CmdID / PowerShell / Cmdlets / Register
Register-CimIndicationEvent
Subscribes to indications using a filter expression or a query expression. PowerShell reference
From the PowerShell reference
13 parameters
Alias rcie
What it does
Subscribes to indications using a filter expression or a query expression. The Register-CimIndicationEvent cmdlet subscribes to indications using an indication class name or a query expression. Use the SourceIdentifier parameter give a name to the subscription. This cmdlet returns an EventSubscription object. You can use this object to cancel the subscription.
Register-CimIndicationEvent [-Namespace <String>] [-ClassName] <String> [-OperationTimeoutSec <UInt32>] [-ComputerName <String>] [[-SourceIdentifier] <String>] [[-Action] <ScriptBlock>] [-MessageData <PSObject>] [-SupportEvent] [-Forward] [-MaxTriggerCount <Int32>] [<CommonParameters>]Register-CimIndicationEvent [-Namespace <String>] [-ClassName] <String> [-OperationTimeoutSec <UInt32>] -CimSession <CimSession> [[-SourceIdentifier] <String>] [[-Action] <ScriptBlock>] [-MessageData <PSObject>] [-SupportEvent] [-Forward] [-MaxTriggerCount <Int32>] [<CommonParameters>]Register-CimIndicationEvent [-Namespace <String>] [-Query] <String> [-QueryDialect <String>] [-OperationTimeoutSec <UInt32>] -CimSession <CimSession> [[-SourceIdentifier] <String>] [[-Action] <ScriptBlock>] [-MessageData <PSObject>] [-SupportEvent] [-Forward] [-MaxTriggerCount <Int32>] [<CommonParameters>]Register-CimIndicationEvent [-Namespace <String>] [-Query] <String> [-QueryDialect <String>] [-OperationTimeoutSec <UInt32>] [-ComputerName <String>] [[-SourceIdentifier] <String>] [[-Action] <ScriptBlock>] [-MessageData <PSObject>] [-SupportEvent] [-Forward] [-MaxTriggerCount <Int32>] [<CommonParameters>]Register the events generated by a class
$event = @{
ClassName = 'Win32_ProcessStartTrace'
SourceIdentifier = 'ProcessStarted'
}
Register-CimIndicationEvent @event
Get-Event -SourceIdentifier "ProcessStarted"IdentifyRegister the events using a query
$query = "SELECT * FROM CIM_InstModification WHERE TargetInstance ISA 'Win32_LocalTime'"
Register-CimIndicationEvent -Query $query -SourceIdentifier "Timer"IdentifyRun a script when the event arrives
$action = {
$name = $Event.SourceEventArgs.NewEvent.ProcessName
$id = $Event.SourceEventArgs.NewEvent.ProcessId
Write-Host -Object "New Process Started : Name = $name ID = $id"
}
$event = @{
ClassName = 'Win32_ProcessStartTrace'
SourceIdentifier = 'ProcessStarted'
Action = $action
}
Register-CimIndicationEvent @eventIdentifyRegister the events on a remote computer
$event = @{
ClassName = 'Win32_ProcessStartTrace'
SourceIdentifier = 'ProcessStarted'
ComputerName = 'Server01'
}
Register-CimIndicationEvent @event
Get-Event -SourceIdentifier "ProcessStarted"IdentifyIts page in the reference: Register-CimIndicationEvent.
Parameters
-ActionSpecifies the commands that handle the events. The commands specified by this parameter run when an event is raised, instead of sending the event to the event queue. Enclose the commands in braces ({}) to create a scriptblock.
The scriptblock specified with Action can include the $Event, $EventSubscriber, $Sender,
$SourceEventArgs, and $SourceArgs automatic variables, which provide information about the event
to the Action scriptblock. For more information, see
About Automatic Variables.-CimSessionRuns the command using the specified CIM session. Enter a variable that contains the CIM session, or a command that creates or gets the CIM session, such as the New-CimSession or Get-CimSession cmdlets. For more information, see about_CimSession.-ClassNameSpecifies the indication class to which you are subscribing. You can use tab completion to browse the list of classes, because PowerShell gets a list of classes from the local WMI server to provide a list of class names.-ComputerNameSpecifies the name of the computer on which you want to run the CIM operation. You can specify a fully qualified domain name (FQDN), a NetBIOS name, or an IP address.
If you specify this parameter, the cmdlet creates a temporary session to the specified computer using the WsMan protocol. If you do not specify this parameter, the cmdlet performs operation on the local system using Component Object Model (COM).
If multiple operations are being performed on the same computer, connect using a CIM session for better performance.-ForwardIndicates that events for the subscription are forwarded to the session on the local computer. Use this parameter when you are registering for events on a remote computer or in a remote session.-MaxTriggerCountParameter to indicate that the subscriber should be auto-unregistered after being triggered for specified times. If the value is equal or less than zero, there is no limit on the number of times the event can be triggered without being unregistered.-MessageDataSpecifies any additional data to associate with this event subscription. The value of this parameter appears in the MessageData property of all the events associated with this subscription.-NamespaceSpecifies the namespace for the CIM operation. The default namespace is root/CIMV2. You can use tab completion to browse the list of namespaces, because PowerShell gets a list of namespaces from the local WMI server to provide the list of namespaces.-OperationTimeoutSecSpecifies the amount of time that the cmdlet waits for a response from the computer. By default, the value of this parameter is 0, which means that the cmdlet uses the default timeout value for the server.
If the OperationTimeoutSec parameter is set to a value less than the robust connection retry timeout of 3 minutes, network failures that last more than the value of the OperationTimeoutSec parameter are not recoverable, because the operation on the server times out before the client can reconnect.-QuerySpecifies a query to run on the CIM server. If the value specified contains double quotes ", single quotes ', or a backslash \, you must escape those characters by prefixing them with the backslash character. If the value specified uses the WQL LIKE operator, then you must escape the following characters by enclosing them in square brackets []: percent %, underscore _, or opening square bracket [.-QueryDialectSpecifies the query language used for the Query parameter. The acceptable values for this parameter are: WQL or CQL. The default value is WQL.-SourceIdentifierSpecifies a name for the subscription. The name that you specify must be unique in the current session. The default value is a GUID that PowerShell assigns. This value appears in the value of the SourceIdentifier property of the subscriber object and of all event objects associated with this subscription.-SupportEventIndicates that the event subscription is hidden. Use this parameter when the current subscription is part of a more complex event registration mechanism and it should not be discovered independently.