Which method made the call to IWbemObjectSink::Indicate method - c++

Question

I am developing an application in C++ using VS2010. In my code,I have two WQL queries as follows:
hres = pSvc->ExecNotificationQueryAsync(
_bstr_t("WQL"),
_bstr_t("SELECT * "
"FROM __InstanceDeletionEvent WITHIN 1 "
"WHERE TargetInstance ISA 'Win32_Process' "),
WBEM_FLAG_SEND_STATUS,
NULL,
pStubSink);
hres1 = pSvc->ExecNotificationQueryAsync(
_bstr_t("WQL"),
_bstr_t("SELECT * "
"FROM __InstanceCreationEvent WITHIN 1 "
"WHERE TargetInstance ISA 'Win32_Process'"),
WBEM_FLAG_SEND_STATUS,
NULL,
pStubSink);
On cretion or deletion of processes I get its name printed into the console from the IWbemObjectSink::Indicate method. When the name of the process is printed, I need to know whether it was created or deleted. How will I know this? Is there some way to know which asynchronous method made the call to Indicate method?
Thankyou

Answer 1

__InstanceDeletionEvent and __InstanceCreationEvent are subclasses of __InstanceOperationEvent. Hence, you should be querying for instances of __InstanceOperationEvent. Then you will Get the Class from the object in your Sink Class (e.g., pStubSink) to know from which instance is being created. Look at this example to get an idea about how to handle a similar situation: http://blogs.technet.com/b/heyscriptingguy/archive/2005/04/04/how-can-i-monitor-for-different-types-of-events-with-just-one-script.aspx
UPDATE1:
__InstanceOperationEvent is superclass of: __InstanceDeletionEvent, __InstanceCreationEvent and __InstanceModificationEvent.
pSvc->ExecNotificationQueryAsync(
_bstr_t("WQL"),
_bstr_t("SELECT * FROM __InstanceOperationEvent WITHIN 1 WHERE Targetinstance ISA 'Win32_Process'"),
WBEM_FLAG_SEND_STATUS,
NULL,
pStubSink);
In your Indicate function:
Indicate(long lObjectCount,
IWbemClassObject **apObjArray)
{
HRESULT hr = S_OK;
for (int i = 0; i < lObjectCount; i++)
{
_variant_t myVariant;
hr = apObjArray[i]->Get(_bstr_t(L"__Class"), 0, &myVariant, 0, 0);
if (SUCCEEDED(hr))
{
std::wstring classOrigin(myVariant.bstrVal);
if (0 == classOrigin.compare(L"__InstanceDeletionEvent") )
{
std::wcout << L"DELETION" << std::endl;
}
else if (0 == classOrigin.compare(L"__InstanceCreationEvent"))
{
std::wcout << L"CREATION" << std::endl;
}
}
}
}
myVariant will say which is the class that generated the event (read note).
NOTE: This will result in a constant call to your pStubSink because Processes are constantly being modificated (__InstanceModificationEvent, e.g., changes in memory/CPU).
UPDATE2: You could also have two different Queries (and consecuently Sink objects), one for creation and one for deletion (e.g., pStubSinkCreation, pStubSinkDeletion). In this way you (1) would know exactly when it comes from Creation and when from Deletion; and (2) would avoid to be receiving constantly the __InstanceModificationEvent.