Mof File for LowDisk Space Event ID based on NT Event during hardware inventory

 

 

 

//——————————- LowDisk Space Event ID ———————————— #pragma namespace("\.rootcimv2")
[Union,
ViewSources{"Select * FROM Win32_NTLogEvent WHERE LogFile = 'System' AND EventCode = 2013"},
ViewSpaces{"\.rootcimv2"},
dynamic,provider("MS_VIEW_INSTANCE_PROVIDER")]

Class NTLogEvent
{
     [PropertySources("LogFile"), Key] string LogFile;
     [PropertySources("RecordNumber"), Key] UINT32 Recordnumber;
     [PropertySources("Message")] String Message;
     [PropertySources("TimeGenerated")] DateTime TimeGenerated;
}; //————————– Reporting Class———————————–
#pragma namespace("\.rootCIMV2SMS")

[SMS_Report(TRUE),
SMS_Group_Name("Installed Updates"),
SMS_Class_ID("MICROSOFT|Win32_NTLogEvent|1.0") ]

Class NTLogEvent: SMS_Class_Template
{
     [SMS_Report(TRUE), Key] String LogFile;
     [SMS_Report(TRUE), Key] UINT32 RecordNumber;
     [SMS_Report(True)] String Message;
     [SMS_Report(True)] DateTime TimeGenerated;
}; 
——————-
Thanks,
https://paddymaddy.blogspot.com/