Monitor folder for file modification, creation or deletion using WMI

Printable View

01-08-2007
Highlander

Monitor folder for file modification, creation or deletion using WMI

Hello all.

I've got a VBScript that will monitor a folder for any file
modification, creation or deletion. The script detects file
modifications just fine; but it does NOT detect any file creation or
deletion.

Any suggestions why this is occurring would be greatly appreciated.
Thanks!

- Dave

sPath = "\\Server\Drive$\Folder1\Folder2\Folder3"
sComputer = split(sPath,"\")(2)
sDrive = split(sPath,"\")(3)
sDrive = REPLACE(sDrive, "$", ":")
sFolders = split(sPath,"$")(1)
sFolders = REPLACE(sFolders, "\", "\\") & "\\"

Set objWMIService = GetObject("winmgmts:\\" & sComputer & "\root
\cimv2")
Set colMonitoredEvents = objWMIService.ExecNotificationQuery _
("SELECT * FROM __InstanceModificationEvent WITHIN 1 WHERE " _
& "TargetInstance ISA 'CIM_DataFile' AND " _
& "TargetInstance.Drive='" & sDrive & "' AND " _
& "TargetInstance.Path='" & sFolders & "'")

Wscript.Echo vbCrlf & Now & vbTab & _
"Begin Monitoring for a Folder Change Event..." & vbCrlf

Do
Set objLatestEvent = colMonitoredEvents.NextEvent
Select Case objLatestEvent.Path_.Class

Case "__InstanceCreationEvent"
WScript.Echo Now & vbTab & objLatestEvent.TargetInstance.FileName
_
& " was created" & vbCrlf

Case "__InstanceDeletionEvent"
WScript.Echo Now & vbTab & objLatestEvent.TargetInstance.FileName
_
& " was deleted" & vbCrlf

Case "__InstanceModificationEvent"
If objLatestEvent.TargetInstance.LastModified <> _
objLatestEvent.PreviousInstance.LastModified then
WScript.Echo Now & vbTab &
objLatestEvent.TargetInstance.FileName _
& " was modified" & vbCrlf
End If

IF objLatestEvent.TargetInstance.LastAccessed <> _
objLatestEvent.PreviousInstance.LastAccessed then
WScript.Echo Now & vbTab &
objLatestEvent.TargetInstance.FileName _
& " was accessed" & vbCrlf
End If

End Select
Loop

Set objWMIService = nothing
Set colMonitoredEvents = nothing
Set objLatestEvent = nothing
02-08-2007
urkec

RE: Monitor folder for file modification, creation or deletion using W

"Highlander" wrote:

> Hello all.
>
> I've got a VBScript that will monitor a folder for any file
> modification, creation or deletion. The script detects file
> modifications just fine; but it does NOT detect any file creation or
> deletion.
>
> Any suggestions why this is occurring would be greatly appreciated.
> Thanks!
>
> - Dave
>
> sPath = "\\Server\Drive$\Folder1\Folder2\Folder3"
> sComputer = split(sPath,"\")(2)
> sDrive = split(sPath,"\")(3)
> sDrive = REPLACE(sDrive, "$", ":")
> sFolders = split(sPath,"$")(1)
> sFolders = REPLACE(sFolders, "\", "\\") & "\\"
>
> Set objWMIService = GetObject("winmgmts:\\" & sComputer & "\root
> \cimv2")
> Set colMonitoredEvents = objWMIService.ExecNotificationQuery _
> ("SELECT * FROM __InstanceModificationEvent WITHIN 1 WHERE " _
> & "TargetInstance ISA 'CIM_DataFile' AND " _
> & "TargetInstance.Drive='" & sDrive & "' AND " _
> & "TargetInstance.Path='" & sFolders & "'")
>
> Wscript.Echo vbCrlf & Now & vbTab & _
> "Begin Monitoring for a Folder Change Event..." & vbCrlf
>
> Do
> Set objLatestEvent = colMonitoredEvents.NextEvent
> Select Case objLatestEvent.Path_.Class
>
> Case "__InstanceCreationEvent"
> WScript.Echo Now & vbTab & objLatestEvent.TargetInstance.FileName
> _
> & " was created" & vbCrlf
>
> Case "__InstanceDeletionEvent"
> WScript.Echo Now & vbTab & objLatestEvent.TargetInstance.FileName
> _
> & " was deleted" & vbCrlf
>
> Case "__InstanceModificationEvent"
> If objLatestEvent.TargetInstance.LastModified <> _
> objLatestEvent.PreviousInstance.LastModified then
> WScript.Echo Now & vbTab &
> objLatestEvent.TargetInstance.FileName _
> & " was modified" & vbCrlf
> End If
>
> IF objLatestEvent.TargetInstance.LastAccessed <> _
> objLatestEvent.PreviousInstance.LastAccessed then
> WScript.Echo Now & vbTab &
> objLatestEvent.TargetInstance.FileName _
> & " was accessed" & vbCrlf
> End If
>
> End Select
> Loop
>
> Set objWMIService = nothing
> Set colMonitoredEvents = nothing
> Set objLatestEvent = nothing
>
>

