[This is preliminary documentation and subject to change.]
Event providers use WQL to specify the types of event notifications that they support; event consumers use WQL to specify the types of event notifications that they receive. The WQL SELECT statement includes several extensions to the standard SQL syntax to support event notification:
Since many almost-identical events can occur within a specified amount of time, flooding is possible. To prevent possible flooding, WQL supports the GROUP BY and HAVING COUNT clauses to aggregate nearly-identical events into a single "representative" event. The result event is always an instance of the system class __AggregateEvent:. All related events are summarized by the Representative property, and the Count property tells the user how many events actually occurred.