////////////////////////////////////////////////////////////////////////////// // sd.mof contains: // SD Event Generator definitions for ESSTest // Tests security // // Event and provider definitions for: // MSFT_EssTestSDEveryoneEvent // MSFT_EssTestSDSystemEvent #pragma namespace("\\\\.\\root\\cimv2") ////////////////////////////////////////////////////////////////////////////// // MSFT_EssTestSDEveryoneEvent class MSFT_EssTestSDEveryoneEvent : __ExtrinsicEvent { uint32 Index; }; // Fires MSFT_EssTestSDEveryoneEvent instance of MSFT_EssEventGenerator as $Gen1 { Name = "Everyone Event Generator"; CommandLine = "mofprov \"/Nroot\\cimv2\" \"/PDecoupled Everyone Event Generator\" " "\"/F%ResultsFile%\" /B64000 /L1000 /OSystem /GAdministrators /AEveryone"; Script = "PrintMOF();\n" "\n" "function PrintMOF()\n" "{\n" " var args = WScript.Arguments;\n" "\n" " for (Index = 0; Index < args(0); Index++)\n" " {\n" " if (%ScriptRule%)\n" " {\n" " var strOut =\n" " \"instance of MSFT_EssTestSDEveryoneEvent \" +\n" " \"{\" +\n" " \" Index = \" + Index + \";\" +\n" " \"};\"\n" " \n" " WScript.Echo(strOut);\n" " }\n" " }\n" "};\n"; }; instance of MSFT_EssTestWorkItem { Name = "Everyone Events"; EventGenerator = $Gen1; Enabled = false; NumEvents = 5000; TimesToExecute = 1; MaxPermConsumers = 2; MaxTempConsumers = 2; SlowDownProviders = true; }; instance of MSFT_EssTestFilter { Name = "Everyone Ranges: 100-200,400-500"; EventGenerator = $Gen1; Query = "select * from MSFT_EssTestSDEveryoneEvent " "where (Index >= 100 and Index <= 200) or" "(Index >= 400 and Index <= 500)"; ScriptRule = "(Index >= 100 && Index <= 200) || " "(Index >= 400 && Index <= 500)"; Behavior = 1; }; ////////////////////////////////////////////////////////////////////////////// // Decoupled event provider registration. instance of Win32PseudoProvider as $P1 { Name = "Decoupled Everyone Event Generator"; }; instance of __EventProviderRegistration { Provider = $P1; EventQueryList = { "select * from MSFT_EssTestSDEveryoneEvent" }; }; ////////////////////////////////////////////////////////////////////////////// // MSFT_EssTestSDEveryoneEvent class MSFT_EssTestSDSystemEvent : __ExtrinsicEvent { uint32 Index; }; // Fires MSFT_EssTestSDEveryoneEvent instance of MSFT_EssEventGenerator as $Gen2 { Name = "System Event Generator"; CommandLine = "mofprov \"/Nroot\\cimv2\" \"/PDecoupled System Event Generator\" " "\"/F%ResultsFile%\" /B64000 /L1000 /OSystem /GAdministrators /ASystem"; Script = "PrintMOF();\n" "\n" "function PrintMOF()\n" "{\n" " var args = WScript.Arguments;\n" "\n" " for (Index = 0; Index < args(0); Index++)\n" " {\n" " if (%ScriptRule%)\n" " {\n" " var strOut =\n" " \"instance of MSFT_EssTestSDSystemEvent \" +\n" " \"{\" +\n" " \" Index = \" + Index + \";\" +\n" " \"};\"\n" " \n" " WScript.Echo(strOut);\n" " }\n" " }\n" "};\n"; }; instance of MSFT_EssTestWorkItem { Name = "System Events"; EventGenerator = $Gen2; Enabled = false; NumEvents = 5000; TimesToExecute = 1; MaxPermConsumers = 2; MaxTempConsumers = 2; SlowDownProviders = true; }; instance of MSFT_EssTestFilter { Name = "System Ranges: 100-200,400-500"; EventGenerator = $Gen2; Query = "select * from MSFT_EssTestSDSystemEvent " "where (Index >= 100 and Index <= 200) or" "(Index >= 400 and Index <= 500)"; // We should never get any events because only the system // has been granted access to these events. ScriptRule = "0"; Behavior = 1; }; ////////////////////////////////////////////////////////////////////////////// // Decoupled event provider registration. instance of Win32PseudoProvider as $P2 { Name = "Decoupled System Event Generator"; }; instance of __EventProviderRegistration { Provider = $P2; EventQueryList = { "select * from MSFT_EssTestSDSystemEvent" }; };