Event Log Association Classes

[This is preliminary documentation and subject to change.]

There are three association classes that a client of the Event Log Provider typically uses. All three classes link an instance of the Win32_NTLogEvent class with an instance of another class.

The Win32_NTLogEventLog association class links instances of the Win32_NTLogEvent and Win32_NTEventlogFile classes. It is defined as follows:

class Win32_NTLogEventLog
{
    [key, read]  Win32_NTEventlogFile ref Log;
    [key, read]  Win32_NTLogEvent     ref Record;
}

The Win32_NTLogEventUser association class links instances of the Win32_NTLogEvent and Win32_UserAccount, a class defined in the Win32 schema. Win32_NTLogEventUser is defined as follows:

class Win32_NTLogEventUser
{
    [key, read]  Win32_NTUserAccount  ref User;
    [key, read]  Win32_NTLogEvent     ref Record;
}

The Win32_NTLogEventComputer association class links instances of the Win32_NTLogEvent and Win32_ComputerSystem, another class defined in the Win32 schema. Win32_NTLogEventComputer is defined as follows:

class Win32_NTLogEventComputer
{
    [key, read]  Win32_ComputerSystem  ref Computer;
    [key, read]  Win32_NTLogEvent      ref Record;
}