How to Trap WMI Events Raised by Enterprise Library

Topics: Logging Application Block
May 24, 2011 at 6:14 PM
Edited May 24, 2011 at 6:19 PM

I have a logging application block implementation that raises WMI Events. My question is what do these events show up as on the WMI side? Do they show up as instances of __ExtrinsicEvent or a subclass thereof? Do I have to explicitly define a specific subclass with WMI's Event CIM to trap events fired by Entlib?

May 25, 2011 at 9:10 AM


I haven't personally tried WMI with Logging yet but I believe there is a huge change with it since Enterprise Library 5.0. Quoting from the Entlib 5.0 changelog:

"WMI support has been removed from Enterprise Library except for the WMI Trace Listener in the Logging block. Enterprise Library no longer exposes its configuration through WMI, and the application blocks no longer raise WMI events. Only the WMI Trace Listener in the Logging block still raises WMI events."


Noel Angelo Bolasoc
Global Technologies and Solutions
Avanade, Inc.



May 25, 2011 at 6:06 PM

Noel - thank you for the guidance. Not to belabor the point, but Entlib 5.0 does allow me to configure Logging Application Block to send to WMI through Fluent API (see code below) and when I step through code, even for non-trace events, I do see a WMI event getting fired from inside code (In Microsoft.Practices.EnterpriseLibrary.Logging.TraceListeners.WmiTraceListener.Write(), there is a call to  ManagementInstrumentation.Fire(logEntry)). 

Here is the Fluent API LAB setup:

            var builder = new ConfigurationSourceBuilder();
                    .SendTo.Wmi("WMI Trace Listener");

Here is the Code from Microsoft.Practices.EnterpriseLibrary.Logging.TraceListeners.WmiTraceListener.Write()
        public override void Write(string message)
            LogEntry logEntry = new LogEntry();
            logEntry.Message = message;
Evidently, dropping support for non-trace WMI events didn't lead to shutdown of code paths; it would get done in some future release?
For trace events, would you know what it would show up on the WMI side as? How do I trap a WMI trace event that originated in Entlib, on the WMI side? Would you have a WQL query for it?

May 26, 2011 at 9:43 AM
Edited May 26, 2011 at 9:49 AM


I wouldn't think there may be future releases specific to WMI anymore. You can refer to this thread What replaces WMI in 5.0 and later? for the Microsoft Entlib team thoughts regarding this.

As for the WQL Query, unfortunately we haven't have any sample for this, though this article may help -

Gino Terrado
Global Technologies and Solutions
Avanade, Inc.