Is there a WMI event you can subscribe to that will fire when a remote machine boots up and comes online, or goes offline?
My application needs to be able to monitor machines for their availability, and ideally, I'd like something that can work via events instead of continuous polling.
A perusal around Microsoft's and other sites doesn't yield any information on a "boot" event in WMI. However, this thread suggests installing something in the startup folder on the server(s) you want to monitor.
Subscribing to a shutdown event is theoretically possible. You could subscribe to get updates to the "System" Event Log. You'd be looking for an event from Source = "EventLog" and EventID = 6006. This event contains the message:
The Event log service was stopped.
This is usually the last message written on shutdown. But wait! It may be problematical to receive this via WMI. Why? It may be that the WMI service itself shuts down prior to EventLog so it might be a Catch 22. You could potentially look for another message that occurs earlier during shutdown on the servers you are monitoring, and watch for that.
A boot up event carries with it an even more troublesome set of Catch 22s. Think about how WMI eventing works for a moment. To get events, you have to open a connection to the remote WMI server via DCOM, and issue a WQL query to indicate what events you want. In order to receive a boot up event, you'd have to "magically" know to open said connection and issue said query prior to the event being fired.
Years ago I wrote a service that collected Event Log entries from remote servers for a network monitoring application. Just the logic to detect when the DCOM connection to the remote had been lost and needed to be rebuilt was a major pain in the neck. As it happened this was a component in a larger system that pinged the remote hosts anyway, so we ended up relying on that information to know when to rebuild our DCOM connections.
Are these systems on DHCP? It might be easier to monitor the DHCP renewals to see when a system is back online.
Typically from my experience this is done best with active (polling/pinging/whatever you want to call it)
What about the polling don't you like? (in general I share your dislike of polling for most uses, but this is a case where it is probably a good solution)
At the very least you can make some small lightweight polling process that then fires events to a set of subscribers when status changes for a machine.
Then if you find a better solution you already have an interface for events.