Register-CimIndicationEvent (PowerShell 3.0+ )

Subscribe to indications using a filter expression or a query expression. Equivalent to the old WMI cmdlet Register-WmiEvent , the CIM version uses WSMAN (WinRM) to connect to remote machines and is therefore an order of magnitude faster.

      Register-CimIndicationEvent [-ClassName] String
         [[-SourceIdentifier] String] [[-Action] ScriptBlock] 
            [-ComputerName String] [-Forward] [-MessageData PSObject] 
               [-Namespace String] [-OperationTimeoutSec UInt32]  [-SupportEvent] [CommonParameters]

      Register-CimIndicationEvent [-ClassName] String
         [[-SourceIdentifier] String] [[-Action] ScriptBlock] 
            -CimSession CimSession [-Forward] [-MessageData PSObject] 
               [-Namespace String] [-OperationTimeoutSec UInt32]  [-SupportEvent] [CommonParameters]

      Register-CimIndicationEvent [-Query] String [-QueryDialect String]
         [[-SourceIdentifier] String] [[-Action] ScriptBlock] 
            [-ComputerName String] [-Forward] [-MessageData PSObject]
               [-Namespace String] [-OperationTimeoutSec UInt32]  [-SupportEvent] [CommonParameters]
      Register-CimIndicationEvent [-Query] String [-QueryDialect String]
         [[-SourceIdentifier] String] [[-Action] ScriptBlock]
            -CimSession CimSession [-Forward]  [-MessageData PSObject] 
               [-Namespace String] [-OperationTimeoutSec UInt32]  [-SupportEvent] [CommonParameters]

   -Action ScriptBlock
       Specify the commands that handle the events.

       The commands specified by this parameter run when an event is raised, instead of sending the event to the 
       event queue. Enclose the commands in braces ( { } ) to create a script block.

       The script block specified with Action can include the $Event, $EventSubscriber, $Sender, $SourceEventArgs, 
       and $SourceArgs automatic variables, which provide information about the event to the Action script block.

   -CimSession CimSession
       Run the command using the specified CIM session. Enter a variable that contains the CIM session, or a command 
       that creates or gets the CIM session, such as the New-CimSession or Get-CimSession cmdlets. For more 
       information, see about_CimSessions.

   -ClassName String
       The indication class to which you are subscribing. 
       You can use tab completion to browse the list of classes, because wps_2 gets a list of classes from the 
       local WMI server to provide a list of class names.

   -ComputerName String
       The name of the computer on which you want to run the CIM operation.
       Specify a fully qualified domain name (FQDN), a NetBIOS name, or an IP address.

       If you specify this parameter, the cmdlet creates a temporary session to the specified computer using WsMan.

       If you do not specify this parameter, the cmdlet performs operation on the local system using (COM).

       If multiple operations are being performed on the same computer, connecting using a CIM session gives better 

       Indicates that events for the subscription are forwarded to the session on the local computer.

       Use this parameter when you are registering for events on a remote computer or in a remote session.

   -MessageData PSObject
       Specify any additional data to be associated with this event subscription.

       The value of this parameter appears in the MessageData property of all the events associated with this subscription.

   -Namespace String
       Specify the namespace for the CIM operation.
       The default namespace is root/cimv2. 
       You can use tab completion to browse the list of namespaces, because wps_2 gets a list of namespaces 
       from the local WMI server to provide the list of namespaces.

   -OperationTimeoutSec UInt32
       Specify the amount of time that the cmdlet waits for a response from the computer.

       By default, the value of this parameter is 0, which means that the cmdlet uses the default timeout value for the server.

       If the -OperationTimeoutSec parameter is set to a value less than the robust connection retry timeout of 3 
       minutes, network failures that last more than the value of the OperationTimeoutSec parameter are not 
       recoverable, because the operation on the server times out before the client can reconnect.

   -Query String
       Specify a query to run on the CIM server.

       You can specify the query dialect using the QueryDialect parameter.

       If the value specified contains double quotes (“), single quotes (‘), or a backslash (\), you must escape 
       those characters by prefixing them with the backslash (\) character. If the value specified uses the WQL LIKE 
       operator, then you must escape the following characters by enclosing them in square brackets ([]): percent 
       (%), underscore (_), or opening square bracket ([).

   -QueryDialect String
       Specify the query language used for the Query parameter. psdx_paramvaluesWQL or CQL.

       The default value is WQL.

   -SourceIdentifier String
       Specifies a name for the subscription. The name that you specify must be unique in the current session.

       The default value is a GUID that wps_1 assigns.

       The value of this parameter appears in the value of the SourceIdentifier property of the subscriber object and 
       of all event objects associated with this subscription.

       Indicates that the event subscription is hidden.

       Use this parameter when the current subscription is part of a more complex event registration mechanism and it 
       should not be discovered independently.

Standard Alias for Register-CimIndicationEvent: none


Use a query to subscribe to an event generated whenever there is a change in the instance of a class named Win32_LocalTime:

PS C:\> $query = "SELECT * FROM CIM_InstModification WHERE TargetInstance ISA 'Win32_LocalTime'"
PS C:\> Register-CimIndicationEvent -Query $query -SourceIdentifier "Timer"

Use an action in response to an event, $action holds a script block for Action, using $action, Register-CimIndicationEvent is then used to subscribe to the event generated by the class named Win32_ProcessStartTrace:

PS C:\> $event = Get-Event

PS C:\> $action = {$name = $event.SourceEventArgs.NewEvent.ProcessName; $id = $event.SourceEventArgs.NewEvent.ProcessId; Write-Host –Object "New Process Started : Name = $name; ID = $id"}

PS C:\> Register-CimIndicationEvent -ClassName 'Win32_ProcessStartTrace' -SourceIdentifier "ProcessStarted" -Action $action

Register the events on a remote computer, events received from the CIM server are stored in the event queue in the current wps_2 session and then runs a local Get-Event to retrieve the events:
PS C:\> Register-CimIndicationEvent -ClassName 'Win32_ProcessStartTrace' -SourceIdentifier "ProcessStarted" -ComputerName Server64

PS C:\> Get-Event -SourceIdentifier "ProcessStarted"

“There are no other Everglades in the world.
 They are, they have always been, one of the unique regions of the earth; remote, never wholly known.
 Nothing anywhere else is like them” ~ Marjory Stoneman Douglas

Related PowerShell Cmdlets

Get-Event - Get events in the PowerShell event queue.
Remove-Event - Delete events from the event queue.
Unregister-Event - Cancel an event subscription.
Get-CimInstance - Get a managed resource (storage, network, software etc).

Copyright © 1999-2023
Some rights reserved