273 lines
9.4 KiB
Plaintext
273 lines
9.4 KiB
Plaintext
|
|
#pragma namespace ("\\\\.\\root")
|
|
|
|
instance of __WmiMappedDriverNamespace
|
|
{
|
|
Name = "SQL";
|
|
server = ".";
|
|
UserID = "sa";
|
|
Password = "";
|
|
database = "WMI";
|
|
CLSID = "{89B9BAF8-6A06-11d3-A5FE-00105A0A3102}";
|
|
};
|
|
|
|
#pragma namespace ("\\\\.\\root\\SQL")
|
|
|
|
instance of __SqlMappedNamespace
|
|
{
|
|
Name = "EEL";
|
|
};
|
|
|
|
#pragma namespace ("\\\\.\\root\\SQL\\EEL")
|
|
|
|
|
|
instance of __CustRepDrvrMapping
|
|
{
|
|
sClassName = "Microsoft_EELEntry";
|
|
sTableName = "EELEvent";
|
|
sDatabaseName = "EEL";
|
|
sPrimaryKeyCol = "RecordId";
|
|
arrProperties =
|
|
{
|
|
instance of __CustRepDrvrMappingProperty
|
|
{
|
|
sPropertyName = "RecordNumber";
|
|
arrColumnNames = {"RecordId"};
|
|
bReadOnly = true; // auto-generated key.
|
|
bStoreAsNumber = true;
|
|
bIsKey = true;
|
|
},
|
|
|
|
instance of __CustRepDrvrMappingProperty
|
|
{
|
|
sPropertyName = "EventID";
|
|
arrColumnNames = {"EventID"};
|
|
},
|
|
|
|
instance of __CustRepDrvrMappingProperty
|
|
{
|
|
sPropertyName = "SourceSubsystemType";
|
|
arrColumnNames = {"SourceSubsystemType"};
|
|
},
|
|
instance of __CustRepDrvrMappingProperty
|
|
{
|
|
sPropertyName = "SourceSubsystemName";
|
|
arrColumnNames = {"SourceSubsystemName"};
|
|
},
|
|
instance of __CustRepDrvrMappingProperty
|
|
{
|
|
sPropertyName = "SystemAbout";
|
|
arrColumnNames = {"SystemAbout"};
|
|
},
|
|
instance of __CustRepDrvrMappingProperty
|
|
{
|
|
sPropertyName = "SystemFrom";
|
|
arrColumnNames = {"SystemFrom"};
|
|
},
|
|
instance of __CustRepDrvrMappingProperty
|
|
{
|
|
sPropertyName = "DeliveredBy";
|
|
arrColumnNames = {"DeliveredBy"};
|
|
},
|
|
instance of __CustRepDrvrMappingProperty
|
|
{
|
|
sPropertyName = "Category";
|
|
arrColumnNames = {"Category"};
|
|
},
|
|
instance of __CustRepDrvrMappingProperty
|
|
{
|
|
sPropertyName = "Subcategory";
|
|
arrColumnNames = {"Subcategory"};
|
|
},
|
|
instance of __CustRepDrvrMappingProperty
|
|
{
|
|
sPropertyName = "Severity";
|
|
arrColumnNames = {"Severity"};
|
|
},
|
|
instance of __CustRepDrvrMappingProperty
|
|
{
|
|
sPropertyName = "Priority";
|
|
arrColumnNames = {"Priority"};
|
|
},
|
|
instance of __CustRepDrvrMappingProperty
|
|
{
|
|
sPropertyName = "TimeGenerated";
|
|
arrColumnNames = {"TimeGenerated"};
|
|
},
|
|
instance of __CustRepDrvrMappingProperty
|
|
{
|
|
sPropertyName = "LoggingTime";
|
|
arrColumnNames = {"LoggingTime"};
|
|
},
|
|
instance of __CustRepDrvrMappingProperty
|
|
{
|
|
sPropertyName = "RollupTime";
|
|
arrColumnNames = {"RollupTime"};
|
|
},
|
|
instance of __CustRepDrvrMappingProperty
|
|
{
|
|
sPropertyName = "Message";
|
|
arrColumnNames = {"Message"};
|
|
},
|
|
instance of __CustRepDrvrMappingProperty
|
|
{
|
|
sPropertyName = "User";
|
|
arrColumnNames = {"EELUser"};
|
|
},
|
|
instance of __CustRepDrvrMappingProperty
|
|
{
|
|
sPropertyName = "Type";
|
|
arrColumnNames = {"Type"};
|
|
},
|
|
instance of __CustRepDrvrMappingProperty
|
|
{
|
|
sPropertyName = "Classification";
|
|
arrColumnNames = {"Classification"};
|
|
},
|
|
instance of __CustRepDrvrMappingProperty
|
|
{
|
|
sPropertyName = "LogType";
|
|
arrColumnNames = {"LogType"};
|
|
},
|
|
|
|
instance of __CustRepDrvrMappingProperty
|
|
{
|
|
sPropertyName = "OriginalEvent";
|
|
arrColumnNames = {"InstancePart"};
|
|
arrForeignKeys = {"InstanceId"};
|
|
sTableName = "EELEmbeddedInstanceParts";
|
|
sClassTableName = "EELEmbeddedClassParts";
|
|
sClassNameColumn = "ClassName";
|
|
sClassForeignKey = "ClassId";
|
|
sClassDataColumn = "ClassPart";
|
|
bDecompose = true;
|
|
bStoreAsBlob = true;
|
|
}
|
|
};
|
|
|
|
};
|
|
|
|
|
|
class Microsoft_EELEntry
|
|
{
|
|
[Description ("The EventID property is the GUID. It identifies "
|
|
"the event. This is specific to the source that generated "
|
|
"the event log entry, and is used, together with SourceSubsystemName, "
|
|
"to uniquely identify an event type.")
