< Back
Register-CimIndicationEvent
Post
NAME Register-CimIndicationEvent
SYNOPSIS
Subscribes to indications using a filter expression or a query expression.
SYNTAX
Register-CimIndicationEvent [-ClassName] <String> [[-SourceIdentifier] <String>] [[-Action] <ScriptBlock>] [-ComputerName <String>] [-Forward]
[-MaxTriggerCount <System.Int32>] [-MessageData <PSObject>] [-Namespace <String>] [-OperationTimeoutSec <UInt32>] [-SupportEvent]
[<CommonParameters>]
Register-CimIndicationEvent [-Query] <String> [[-SourceIdentifier] <String>] [[-Action] <ScriptBlock>] [-Forward] [-MaxTriggerCount
<System.Int32>] [-MessageData <PSObject>] [-Namespace <String>] [-OperationTimeoutSec <UInt32>] [-QueryDialect <String>] [-SupportEvent]
-CimSession <CimSession> [<CommonParameters>]
Register-CimIndicationEvent [-ClassName] <String> [[-SourceIdentifier] <String>] [[-Action] <ScriptBlock>] [-Forward] [-MaxTriggerCount
<System.Int32>] [-MessageData <PSObject>] [-Namespace <String>] [-OperationTimeoutSec <UInt32>] [-SupportEvent] -CimSession <CimSession>
[<CommonParameters>]
Register-CimIndicationEvent [-Query] <String> [[-SourceIdentifier] <String>] [[-Action] <ScriptBlock>] [-ComputerName <String>] [-Forward]
[-MaxTriggerCount <System.Int32>] [-MessageData <PSObject>] [-Namespace <String>] [-OperationTimeoutSec <UInt32>] [-QueryDialect <String>]
[-SupportEvent] [<CommonParameters>]
DESCRIPTION
The Register-CimIndicationEvent cmdlet subscribes to indications using an indication class name or a query expression.
Use the SourceIdentifier parameter to give a name to the subscription.
This cmdlet returns a PS EventSubscription object. You can use this object to cancel the subscription.
PARAMETERS
-Action [<ScriptBlock>]
Specifies the commands that handle the events.
The commands specified by this parameter run when an event is raised, instead of sending the event to the event queue. Enclose the commands in
braces ( { } ) to create a script block.
The script block specified with Action can include the $Event, $EventSubscriber, $Sender, $SourceEventArgs, and $SourceArgs automatic
variables, which provide information about the event to the Action script block. For more information about automatic variables, see
http://technet.microsoft.com/library/hh847768.aspx.
Required? false
Position? 102
Default value none
Accept pipeline input? false
Accept wildcard characters? false
-CimSession <CimSession>
Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a New-CimSession
or Get-CimSession cmdlet. The default is the current session on the local computer.
Required? true
Position? named
Default value none
Accept pipeline input? false
Accept wildcard characters? false
-ClassName <String>
Specifies the indication class to which you are subscribing.
Note: You can use tab completion to browse the list of classes, because Windows PowerShell gets a list of classes from the local WMI server to
provide a list of class names.
Required? true
Position? 1
Default value none
Accept pipeline input? false
Accept wildcard characters? false
-ComputerName [<String>]
Specifies the name of the computer on which you want to run the CIM operation. You can specify a fully qualified domain name (FQDN), a NetBIOS
name, or an IP address.
If you specify this parameter, the cmdlet creates a temporary session to the specified computer using the WsMan protocol.
If you do not specify this parameter, the cmdlet performs operation on the local system using Component Object Model (COM).
If multiple operations are being performed on the same computer, connecting using a CIM session gives better performance.
Required? false
Position? named
Default value none
Accept pipeline input? false
Accept wildcard characters? false
-Forward [<SwitchParameter>]
Indicates that events for the subscription are forwarded to the session on the local computer.
Use this parameter when you are registering for events on a remote computer or in a remote session.
