Process_V1_TypeGroup1 class

This class is the event type class for process events.

The following syntax is simplified from MOF code.

Syntax

[EventType{1, 2, 3, 4}, EventTypeName{"Start", "End", "DCStart", "DCEnd"}]
class Process_V1_TypeGroup1 : Process_V1
{
  uint32 PageDirectoryBase;
  uint32 ProcessId;
  uint32 ParentId;
  uint32 SessionId;
  sint32 ExitStatus;
  object UserSID;
  string ImageFileName;
};

Members

The Process_V1_TypeGroup1 class has these types of members:

• Properties

Properties

The Process_V1_TypeGroup1 class has these properties.

ExitStatus

Data type: sint32

Access type: Read-only

Qualifiers: WmiDataId(5)

Exit status of the stopped process.

ImageFileName

Data type: string

Access type: Read-only

Qualifiers: WmiDataId(7), StringTermination("NullTerminated")

Path to the executable file of the process.

PageDirectoryBase

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(1), Pointer

Reserved.

ParentId

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(3)

Unique identifier of the process that creates this process. Process identifier numbers are reused, so they only identify a process for the lifetime of that process. It is possible that the process identified by ParentProcessId is terminated, so ParentProcessId may not refer to a running process. It is also possible that ParentProcessId incorrectly refers to a process that reuses a process identifier.

Windows Server 2003: Includes the Format("x") qualifier.

ProcessId

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(2)

Global process identifier that you can use to identify a process. The value is valid from the time a process is created until it is terminated.

Windows Server 2003: Includes the Format("x") qualifier.

SessionId

Data type: uint32

Access type: Read-only

Qualifiers: WmiDataId(4)

Unique identifier that an operating system generates when it creates a new session. A session spans a period of time from log on until log off from a specific system.

UserSID

Data type: object

Access type: Read-only

Qualifiers: WmiDataId(6), Extension("Sid")

Security identifier (SID) for the user context under which the event happens.

Requirements

See also

Process_V1

Process_V1