a bitmask of keywords from the provider manifest which is used to further restrict the categories of events to includ in the event session. When a keyword for an event satisfies the conditions specified in the MatchAnyKeyword property, the event is included in the event session only if all of the bits in the MatchAllKeyword mask exist in the keyword. This mask is not used when the MatchAnyKeyword property is set to zero.