WMI的WQL简明教程系列的前三篇文章[1,2,3]分别介绍WQL中的关键字，运算符和WMI中的类，由这三个东西，理论上已经能够完成WQL语句的编写了，不过也仅是理论上。就好比盖房子，理论上有水泥，钢筋和砖头是可以盖的，但实际上，并不是一定能盖出好房子的，甚至房子盖不成的也有，要盖好房子，还需要一个设计图纸，相对应的，咱们的WQL也同样，只有了一些基础的配件，有的时候并不一定能够装配出能正常运行的WQL语句。为了能够让我们能够组装出能够运行的WQL语句，就需要WQL的设计图纸——语法。

　　从WQL关键字篇我们能够看到，WQL并没有UPDATE，INSERT这类SQL中的语句，因此我们能够想象的到，WMI的WQL最主要的功能就是为了查询系统数据，因此我们学习WQL语法的时候，首先只要能够了解到查询数据的语法，基本上就能够应付大部分情况了，怎么样，还是相当的简单吧？那让我们开始吧，先看看下面的WQL：

SELECT * FROM Device
WHERE __CLASS = "Modem" OR __CLASS = "Keyboard"

　　从上面的语句中我们能够看到WQL的基本语法结构，其和SQL语法类似，但WQL中多处了ASSOCIATORS OF和 REFERENCES OF两个查询结构，具体的WQL查询分为Schema，Data和Event查询，他们的区别：

1. 数据查询:用于获取类实例,它返回特定类的所有实例，包括各自的请求属性集
2. Schema查询:获取类定义，使用的基本语法的形式与其他类型的查询一样
3. 事件查询:用于过滤出一个特定事件通知的属性。事件表征被管理环境的变更。
   每个查询允许添加一些附加的操作符，如：
   WITHIN：指定轮询
   GROUP：分组相同的事件
   HAVING：过滤WITHIN和GROUP子句收集事件的通知。一般与NumberofEvents属性（收集事件数量）一起。这样可以侦测何时特定事件的数量超过了时间间隔中设置的极限。

下面是Schema和Data查询的语法结构：

; -----------------------------------
; http://blog.useasp.net/
; MitchellChu's Blog
; WQL tutorial
; WQL schema and data 查询的语法结构
; -----------------------------------

DATA-WQL = 
 ("SELECT" <PROPERTY-LIST> "FROM" <CLASS-NAME> 
   <OPTIONAL-SEL-WHERE>)/ 
 ("SELECT" ASTERISK "FROM" <CLASS-NAME> <OPTIONAL-SEL-WHERE>)/ 
 ("SELECT" ASTERISK "FROM META_CLASS" <OPTIONAL-META-WHERE>)/
 ("ASSOCIATORS OF {" <OBJECT-REL-PATH> "}" 
   <OPTIONAL-ASSOC-WHERE>)/
 ("REFERENCES OF {" <OBJECT-REL-PATH> "}" <OPTIONAL-REF-WHERE>)

;========================================
; PROPERTY-LIST：属性列表
; 属性列表有属性名组成，多个属性名使用逗号分隔
; 如果奥全部选择，可以直接使用*（星号）代替
;========================================
PROPERTY-LIST = <PROPERTY-NAME> <PROPERTY-LIST2>
PROPERTY-LIST2 = [COMMA <PROPERTY-LIST>]