|
|
]
|
|
string EventID;
|
|
[Description ("The SourceSubsystemType property reveals the source within "
|
|
"the node - Ntevent log, SMS log, etc..")
|
|
]
|
|
string SourceSubsystemType;
|
|
[Description (" The SourceSubsystemName specifies the name of the "
|
|
"source (application, service, driver, subsystem) that generated the "
|
|
"entry.")
|
|
]
|
|
string SourceSubsystemName;
|
|
[
|
|
DisplayName("System About"),
|
|
Description("The SystemAbout property specifies the name of the "
|
|
"system that generated this event.")
|
|
]
|
|
string SystemAbout;
|
|
|
|
[
|
|
DisplayName("System From"),
|
|
Description("The SystemFrom property is the original machine that "
|
|
"reported the event. This may be the same as the "
|
|
"SystemAbout property, but often will be different.")
|
|
]
|
|
string SystemFrom;
|
|
|
|
[Description ("The DeliveredBy property specifies the name of the "
|
|
"computer that deliverd this event. This may be the same as the "
|
|
"ComputerName property, but may often be different.")
|
|
]
|
|
string DeliveredBy;
|
|
[Description ("The Category property represent the 'standard' category "
|
|
"of the event as determined by system management guidelines.")
|
|
]
|
|
string Category;
|
|
[Description ("The Subcategory property represents additional "
|
|
"categorization of the event with the Category.")
|
|
]
|
|
string Subcategory;
|
|
[Description ("The Severity property shows the severity level "
|
|
"assigned to the event by the logging facility.")
|
|
]
|
|
uint16 Severity;
|
|
[Description ("The Priority property contains the priority level "
|
|
"assigned to the event by the logging facility.")
|
|
]
|
|
uint16 Priority;
|
|
[Description ("The TimeGenerated property specifies the time at which "
|
|
"the source generated the event. This is the actual event time on the "
|
|
"local machine.")
|
|
]
|
|
datetime TimeGenerated;
|
|
[Description ("The LoggingTime property holds the time when the "
|
|
"event was recorded on the system. As events are rolledup to higher "
|
|
"tiers, this time will change and be overwritten. I will always hold "
|
|
"the time which coresponds to the current tier it was logged on.")
|
|
]
|
|
datetime LoggingTime;
|
|
[Description ("The RollupTime property holds the time when the event "
|
|
"was rolled up, or last forwarded from one level to the next. This "
|
|
"time will change as event are forwarded, but it will always hold the "
|
|
"time the event was last sent.")
|
|
]
|
|
datetime RollupTime;
|
|
[Description ("The Message property has additional text attached to "
|
|
"the log entry (optional). Provides additional details of the event "
|
|
"occurrence.")
|
|
]
|
|
string Message;
|
|
[Description ("The OriginalEvent property is an embedded copy of the "
|
|
"event instance received by the local logging consumer.")
|
|
]
|
|
__Event OriginalEvent;
|
|
|
|
[Key: ToInstance, keyhole: ToInstance, Description ("The RecordNumber identifies the event within the "
|
|
"Eventlog logfile. This is specific to the logfile and is used "
|
|
"together with the logfile name to uniquely identify an instance "
|
|
"of this class.")
|
|
]
|
|
string RecordNumber;
|
|
|
|
[Description ("The User property indentifies the name of the logged on "
|
|
"user when the event ocurred. If the user name cannot be determined this "
|
|
"will be NULL.")
|
|
]
|
|
string User;
|
|
|
|
[
|
|
DisplayName("Type Event"),
|
|
Description ("The Type property specifies the type of event."),
|
|
ValueMap {"0","1", "2", "3","4","5", "6"},
|
|
Values {"red alert", "error", "warning", "information",
|
|
"security audit success","security audit failure", "garbage"}
|
|
]
|
|
uint8 Type;
|
|
|
|
[
|
|
DisplayName("Classification"),
|
|
Description("The classification property specifies the usage of the "
|
|
"type of event."),
|
|
ValueMap {"1", "2", "3","4","5","6","7","8"} ,
|
|
Values {"discovery", "inventory", "configuration",
|
|
"operation/availability", "problem management",
|
|
"threshold crossings", "Performance and Capacity", "Billing"}
|
|
]
|
|
uint32 Classification;
|
|
|
|
[
|
|
DisplayName("Log Type"),
|
|
Description("The LogType property indicates which type of log file "
|
|
"this EELEntry belongs to. For example, 'System'."),
|
|
ValueMap {"1", "2", "3"},
|
|
Values {"System", "Application", "Security"}
|
|
]
|
|
uint32 LogType;
|
|
};
|