Required? false
Position? named
Default value none
Accept pipeline input? false
Accept wildcard characters? false
-MaxTriggerCount [<System.Int32>]
The commands specified by this parameter run when an event is raised, instead of sending the event to the event queue. Enclose the commands in
braces ( { } ) to create a script block.
The script block specified with Action can include the $Event, $EventSubscriber, $Sender, $SourceEventArgs, and $SourceArgs automatic
variables, which provide information about the event to the Action script block. For more information, see about_Automatic_Variables.
Required? false
Position? named
Default value none
Accept pipeline input? false
Accept wildcard characters? false
-MessageData [<PSObject>]
Specifies any additional data to be associated with this event subscription.
The value of this parameter appears in the MessageData property of all the events associated with this subscription.
Required? false
Position? named
Default value none
Accept pipeline input? false
Accept wildcard characters? false
-Namespace [<String>]
Specifies the namespace for the CIM operation.
The default namespace is root/cimv2.
Note: You can use tab completion to browse the list of namespaces, because Windows PowerShell gets a list of namespaces from the local WMI
server to provide the list of namespaces.
Required? false
Position? named
Default value none
Accept pipeline input? false
Accept wildcard characters? false
-OperationTimeoutSec [<UInt32>]
Specifies the amount of time that the cmdlet waits for a response from the computer.
By default, the value of this parameter is 0, which means that the cmdlet uses the default timeout value for the server.
If the OperationTimeoutSec parameter is set to a value less than the robust connection retry timeout of 3 minutes, network failures that last
more than the value of the OperationTimeoutSec parameter are not recoverable, because the operation on the server times out before the client
can reconnect.
Required? false
Position? named
Default value none
Accept pipeline input? false
Accept wildcard characters? false
-Query <String>
Specifies a query to run on the CIM server.
You can specify the query dialect using the QueryDialect parameter.
If the value specified contains double quotes (???????), single quotes (???????), or a backslash (\\), you must escape those characters by prefixing them
with the backslash (\\) character. If the value specified uses the WQL LIKE operator, then you must escape the following characters by
enclosing them in square brackets ([]): percent (%), underscore (_), or opening square bracket ([).
Required? true
Position? 1
Default value none
Accept pipeline input? false
Accept wildcard characters? false
-QueryDialect [<String>]
Specifies the query language used for the Query parameter. The acceptable values for this parameter are:
-- WQL
-- CQL
The default value is WQL.
Required? false
Position? named
Default value none
Accept pipeline input? false
Accept wildcard characters? false
-SourceIdentifier [<String>]
Specifies a name for the subscription. The name that you specify must be unique in the current session.
The default value is a GUID that Windows PowerShell???? assigns.
The value of this parameter appears in the value of the SourceIdentifier property of the subscriber object and of all event objects associated
with this subscription.
Required? false
Position? 101
Default value none
Accept pipeline input? false
Accept wildcard characters? false
-SupportEvent [<SwitchParameter>]
Indicates that the event subscription is hidden.
Use this parameter when the current subscription is part of a more complex event registration mechanism and it should not be discovered
independently.
Required? false
Position? named
Default value none
Accept pipeline input? false
Accept wildcard characters? false
<CommonParameters>
This cmdlet supports the common parameters: Verbose, Debug,
ErrorAction, ErrorVariable, WarningAction, WarningVariable,
OutBuffer, PipelineVariable, and OutVariable. For more information, see
about_CommonParameters (http://go.microsoft.com/fwlink/?LinkID=113216).
INPUTS
None
This cmdlet accepts no input objects.
OUTPUTS
System.Object
This cmdlet outputs a PS EventSubscription object.
Example 1: Register the events generated by a class
PS C:\\>Register-CimIndicationEvent -ClassName "Win32_ProcessStartTrace" -SourceIdentifier "ProcessStarted"
PS C:\\> Get-Event -SourceIdentifier "ProcessStarted"
To remove the event from the cache, use the Remove-Event cmdlet.
PS C:\\>Remove-Event -SourceIdentifier "ProcessStarted"
To unregister the event, use the Unregister-Event cmdlet.
