What happens when we don’t specify a “within” interval in a WQL notification query with an intrinsic event class name?
SELECT * FROM __InstanceCreationEvent
WHERE TargetInstance ISA ‘Win32_NTLogEvent’ AND
TargetInstance.LogFile = ‘System’ AND
TargetInstance.EventCode = ‘1007’
The WITHIN interval is only required if there isn’t a real WMI Event Provider that supports that event class. In the case of the NTEventLog WMI Provider, it’s a real event provider, meaning that the events are not polled, they are pushed. So events come in as they happen.
For a general overview of WMI eventing you could visit this page.
Kapil Mathur [MSFT]