Monitor folder for file modification, creation or deletion using WMI

Highlander

unread,

Aug 1, 2007, 2:13:50 PM8/1/07

to

Hello all.

I've got a VBScript that will monitor a folder for any file
modification, creation or deletion. The script detects file
modifications just fine; but it does NOT detect any file creation or
deletion.

Any suggestions why this is occurring would be greatly appreciated.
Thanks!

- Dave

sPath = "\\Server\Drive$\Folder1\Folder2\Folder3"
sComputer = split(sPath,"\")(2)
sDrive = split(sPath,"\")(3)
sDrive = REPLACE(sDrive, "$", ":")
sFolders = split(sPath,"$")(1)
sFolders = REPLACE(sFolders, "\", "\\") & "\\"

Set objWMIService = GetObject("winmgmts:\\" & sComputer & "\root
\cimv2")
Set colMonitoredEvents = objWMIService.ExecNotificationQuery _
("SELECT * FROM __InstanceModificationEvent WITHIN 1 WHERE " _
& "TargetInstance ISA 'CIM_DataFile' AND " _
& "TargetInstance.Drive='" & sDrive & "' AND " _
& "TargetInstance.Path='" & sFolders & "'")

Wscript.Echo vbCrlf & Now & vbTab & _
"Begin Monitoring for a Folder Change Event..." & vbCrlf

Do
Set objLatestEvent = colMonitoredEvents.NextEvent
Select Case objLatestEvent.Path_.Class

Case "__InstanceCreationEvent"
WScript.Echo Now & vbTab & objLatestEvent.TargetInstance.FileName
_
& " was created" & vbCrlf

Case "__InstanceDeletionEvent"
WScript.Echo Now & vbTab & objLatestEvent.TargetInstance.FileName
_
& " was deleted" & vbCrlf

Case "__InstanceModificationEvent"
If objLatestEvent.TargetInstance.LastModified <> _
objLatestEvent.PreviousInstance.LastModified then
WScript.Echo Now & vbTab &
objLatestEvent.TargetInstance.FileName _
& " was modified" & vbCrlf
End If

IF objLatestEvent.TargetInstance.LastAccessed <> _
objLatestEvent.PreviousInstance.LastAccessed then
WScript.Echo Now & vbTab &
objLatestEvent.TargetInstance.FileName _
& " was accessed" & vbCrlf
End If

End Select
Loop

Set objWMIService = nothing
Set colMonitoredEvents = nothing
Set objLatestEvent = nothing

urkec

unread,

Aug 1, 2007, 3:38:01 PM8/1/07

to

"Highlander" wrote:

You subscribed only to file modification events. The notification query
should start like this:

Set colMonitoredEvents = objWMIService.ExecNotificationQuery _

("SELECT * FROM __InstanceOperationEvent WITHIN 1 WHERE " ...

with __InstanceOperationEvent instead of __InstanceModiicationEvent

--
urkec

Highlander

unread,

Aug 1, 2007, 3:56:54 PM8/1/07

to

Duh! Okay I feel stoopid.

Thanks for the correction. Workd like a champ now.

martin

unread,

Oct 29, 2007, 7:23:00 PM10/29/07

to

Great script. How would you add an email notification to something like this?

baka

unread,

Nov 17, 2007, 11:13:00 PM11/17/07

to

Hello Guys/Gals,

Short and sweet script!.Great people,
i have 2 doubts.
1.how can i monitor subfolder/s also
2.Is there any way to monitor Web folders
such oracle e-files (internet file system) folder etc
Thanks in advance
--Baka
Tokyo Japan

Rumi

unread,

Jan 27, 2009, 9:15:27 AM1/27/09

to

Hi Guys,
I need some help since I am new to WMI Events.
I am trying to write WQL query for monitoring any changes that occured
in a file
that is placed in specific folder(C:\Data)
I come up with the following query,but WMIEvent never occures.
Please can you provide me any feedback what I do wrong or if you know
othe way to query for file changes that we'll be great as well :)

Here is my WQL query:

SELECT * FROM __InstanceModificationEvent WITHIN 1 WHERE

TargetInstance ISA "CIM_DataFile" AND TargetInstance.Drive="C:" AND
TargetInstance.Path="\\Data"

Thanks in advance

--
Rumi
------------------------------------------------------------------------
Rumi's Profile: http://forums.techarena.in/members/rumi.htm
View this thread: http://forums.techarena.in/server-scripting/793796.htm

http://forums.techarena.in