Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
Is there a WMI event you can subscribe to that will fire when a remote machine boots up and comes online, or goes offline?
My application needs to be able to monitor machines for their availability, and ideally, I’d like something that can work via events instead of continuous polling.
Subscribing to a shutdown event is theoretically possible. You could subscribe to get updates to the ‘System’ Event Log. You’d be looking for an event from Source = ‘EventLog’ and EventID = 6006. This event contains the message:
This is usually the last message written on shutdown. But wait! It may be problematical to receive this via WMI. Why? It may be that the WMI service itself shuts down prior to EventLog so it might be a Catch 22. You could potentially look for another message that occurs earlier during shutdown on the servers you are monitoring, and watch for that.
A boot up event carries with it an even more troublesome set of Catch 22s. Think about how WMI eventing works for a moment. To get events, you have to open a connection to the remote WMI server via DCOM, and issue a WQL query to indicate what events you want. In order to receive a boot up event, you’d have to ‘magically’ know to open said connection and issue said query prior to the event being fired.
Years ago I wrote a service that collected Event Log entries from remote servers for a network monitoring application. Just the logic to detect when the DCOM connection to the remote had been lost and needed to be rebuilt was a major pain in the neck. As it happened this was a component in a larger system that pinged the remote hosts anyway, so we ended up relying on that information to know when to rebuild our DCOM connections.