2.3.1.1 MSFT_NetEventSession Class

  • Article

The MSFT_NetEventSession MOF class is used for configuring and starting an event session on a remote computer. After an instance is created, all properties are read-only via WS-Management [DMTF-DSP0226] and cannot be changed by a client.

 class MSFT_NetEventSession {
     string Guid;
     string Name;
     uint8 CaptureMode; 
     string LocalFilePath;
     uint32 MaxFileSize;
     uint32 TraceBufferSize;
     uint8 MaxNumberOfBuffers;
     uint8 SessionStatus;
     uint8 Start();
     uint8 Stop();
 };

Guid:  This property specifies a globally unique identifier (GUID) for the session in curly braced string representation, as defined in [MS-DTYP] section 2.3.4.3.

Name:  This property specifies a friendly name for the event session that was assigned by the client when the session was created. 

CaptureMode:  This property MUST be set to 0x02 (RealtimeRPC).

LocalFilePath:  This property is reserved and MUST be set to an empty string.

MaxFileSize:  This property is reserved and MUST be set to 0.

TraceBufferSize:  This property specifies the amount of memory allocated for each event tracing session buffer, in kilobytes. The maximum value is 0x00000400 (decimal 1024). A value of zero (0x00000000) indicates that it is permissible for the server to specify a different value.

MaxNumberOfBuffers:  This property specifies the maximum number of buffers allocated for the event tracing session.  A value of 0x00 indicates that it is permissible for the server to specify a different value.

SessionStatus:  This property indicates the current event session state which MUST be set to one of the following values.

Value

Meaning

Stopped

1

The event session is stopped.

Running

2

The event session is running.

Start:  A method that is used to start an event session that has been previously associated with at least one MSFT_NetEventProvider object (section 2.3.1.2). The method is defined in section 3.1.4.1.2.

Stop:  A method that is used to stop a previously started event session. The method is defined in section 3.1.4.1.3.