PS C:\\>Unregister-Event -SourceIdentifier "ProcessStarted"
This set of commands subscribes to the events generated by the class named Win32_ProcessStartTrace which raises an event whenever a process
starts, and gets the events with ProcessStarted subscription using the Get-Event cmdlet.
Note: for this example, you must run Windows PowerShell as an Administrator.
Example 2: Register the events using a query
PS C:\\>$query = "SELECT * FROM CIM_InstModification WHERE TargetInstance ISA 'Win32_LocalTime'"
PS C:\\> Register-CimIndicationEvent -Query $query -SourceIdentifier "Timer"
This set of commands uses a query to subscribe to an event generated whenever there is a change in the instance of a class named Win32_LocalTime.
Example 3: Run a script when the event arrives
PS C:\\>$action = {$name = $event.SourceEventArgs.NewEvent.ProcessName; $id = $event.SourceEventArgs.NewEvent.ProcessId; Write-Host ????????Object "New
Process Started : Name = $name; ID = $id"}
PS C:\\> Register-CimIndicationEvent -ClassName 'Win32_ProcessStartTrace' -SourceIdentifier "ProcessStarted" -Action $action
This set of commands shows how to use an action in response to an event. The variable $action holds the script block for Action, which uses the
$event variable to access the event received from CIM. Using $action, the Register-CimIndicationEvent cmdlet subscribes to the event generated by
the class named Win32_ProcessStartTrace.
For more information, see Win32_ProcessStartTrace class.
Example 4: Register the events on a remote computer
PS C:\\>Register-CimIndicationEvent -ClassName 'Win32_ProcessStartTrace' -SourceIdentifier "ProcessStarted" -ComputerName "Server01"
PS C:\\> Get-Event -SourceIdentifier "ProcessStarted"
This set of commands subscribes to events on a remote computer named Server01 using the Register-CimIndicationEvent cmdlet. Events received from
the CIM server are stored in the event queue in the current Windows PowerShell session and then runs a local Get-Event to retrieve the events.
RELATED LINKS
Online Version:
Get-CimSession
New-CimSessionOption
SYNOPSIS
Subscribes to indications using a filter expression or a query expression.
SYNTAX
Register-CimIndicationEvent [-ClassName] <String> [[-SourceIdentifier] <String>] [[-Action] <ScriptBlock>] [-ComputerName <String>] [-Forward]
[-MaxTriggerCount <System.Int32>] [-MessageData <PSObject>] [-Namespace <String>] [-OperationTimeoutSec <UInt32>] [-SupportEvent]
[<CommonParameters>]
Register-CimIndicationEvent [-Query] <String> [[-SourceIdentifier] <String>] [[-Action] <ScriptBlock>] [-Forward] [-MaxTriggerCount
<System.Int32>] [-MessageData <PSObject>] [-Namespace <String>] [-OperationTimeoutSec <UInt32>] [-QueryDialect <String>] [-SupportEvent]
-CimSession <CimSession> [<CommonParameters>]
Register-CimIndicationEvent [-ClassName] <String> [[-SourceIdentifier] <String>] [[-Action] <ScriptBlock>] [-Forward] [-MaxTriggerCount
<System.Int32>] [-MessageData <PSObject>] [-Namespace <String>] [-OperationTimeoutSec <UInt32>] [-SupportEvent] -CimSession <CimSession>
[<CommonParameters>]
Register-CimIndicationEvent [-Query] <String> [[-SourceIdentifier] <String>] [[-Action] <ScriptBlock>] [-ComputerName <String>] [-Forward]
[-MaxTriggerCount <System.Int32>] [-MessageData <PSObject>] [-Namespace <String>] [-OperationTimeoutSec <UInt32>] [-QueryDialect <String>]
[-SupportEvent] [<CommonParameters>]
DESCRIPTION
The Register-CimIndicationEvent cmdlet subscribes to indications using an indication class name or a query expression.
Use the SourceIdentifier parameter to give a name to the subscription.
This cmdlet returns a PS EventSubscription object. You can use this object to cancel the subscription.
