I defined WQL Service monitor in capsd and pollerd.
(<property key="wql" value="Select State,Name From Win32_Service Where StartMode = 'auto'") - it is not so important what exactly I configured. Important is that I queried Win32_Service!
When the poller detects a failure and the event message has the following text:
"WMI-Service-Test outage identified on interface 127.0.0.1 with reason code: Result for Win32_ComputerSystem\State: Stopped."
I never queried Win32_ComputerSystem!
Better message would be:
"... with reason code: State: Stopped."
"... with reason code: <$WQL Statement> <$wmiObject> <$compareOp> <$compareValue>: failed"
or somthing else