;========================================
; OPTIONAL-*-WHERE是WHERE子句
; 这个子句非必须，是用来缩小查询范围
;========================================
OPTIONAL-SEL-WHERE = ["WHERE" <EXPR>]
OPTIONAL-META-WHERE = ["WHERE __THIS ISA" <CLASS-NAME>]
OPTIONAL-ASSOC-WHERE = 
 ["WHERE" [ "AssocClass=" <CLASS-NAME> BLANK ] 
 [ "RequiredAssocQualifier=" <QUALIFIER-NAME> BLANK ]
 [ "RequiredQualifier=" <QUALIFIER-NAME> BLANK ]
 [ "ResultClass=" <CLASS-NAME> BLANK ]
 [ "ResultRole=" <PROPERTY-NAME> BLANK ] 
 [ "Role=" <PROPERTY-NAME> BLANK ]
 [ "KeysOnly" BLANK ] 
 [ "ClassDefsOnly" BLANK ]
                       ]
OPTIONAL-REF-WHERE = 
 ["WHERE" [ "RequiredQualifier=" <QUALIFIER-NAME> BLANK ]
 [ "ResultClass=" <CLASS-NAME> BLANK ]
 [ "Role=" <PROPERTY-NAME> BLANK ]
 [ "KeysOnly" BLANK ] 
 [ "ClassDefsOnly" BLANK ]
                     ] 

;========================================
; 
;========================================
OBJECT-REL-PATH = 
 <CLASS-NAME> "=" <TYPED-CONSTANT> <OBJECT-REL-PATH2>
OBJECT-REL-PATH2 = 
 [COMMA <OBJECT-REL-PATH>]

; -----------------------------------
; Expression 表达式
; -----------------------------------

EXPR =  
 ( [OPEN-PARENTHESIS] <PROPERTY-EVALUATION> 
    <EXPR2> [CLOSE-PARENTHESIS] ) / 
     ( [OPEN-PARENTHESIS] "__CLASS" <EQUIVALENT-OPERATOR> 
       <CLASS-NAME> <EXPR2> [CLOSE-PARENTHESIS] )

EXPR2 = ( ["OR"  [OPEN-PARENTHESIS] <EXPR> [CLOSE-PARENTHESIS] ])/
        ( ["AND" [OPEN-PARENTHESIS] <EXPR> [CLOSE-PARENTHESIS] ])

PROPERTY-EVALUATION = 
   ( <PROPERTY-NAME> <OPERATOR> <TYPED-CONSTANT> ) / 
    ( <PROPERTY-NAME> <IS-OPERATOR> "NULL" )

OPERATOR = <EQUIVALENT-OPERATOR> /
           <COMPARE-OPERATOR>

EQUIVALENT-OPERATOR = "=" / "!=" / "<>" 

COMPARE-OPERATOR = "<=" / ">=" / "<" / ">" / "LIKE"
IS-OPERATOR = "IS" / "IS NOT"

; -----------------------------------
; Characters 字符集
; -----------------------------------

ALPHA = %x41-5A
DIGIT = %x30-39
COMMA = ","
ASTERISK = "*"
OPEN-PARENTHESIS = "("
CLOSE-PARENTHESIS = ")"
BLANK = " " / "\x09"
DOUBLEUNDERSCORE = %x5f %x5f


STRING-IDENTIFIER = ALPHA *(ALPHA / DIGIT / (*("_") ALPHA / DIGIT)) 

CLASS-NAME = [DOUBLEUNDERSCORE]<STRING-IDENTIFIER>
PROPERTY-NAME = [DOUBLEUNDERSCORE]<STRING-IDENTIFIER>
QUALIFIER-NAME = <STRING-IDENTIFIER>


TYPED-CONSTANT = INT /
                 REAL /
                 UNICODE-STRING / 
                 DATETIME / 
                 BOOL


INT = "[-+]?\d+"
REAL = "[-+]?(\d*\.\d+)|(\d+)"
STRING = ["]([a-z][A-Z]\d)*["]
DATETIME is specified in section 2.2.1 of [DMTF-DSP0004]

BOOL = "TRUE" / "FALSE"

;==============================================
; http://blog.useasp.net/
; Mitchell Chu's Blog
; 关于RequiredAssocQualifier的示例
;==============================================
ASSOCIATORS OF {Win32_LogicalDisk.DeviceID="C:"}
WHERE RequiredAssocQualifier = Association