PARAMETERS
-Action [<ScriptBlock>]
Specifies the commands that handle the events.
The commands specified by this parameter run when an event is raised, instead of sending the event to the event queue. Enclose the commands in
braces ( { } ) to create a script block.
The script block specified with Action can include the $Event, $EventSubscriber, $Sender, $SourceEventArgs, and $SourceArgs automatic
variables, which provide information about the event to the Action script block. For more information about automatic variables, see
http://technet.microsoft.com/library/hh847768.aspx.
Required? false
Position? 102
Default value none
Accept pipeline input? false
Accept wildcard characters? false
-CimSession <CimSession>
Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a New-CimSession
or Get-CimSession cmdlet. The default is the current session on the local computer.
Required? true
Position? named
Default value none
Accept pipeline input? false
Accept wildcard characters? false
-ClassName <String>
Specifies the indication class to which you are subscribing.
Note: You can use tab completion to browse the list of classes, because Windows PowerShell gets a list of classes from the local WMI server to
provide a list of class names.
Required? true
Position? 1
Default value none
Accept pipeline input? false
Accept wildcard characters? false
-ComputerName [<String>]
Specifies the name of the computer on which you want to run the CIM operation. You can specify a fully qualified domain name (FQDN), a NetBIOS
name, or an IP address.
If you specify this parameter, the cmdlet creates a temporary session to the specified computer using the WsMan protocol.
If you do not specify this parameter, the cmdlet performs operation on the local system using Component Object Model (COM).
If multiple operations are being performed on the same computer, connecting using a CIM session gives better performance.
Required? false
Position? named
Default value none
Accept pipeline input? false
Accept wildcard characters? false
-Forward [<SwitchParameter>]
Indicates that events for the subscription are forwarded to the session on the local computer.
Use this parameter when you are registering for events on a remote computer or in a remote session.
Required? false
Position? named
Default value none
Accept pipeline input? false
Accept wildcard characters? false
-MaxTriggerCount [<System.Int32>]
The commands specified by this parameter run when an event is raised, instead of sending the event to the event queue. Enclose the commands in
braces ( { } ) to create a script block.
The script block specified with Action can include the $Event, $EventSubscriber, $Sender, $SourceEventArgs, and $SourceArgs automatic
variables, which provide information about the event to the Action script block. For more information, see about_Automatic_Variables.
Required? false
Position? named
Default value none
Accept pipeline input? false
Accept wildcard characters? false
-MessageData [<PSObject>]
Specifies any additional data to be associated with this event subscription.
The value of this parameter appears in the MessageData property of all the events associated with this subscription.
Required? false
Position? named
Default value none
Accept pipeline input? false
Accept wildcard characters? false
-Namespace [<String>]
Specifies the namespace for the CIM operation.
The default namespace is root/cimv2.
Note: You can use tab completion to browse the list of namespaces, because Windows PowerShell gets a list of namespaces from the local WMI
server to provide the list of namespaces.
Required? false
Position? named
Default value none
Accept pipeline input? false
Accept wildcard characters? false
-OperationTimeoutSec [<UInt32>]
Specifies the amount of time that the cmdlet waits for a response from the computer.
By default, the value of this parameter is 0, which means that the cmdlet uses the default timeout value for the server.
If the OperationTimeoutSec parameter is set to a value less than the robust connection retry timeout of 3 minutes, network failures that last
more than the value of the OperationTimeoutSec parameter are not recoverable, because the operation on the server times out before the client
can reconnect.
Required? false
Position? named
Default value none
Accept pipeline input? false
Accept wildcard characters? false
-Query <String>
Specifies a query to run on the CIM server.
You can specify the query dialect using the QueryDialect parameter.
If the value specified contains double quotes (???????), single quotes (???????), or a backslash (\\), you must escape those characters by prefixing them
with the backslash (\\) character. If the value specified uses the WQL LIKE operator, then you must escape the following characters by
enclosing them in square brackets ([]): percent (%), underscore (_), or opening square bracket ([).
