#pragma namespace ("\\\\.\\root") instance of __WmiMappedDriverNamespace { Name = "SQL"; server = "."; UserID = "sa"; Password = ""; database = "WMI"; CLSID = "{89B9BAF8-6A06-11d3-A5FE-00105A0A3102}"; }; #pragma namespace ("\\\\.\\root\\SQL") instance of __SqlMappedNamespace { Name = "EEL"; }; #pragma namespace ("\\\\.\\root\\SQL\\EEL") instance of __CustRepDrvrMapping { sClassName = "Microsoft_EELEntry"; sTableName = "EELEvent"; sDatabaseName = "EEL"; sPrimaryKeyCol = "RecordId"; arrProperties = { instance of __CustRepDrvrMappingProperty { sPropertyName = "RecordNumber"; arrColumnNames = {"RecordId"}; bReadOnly = true; // auto-generated key. bStoreAsNumber = true; bIsKey = true; }, instance of __CustRepDrvrMappingProperty { sPropertyName = "EventID"; arrColumnNames = {"EventID"}; }, instance of __CustRepDrvrMappingProperty { sPropertyName = "SourceSubsystemType"; arrColumnNames = {"SourceSubsystemType"}; }, instance of __CustRepDrvrMappingProperty { sPropertyName = "SourceSubsystemName"; arrColumnNames = {"SourceSubsystemName"}; }, instance of __CustRepDrvrMappingProperty { sPropertyName = "SystemAbout"; arrColumnNames = {"SystemAbout"}; }, instance of __CustRepDrvrMappingProperty { sPropertyName = "SystemFrom"; arrColumnNames = {"SystemFrom"}; }, instance of __CustRepDrvrMappingProperty { sPropertyName = "DeliveredBy"; arrColumnNames = {"DeliveredBy"}; }, instance of __CustRepDrvrMappingProperty { sPropertyName = "Category"; arrColumnNames = {"Category"}; }, instance of __CustRepDrvrMappingProperty { sPropertyName = "Subcategory"; arrColumnNames = {"Subcategory"}; }, instance of __CustRepDrvrMappingProperty { sPropertyName = "Severity"; arrColumnNames = {"Severity"}; }, instance of __CustRepDrvrMappingProperty { sPropertyName = "Priority"; arrColumnNames = {"Priority"}; }, instance of __CustRepDrvrMappingProperty { sPropertyName = "TimeGenerated"; arrColumnNames = {"TimeGenerated"}; }, instance of __CustRepDrvrMappingProperty { sPropertyName = "LoggingTime"; arrColumnNames = {"LoggingTime"}; }, instance of __CustRepDrvrMappingProperty { sPropertyName = "RollupTime"; arrColumnNames = {"RollupTime"}; }, instance of __CustRepDrvrMappingProperty { sPropertyName = "Message"; arrColumnNames = {"Message"}; }, instance of __CustRepDrvrMappingProperty { sPropertyName = "User"; arrColumnNames = {"EELUser"}; }, instance of __CustRepDrvrMappingProperty { sPropertyName = "Type"; arrColumnNames = {"Type"}; }, instance of __CustRepDrvrMappingProperty { sPropertyName = "Classification"; arrColumnNames = {"Classification"}; }, instance of __CustRepDrvrMappingProperty { sPropertyName = "LogType"; arrColumnNames = {"LogType"}; }, instance of __CustRepDrvrMappingProperty { sPropertyName = "OriginalEvent"; arrColumnNames = {"InstancePart"}; arrForeignKeys = {"InstanceId"}; sTableName = "EELEmbeddedInstanceParts"; sClassTableName = "EELEmbeddedClassParts"; sClassNameColumn = "ClassName"; sClassForeignKey = "ClassId"; sClassDataColumn = "ClassPart"; bDecompose = true; bStoreAsBlob = true; } }; }; class Microsoft_EELEntry { [Description ("The EventID property is the GUID. It identifies " "the event. This is specific to the source that generated " "the event log entry, and is used, together with SourceSubsystemName, " "to uniquely identify an event type.") ] string EventID; [Description ("The SourceSubsystemType property reveals the source within " "the node - Ntevent log, SMS log, etc..") ] string SourceSubsystemType; [Description (" The SourceSubsystemName specifies the name of the " "source (application, service, driver, subsystem) that generated the " "entry.") ] string SourceSubsystemName; [ DisplayName("System About"), Description("The SystemAbout property specifies the name of the " "system that generated this event.") ] string SystemAbout; [ DisplayName("System From"), Description("The SystemFrom property is the original machine that " "reported the event. This may be the same as the " "SystemAbout property, but often will be different.") ] string SystemFrom; [Description ("The DeliveredBy property specifies the name of the " "computer that deliverd this event. This may be the same as the " "ComputerName property, but may often be different.") ] string DeliveredBy; [Description ("The Category property represent the 'standard' category " "of the event as determined by system management guidelines.") ] string Category; [Description ("The Subcategory property represents additional " "categorization of the event with the Category.") ] string Subcategory; [Description ("The Severity property shows the severity level " "assigned to the event by the logging facility.") ] uint16 Severity; [Description ("The Priority property contains the priority level " "assigned to the event by the logging facility.") ] uint16 Priority; [Description ("The TimeGenerated property specifies the time at which " "the source generated the event. This is the actual event time on the " "local machine.") ] datetime TimeGenerated; [Description ("The LoggingTime property holds the time when the " "event was recorded on the system. As events are rolledup to higher " "tiers, this time will change and be overwritten. I will always hold " "the time which coresponds to the current tier it was logged on.") ] datetime LoggingTime; [Description ("The RollupTime property holds the time when the event " "was rolled up, or last forwarded from one level to the next. This " "time will change as event are forwarded, but it will always hold the " "time the event was last sent.") ] datetime RollupTime; [Description ("The Message property has additional text attached to " "the log entry (optional). Provides additional details of the event " "occurrence.") ] string Message; [Description ("The OriginalEvent property is an embedded copy of the " "event instance received by the local logging consumer.") ] __Event OriginalEvent; [Key: ToInstance, keyhole: ToInstance, Description ("The RecordNumber identifies the event within the " "Eventlog logfile. This is specific to the logfile and is used " "together with the logfile name to uniquely identify an instance " "of this class.") ] string RecordNumber; [Description ("The User property indentifies the name of the logged on " "user when the event ocurred. If the user name cannot be determined this " "will be NULL.") ] string User; [ DisplayName("Type Event"), Description ("The Type property specifies the type of event."), ValueMap {"0","1", "2", "3","4","5", "6"}, Values {"red alert", "error", "warning", "information", "security audit success","security audit failure", "garbage"} ] uint8 Type; [ DisplayName("Classification"), Description("The classification property specifies the usage of the " "type of event."), ValueMap {"1", "2", "3","4","5","6","7","8"} , Values {"discovery", "inventory", "configuration", "operation/availability", "problem management", "threshold crossings", "Performance and Capacity", "Billing"} ] uint32 Classification; [ DisplayName("Log Type"), Description("The LogType property indicates which type of log file " "this EELEntry belongs to. For example, 'System'."), ValueMap {"1", "2", "3"}, Values {"System", "Application", "Security"} ] uint32 LogType; };