SELECT * FROM __InstanceCreationEvent WITHIN 10 WHERE TargetInstance ISA
"CIM_DirectoryContainsFile" and TargetInstance.GroupComponent=
"Win32_Directory.Name=\"c:\\\\ReceiveQueue\""
I thought that I could add teh TargetInstance.Extension to the WQL query
like this:
SELECT * FROM __InstanceCreationEvent WITHIN 10 WHERE TargetInstance ISA
"CIM_DirectoryContainsFile" and TargetInstance.GroupComponent=
"Win32_Directory.Name=\"c:\\\\ReceiveQueue\"" AND TargetInstance.Extension=
"txt"
however, that did not work. I have tried putting the txt in single quotes
inside the double quotes and using single quotes alone but nothing seems to
work.
What's the secret. Thanks in advance.
If you look at the Cim_DirectoryContainsFile class you will see that it only
has two properties:
GroupComponent, representing the path to a Win32_Directory instance
PartComponent, representing the path to a CIM_DataFile instance
This is why your query doesn't work - there is no Extension property for
Cim_DirectoryContainsFile. This doesn't work either:
TargetInstance.PartComponent.Extension
because PartComponent (just as GroupComponent) contains just a path (as a
string). Here is an alternative query:
Select * From __InstanceCreationEvent Within 10 Where TargetInstance Isa
Cim_DataFile And TargetInstance.Drive = "C:" And TargetInstance.Path =
"\\ReceiveQueue\\" And TargetInstance.Extension = "txt"
Instead of Cim_DirectoryContainsFile, this query subscribes to Cim_dataFile
creation events, which allows you to rafine results using all Cim_dataFile
properties, including Extesion.
--
urkec
My blog:
http://theadminblog.blogspot.com/
My CodeProject articles:
http://www.codeproject.com/script/Articles/MemberArticles.aspx?amid=4210975