Required? true
Position? 1
Default value none
Accept pipeline input? false
Accept wildcard characters? false
-QueryDialect [<String>]
Specifies the query language used for the Query parameter. The acceptable values for this parameter are:
-- WQL
-- CQL
The default value is WQL.
Required? false
Position? named
Default value none
Accept pipeline input? false
Accept wildcard characters? false
-SourceIdentifier [<String>]
Specifies a name for the subscription. The name that you specify must be unique in the current session.
The default value is a GUID that Windows PowerShell???? assigns.
The value of this parameter appears in the value of the SourceIdentifier property of the subscriber object and of all event objects associated
with this subscription.
Required? false
Position? 101
Default value none
Accept pipeline input? false
Accept wildcard characters? false
-SupportEvent [<SwitchParameter>]
Indicates that the event subscription is hidden.
Use this parameter when the current subscription is part of a more complex event registration mechanism and it should not be discovered
independently.
Required? false
Position? named
Default value none
Accept pipeline input? false
Accept wildcard characters? false
<CommonParameters>
This cmdlet supports the common parameters: Verbose, Debug,
ErrorAction, ErrorVariable, WarningAction, WarningVariable,
OutBuffer, PipelineVariable, and OutVariable. For more information, see
about_CommonParameters (http://go.microsoft.com/fwlink/?LinkID=113216).
INPUTS
None
This cmdlet accepts no input objects.
OUTPUTS
System.Object
This cmdlet outputs a PS EventSubscription object.
Example 1: Register the events generated by a class
PS C:\\>Register-CimIndicationEvent -ClassName "Win32_ProcessStartTrace" -SourceIdentifier "ProcessStarted"
PS C:\\> Get-Event -SourceIdentifier "ProcessStarted"
To remove the event from the cache, use the Remove-Event cmdlet.
PS C:\\>Remove-Event -SourceIdentifier "ProcessStarted"
To unregister the event, use the Unregister-Event cmdlet.
PS C:\\>Unregister-Event -SourceIdentifier "ProcessStarted"
This set of commands subscribes to the events generated by the class named Win32_ProcessStartTrace which raises an event whenever a process
starts, and gets the events with ProcessStarted subscription using the Get-Event cmdlet.
Note: for this example, you must run Windows PowerShell as an Administrator.
Example 2: Register the events using a query
PS C:\\>$query = "SELECT * FROM CIM_InstModification WHERE TargetInstance ISA 'Win32_LocalTime'"
PS C:\\> Register-CimIndicationEvent -Query $query -SourceIdentifier "Timer"
This set of commands uses a query to subscribe to an event generated whenever there is a change in the instance of a class named Win32_LocalTime.
Example 3: Run a script when the event arrives
PS C:\\>$action = {$name = $event.SourceEventArgs.NewEvent.ProcessName; $id = $event.SourceEventArgs.NewEvent.ProcessId; Write-Host ????????Object "New
Process Started : Name = $name; ID = $id"}
PS C:\\> Register-CimIndicationEvent -ClassName 'Win32_ProcessStartTrace' -SourceIdentifier "ProcessStarted" -Action $action
This set of commands shows how to use an action in response to an event. The variable $action holds the script block for Action, which uses the
$event variable to access the event received from CIM. Using $action, the Register-CimIndicationEvent cmdlet subscribes to the event generated by
the class named Win32_ProcessStartTrace.
For more information, see Win32_ProcessStartTrace class.
Example 4: Register the events on a remote computer
PS C:\\>Register-CimIndicationEvent -ClassName 'Win32_ProcessStartTrace' -SourceIdentifier "ProcessStarted" -ComputerName "Server01"
PS C:\\> Get-Event -SourceIdentifier "ProcessStarted"
This set of commands subscribes to events on a remote computer named Server01 using the Register-CimIndicationEvent cmdlet. Events received from
the CIM server are stored in the event queue in the current Windows PowerShell session and then runs a local Get-Event to retrieve the events.
RELATED LINKS
Online Version:
Get-CimSession
New-CimSessionOption