[This is preliminary documentation and subject to change.]
WBEM defines events as either intrinsic or extrinsic. Intrinsic events occur in response to changes to data in the CIM repository. For example, the creation of an instance is an intrinsic event. Both CIMOM and event providers send notifications of intrinsic events. CIMOM reports changes to data stored statically, such as instances of system classes. Event providers report changes to dynamic data, data related to the classes and instances that they create.
Extrinsic events occur in response to changes in both hardware and software system components, such as the breakage of a cable or the failure of a database. Because these events occur outside of CIMOM's scope, CIMOM has no understanding of their purpose and has no responsibility for sending notifications. Only event providers send notification of extrinsic events. However, CIMOM forwards both extrinsic and intrinsic event notifications to appropriate consumers.
WBEM defines a fixed set of intrinsic event types that are represented by system classes derived from the __Event system class. Event types correspond to the creation, modification, or deletion of a namespace, class, or instance. WBEM also defines a special timer event that can be generated either periodically or at a specific day and time. Because intrinsic events map to system classes, they can not be modified or extended. The following table briefly describes the intrinsic event classes:
| Event system class | Description |
|---|---|
| __ClassCreationEvent | Generated when a class is created. |
| __ClassModificationEvent | Generated when a class is modified. |
| __ClassDeletionEvent | Generated when a class is deleted. |
| __InstanceCreationEvent | Generated when an instance is created. |
| __InstanceModificationEvent | Generated when an instance is modified. |
| __InstanceDeletionEvent | Generated when an instance is deleted. |
| __NamespaceCreationEvent | Generated when a namespace is created. |
| __NamespaceModificationEvent | Generated when an instance of a class derived from a class representing a namespace is modified. |
| __NamespaceDeletionEvent | Generated when a namespace is deleted. |
Unlike intrinsic events, there is neither a fixed set of extrinsic event types nor any limit to the number of extrinsic event types that can be created. Extrinsic events correspond to the wide range of changes that can occur in the real world. WBEM allows event providers to create whatever event types best support the components that they monitor. Extrinsic events are represented by classes that derive from the __ExtrinsicEvent system class, a subclass of the system class __Event.
For example, consider the event provider that needs to report security violations. The following class would be defined to represent the extrinsic event:
class SecurityViolation : __ExtrinsicEvent
{
string Building; // Building where violation occurred
sint32 EntranceNumber; // Entrance where violation occurred
datetime TimeOfDetection; // Time of day of violation
};
To receive the SecurityViolation notifications, a consumer registers for the SecurityViolation event type. By default, the consumer receives notifications of all violations in all buildings during each 24-hour period. However, because the class allows the consumer to specify a particular building, entrance, and time of day, it is possible for the consumer to register a detailed filter and thus receive only notifications for violations that occur, for example, in a particular building.