[This is preliminary documentation and subject to change.]
There are three association classes that a client of the Event Log Provider typically uses. All three classes link an instance of the Win32_NTLogEvent class with an instance of another class.
The Win32_NTLogEventLog association class links instances of the Win32_NTLogEvent and Win32_NTEventlogFile classes. It is defined as follows:
class Win32_NTLogEventLog
{
[key, read] Win32_NTEventlogFile ref Log;
[key, read] Win32_NTLogEvent ref Record;
}
The Win32_NTLogEventUser association class links instances of the Win32_NTLogEvent and Win32_UserAccount, a class defined in the Win32 schema. Win32_NTLogEventUser is defined as follows:
class Win32_NTLogEventUser
{
[key, read] Win32_NTUserAccount ref User;
[key, read] Win32_NTLogEvent ref Record;
}
The Win32_NTLogEventComputer association class links instances of the Win32_NTLogEvent and Win32_ComputerSystem, another class defined in the Win32 schema. Win32_NTLogEventComputer is defined as follows:
class Win32_NTLogEventComputer
{
[key, read] Win32_ComputerSystem ref Computer;
[key, read] Win32_NTLogEvent ref Record;
}