You subscribed only to file modification events. The notification query
should start like this:

Set colMonitoredEvents = objWMIService.ExecNotificationQuery _
("SELECT * FROM __InstanceOperationEvent WITHIN 1 WHERE " ...

with __InstanceOperationEvent instead of __InstanceModiicationEvent

--
urkec
02-08-2007
Highlander

Re: Monitor folder for file modification, creation or deletion using W

On Aug 1, 2:38 pm, urkec <ur...@discussions.microsoft.com> wrote:
> "Highlander" wrote:
> > Hello all.
>
> > I've got a VBScript that will monitor a folder for any file
> > modification, creation or deletion. The script detects file
> > modifications just fine; but it does NOT detect any file creation or
> > deletion.
>
> > Any suggestions why this is occurring would be greatly appreciated.
> > Thanks!
>
> > - Dave
>
> > sPath = "\\Server\Drive$\Folder1\Folder2\Folder3"
> > sComputer = split(sPath,"\")(2)
> > sDrive = split(sPath,"\")(3)
> > sDrive = REPLACE(sDrive, "$", ":")
> > sFolders = split(sPath,"$")(1)
> > sFolders = REPLACE(sFolders, "\", "\\") & "\\"
>
> > Set objWMIService = GetObject("winmgmts:\\" & sComputer & "\root
> > \cimv2")
> > Set colMonitoredEvents = objWMIService.ExecNotificationQuery _
> > ("SELECT * FROM __InstanceModificationEvent WITHIN 1 WHERE " _
> > & "TargetInstance ISA 'CIM_DataFile' AND " _
> > & "TargetInstance.Drive='" & sDrive & "' AND " _
> > & "TargetInstance.Path='" & sFolders & "'")
>
> > Wscript.Echo vbCrlf & Now & vbTab & _
> > "Begin Monitoring for a Folder Change Event..." & vbCrlf
>
> > Do
> > Set objLatestEvent = colMonitoredEvents.NextEvent
> > Select Case objLatestEvent.Path_.Class
>
> > Case "__InstanceCreationEvent"
> > WScript.Echo Now & vbTab & objLatestEvent.TargetInstance.FileName
> > _
> > & " was created" & vbCrlf
>
> > Case "__InstanceDeletionEvent"
> > WScript.Echo Now & vbTab & objLatestEvent.TargetInstance.FileName
> > _
> > & " was deleted" & vbCrlf
>
> > Case "__InstanceModificationEvent"
> > If objLatestEvent.TargetInstance.LastModified <> _
> > objLatestEvent.PreviousInstance.LastModified then
> > WScript.Echo Now & vbTab &
> > objLatestEvent.TargetInstance.FileName _
> > & " was modified" & vbCrlf
> > End If
>
> > IF objLatestEvent.TargetInstance.LastAccessed <> _
> > objLatestEvent.PreviousInstance.LastAccessed then
> > WScript.Echo Now & vbTab &
> > objLatestEvent.TargetInstance.FileName _
> > & " was accessed" & vbCrlf
> > End If
>
> > End Select
> > Loop
>
> > Set objWMIService = nothing
> > Set colMonitoredEvents = nothing
> > Set objLatestEvent = nothing
>
> You subscribed only to file modification events. The notification query
> should start like this:
>
> Set colMonitoredEvents = objWMIService.ExecNotificationQuery _
> ("SELECT * FROM __InstanceOperationEvent WITHIN 1 WHERE " ...
>
> with __InstanceOperationEvent instead of __InstanceModiicationEvent
>
> --
> urkec

Duh! Okay I feel stoopid.