;============================================
; http://blog.useasp.net/
; MitchellChu's Blog
; WQL tutorial
;============================================
ASSOCIATORS OF {Win32_LogicalDisk.DeviceID="C:"}
WHERE RequiredAssocQualifier = Association

Event查询语法结构如下：

; -----------------------------------
; http://blog.useasp.net/
; MitchellChu's Blog
; WQL tutorial
; WQL event queries,Event查询
; -----------------------------------

EVENT-WQL = "SELECT" <PROPERTY-LIST> "FROM" / 
              <EVENT-CLASS-NAME> <OPTIONAL-WITHIN> <EVENT-WHERE>

OPTIONAL-WITHIN = ["WITHIN" <INTERVAL>]
INTERVAL = 1*MODULOREAL
EVENT-WHERE = ["WHERE" <EVENT-EXPR>]

EVENT-EXPR = ( (<INSTANCE-STATE> "ISA" <CLASS-NAME> <EXPR2>) /
              <EXPR> )
              ["GROUP WITHIN" <INTERVAL> 
                    ( ["BY" [<INSTANCE-STATE> DOT] <PROPERTY-NAME>] 
                      ["HAVING" <EXPR>] )]
INSTANCE-STATE = "TARGETINSTANCE" / "PREVIOUSINSTANCE"

; -----------------------------------
; Expression 表达式
; -----------------------------------

EXPR =
 [OPEN-PARENTHESIS] <PROPERTY-EVALUATION> /
  <EXPR2> [CLOSE-PARENTHESIS] 
EXPR2 = ( ["OR"  [OPEN-PARENTHESIS] <EXPR> / 
   [CLOSE-PARENTHESIS] ] ) /
        ( ["AND" [OPEN-PARENTHESIS] <EXPR> / 
   [CLOSE-PARENTHESIS] ] )

PROPERTY-EVALUATION = 
 ( <PROPERTY-NAME> <OPERATOR> <TYPED-CONSTANT> ) / 
  ( <PROPERTY-NAME> <IS-OPERATOR> "NULL" )

OPERATOR = <EQUIVALENT-OPERATOR> /
           <COMPARE-OPERATOR>

EQUIVALENT-OPERATOR = "=" / "!=" / "<>"
COMPARE-OPERATOR = "<=" / ">=" / "<" / ">" / "LIKE"
IS-OPERATOR = "IS" / "IS NOT"

; -----------------------------------
; Characters
; -----------------------------------

ALPHA = %x41-5A
DIGIT = %x30-39
DOT = ","
COMMA = "."
ASTERISK = "*"
OPEN-PARENTHESIS = "("
CLOSE-PARENTHESIS = ")"
STRING-IDENTIFIER = ALPHA *(ALPHA / DIGIT / (*("_") ALPHA / DIGIT)) 
DOUBLEUNDERSCORE = "__"

CLASS-NAME = [DOUBLEUNDERSCORE]<STRING-IDENTIFIER>
EVENT-CLASS-NAME = [DOUBLEUNDERSCORE]<STRING-IDENTIFIER>
PROPERTY-NAME = [DOUBLEUNDERSCORE]<STRING-IDENTIFIER>

TYPED-CONSTANT = INT /
                 REAL /
                 STRING / 
                 DATETIME / 
                 BOOL

INT = "[-+]?\d*"
REAL = "[-+]?\d*(\.\d+)?"
MODULOREAL = “[+]?\d*(\.\d+)?”
STRING = ["]([a-z][A-Z]\d)*["]
DATETIME is specified in section 2.2.1 of [DMTF-DSP0004]

BOOL = "TRUE" / "FALSE"

EVENT-WQL语法中的说明：

 有了这些语法，在应对WQL的操作时，就不再那么不知所措了，根据本文的语法，按照要求选取需要的关键字，找到关键的类，在WHERE子句用上操作符缩小下范围，就能找到自己想要的CIM类或者CIM实例了。enjoy it.

附注：

本文的文章大部分翻译自微软官方网站（才能有限，错愕之处还请指正）：WQL Query