Thanks for the correction. Workd like a champ now.
30-10-2007
martin

Re: Monitor folder for file modification, creation or deletion usi

Great script. How would you add an email notification to something like this?

"Highlander" wrote:

> On Aug 1, 2:38 pm, urkec <ur...@discussions.microsoft.com> wrote:
> > "Highlander" wrote:
> > > Hello all.
> >
> > > I've got a VBScript that will monitor a folder for any file
> > > modification, creation or deletion. The script detects file
> > > modifications just fine; but it does NOT detect any file creation or
> > > deletion.
> >
> > > Any suggestions why this is occurring would be greatly appreciated.
> > > Thanks!
> >
> > > - Dave
> >
> > > sPath = "\\Server\Drive$\Folder1\Folder2\Folder3"
> > > sComputer = split(sPath,"\")(2)
> > > sDrive = split(sPath,"\")(3)
> > > sDrive = REPLACE(sDrive, "$", ":")
> > > sFolders = split(sPath,"$")(1)
> > > sFolders = REPLACE(sFolders, "\", "\\") & "\\"
> >
> > > Set objWMIService = GetObject("winmgmts:\\" & sComputer & "\root
> > > \cimv2")
> > > Set colMonitoredEvents = objWMIService.ExecNotificationQuery _
> > > ("SELECT * FROM __InstanceModificationEvent WITHIN 1 WHERE " _
> > > & "TargetInstance ISA 'CIM_DataFile' AND " _
> > > & "TargetInstance.Drive='" & sDrive & "' AND " _
> > > & "TargetInstance.Path='" & sFolders & "'")
> >
> > > Wscript.Echo vbCrlf & Now & vbTab & _
> > > "Begin Monitoring for a Folder Change Event..." & vbCrlf
> >
> > > Do
> > > Set objLatestEvent = colMonitoredEvents.NextEvent
> > > Select Case objLatestEvent.Path_.Class
> >
> > > Case "__InstanceCreationEvent"
> > > WScript.Echo Now & vbTab & objLatestEvent.TargetInstance.FileName
> > > _
> > > & " was created" & vbCrlf
> >
> > > Case "__InstanceDeletionEvent"
> > > WScript.Echo Now & vbTab & objLatestEvent.TargetInstance.FileName
> > > _
> > > & " was deleted" & vbCrlf
> >
> > > Case "__InstanceModificationEvent"
> > > If objLatestEvent.TargetInstance.LastModified <> _
> > > objLatestEvent.PreviousInstance.LastModified then
> > > WScript.Echo Now & vbTab &
> > > objLatestEvent.TargetInstance.FileName _
> > > & " was modified" & vbCrlf
> > > End If
> >
> > > IF objLatestEvent.TargetInstance.LastAccessed <> _
> > > objLatestEvent.PreviousInstance.LastAccessed then
> > > WScript.Echo Now & vbTab &
> > > objLatestEvent.TargetInstance.FileName _
> > > & " was accessed" & vbCrlf
> > > End If
> >
> > > End Select
> > > Loop
> >
> > > Set objWMIService = nothing
> > > Set colMonitoredEvents = nothing
> > > Set objLatestEvent = nothing
> >
> > You subscribed only to file modification events. The notification query
> > should start like this:
> >
> > Set colMonitoredEvents = objWMIService.ExecNotificationQuery _
> > ("SELECT * FROM __InstanceOperationEvent WITHIN 1 WHERE " ...
> >
> > with __InstanceOperationEvent instead of __InstanceModiicationEvent
> >
> > --
> > urkec
>
> Duh! Okay I feel stoopid.
>
> Thanks for the correction. Workd like a champ now.
>
>
18-11-2007
baka

Re: Monitor folder for file modification, creation or deletion usi

Hello Guys/Gals,

Short and sweet script!.Great people,
i have 2 doubts.
1.how can i monitor subfolder/s also
2.Is there any way to monitor Web folders
such oracle e-files (internet file system) folder etc
Thanks in advance
--Baka
Tokyo Japan

"martin" wrote:

> Great script. How would you add an email notification to something like this?
>
> "Highlander" wrote:
>
> > On Aug 1, 2:38 pm, urkec <ur...@discussions.microsoft.com> wrote:
> > > "Highlander" wrote:
> > > > Hello all.
> > >
> > > > I've got a VBScript that will monitor a folder for any file
> > > > modification, creation or deletion. The script detects file
> > > > modifications just fine; but it does NOT detect any file creation or
> > > > deletion.
> > >
> > > > Any suggestions why this is occurring would be greatly appreciated.
> > > > Thanks!
> > >
> > > > - Dave
> > >
> > > > sPath = "\\Server\Drive$\Folder1\Folder2\Folder3"
> > > > sComputer = split(sPath,"\")(2)
> > > > sDrive = split(sPath,"\")(3)
> > > > sDrive = REPLACE(sDrive, "$", ":")
> > > > sFolders = split(sPath,"$")(1)
> > > > sFolders = REPLACE(sFolders, "\", "\\") & "\\"
> > >
> > > > Set objWMIService = GetObject("winmgmts:\\" & sComputer & "\root
> > > > \cimv2")
> > > > Set colMonitoredEvents = objWMIService.ExecNotificationQuery _
> > > > ("SELECT * FROM __InstanceModificationEvent WITHIN 1 WHERE " _
> > > > & "TargetInstance ISA 'CIM_DataFile' AND " _
> > > > & "TargetInstance.Drive='" & sDrive & "' AND " _
> > > > & "TargetInstance.Path='" & sFolders & "'")
> > >
> > > > Wscript.Echo vbCrlf & Now & vbTab & _
> > > > "Begin Monitoring for a Folder Change Event..." & vbCrlf
> > >
> > > > Do
> > > > Set objLatestEvent = colMonitoredEvents.NextEvent
> > > > Select Case objLatestEvent.Path_.Class
> > >
> > > > Case "__InstanceCreationEvent"
> > > > WScript.Echo Now & vbTab & objLatestEvent.TargetInstance.FileName
> > > > _
> > > > & " was created" & vbCrlf
> > >
> > > > Case "__InstanceDeletionEvent"
> > > > WScript.Echo Now & vbTab & objLatestEvent.TargetInstance.FileName
> > > > _
> > > > & " was deleted" & vbCrlf
> > >
> > > > Case "__InstanceModificationEvent"
> > > > If objLatestEvent.TargetInstance.LastModified <> _
> > > > objLatestEvent.PreviousInstance.LastModified then
> > > > WScript.Echo Now & vbTab &
> > > > objLatestEvent.TargetInstance.FileName _
> > > > & " was modified" & vbCrlf
> > > > End If
> > >
> > > > IF objLatestEvent.TargetInstance.LastAccessed <> _
> > > > objLatestEvent.PreviousInstance.LastAccessed then
> > > > WScript.Echo Now & vbTab &
> > > > objLatestEvent.TargetInstance.FileName _
> > > > & " was accessed" & vbCrlf
> > > > End If
> > >
> > > > End Select
> > > > Loop
> > >
> > > > Set objWMIService = nothing
> > > > Set colMonitoredEvents = nothing
> > > > Set objLatestEvent = nothing
> > >
> > > You subscribed only to file modification events. The notification query
> > > should start like this:
> > >
> > > Set colMonitoredEvents = objWMIService.ExecNotificationQuery _
> > > ("SELECT * FROM __InstanceOperationEvent WITHIN 1 WHERE " ...
> > >
> > > with __InstanceOperationEvent instead of __InstanceModiicationEvent
> > >
> > > --
> > > urkec
> >
> > Duh! Okay I feel stoopid.
> >
> > Thanks for the correction. Workd like a champ now.
> >
> >
27-01-2009
Rumi

Re: Monitor folder for file modification, creation or deletion usi

Hi Guys,
I need some help since I am new to WMI Events.
I am trying to write WQL query for monitoring any changes that occured in a file
that is placed in specific folder(C:\Data)
I come up with the following query,but WMIEvent never occures.
Please can you provide me any feedback what I do wrong or if you know othe way to query for file changes that we'll be great as well :)

Here is my WQL query:
SELECT * FROM __InstanceModificationEvent WITHIN 1 WHERE TargetInstance ISA "CIM_DataFile" AND TargetInstance.Drive="C:" AND TargetInstance.Path="\\Data"

Thanks in advance