Is it possible to sink WMI events?
alex_k._angelopoulos_(mvp)
Guide (at bottom of post) and I'm curious - is it possible to instantiate these
references to sink the events?
I was hoping to come up with something of the form
set wmi = WScript.CreateObject(<some-WMI-ref>,"wmi_")
and then be able to create a handler akin to:
Sub wmi___instancedeletionevent
Unfortunately, it looks like it could be pretty difficult to do... anyone have
any thoughts on this?
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colMonitoredProcesses = objWMIService. _
ExecNotificationQuery("select * from __instancedeletionevent " _
& "within 1 where TargetInstance isa 'Win32_Process'")
i = 0
Do While i = 0
Set objLatestProcess = colMonitoredProcesses.NextEvent
Wscript.Echo objLatestProcess.TargetInstance.Name
Loop
Michael Harris (MVP)
Here's an HTA example of sinking WMI events using a "WbemScripting.SWbemSink" object. It's defined in the HTA using an HTML <object> tag with it's clsid but could just as easily have been created on the fly using createobject and the progid.
<html>
<title>WatchFolder</title>
<hta:application
id="WatchFolder" applicationname="WatchFolderHTA"
singleinstance="yes" windowstate="minimize"
caption="yes" showintaskbar="yes"
sysmenu="yes" scroll="yes"
/>
<!------------------------script------------------------------------->
<!-- the progid for mysink is WbemScripting.SWbemSink -->
<object id="mysink" style="display:none;"
classid="clsid:75718C9A-F029-11D1-A1AC-00C04FB6C223"></object>
<script language="vbscript">
username=""
password=""
comp_name=""
folderToWatch = """c:\\\\_temp"""
set locator = CreateObject("Wbemscripting.SWbemLocator")
locator.security_.impersonationLevel = 3 'impersonate
set connector = _
locator.ConnectServer(Comp_Name,"root/cimv2",username,password)
wql = "Select * From __InstanceCreationEvent Within 2 " _
& "Where TargetInstance ISA 'cim_DirectoryContainsFile' " _
& "AND TargetInstance.GroupComponent=" _
& "'Win32_Directory.Name=" & folderToWatch & "'"
connector.ExecNotificationQueryAsync mysink, wql
</script>
<script language="vbscript"
for="mysink"
event="OnObjectReady(objObject, objAsyncContext)"
>
's = "File Created " & objObject.targetinstance.Partcomponent
s = "[" & time() & "] "
set o = connector.get(objObject.targetinstance.Partcomponent)
s = s & o.name & "<br>"
output.insertAdjacentHTML "beforeEnd",s
</script>
<style>
body {
font:x-small 'courier new';
color:black;background-color:white;
}
</style>
</head>
<body>
<div id="output"></div>
</body>
</html>
--
Michael Harris
Microsoft.MVP.Scripting
Seattle WA US
--
alex_k._angelopoulos_(mvp)
I want to see if I'm understanding this correctly since it will take me a bit of
work to put together something like this that I can test with specific WMI
events.
(1) You instantiate a connector and a sink
(2) You hook the connector to the sink via an async query.
(3) You set up event handlers. Since you are actually pipelining from
WbemScripting.SWbemSink, you always have the same set of standard events which
are usable: OnCompleted, OnObjectPut, OnObjectReady, OnProgress.
(4) Omitting the connector-side hookup, I assume something like this is what
would be done in WSH?
set oObj = WScript.CreateObject("WbemScripting.SWbemSink", "oObj_")
MsgBox "Click OK when done."
Sub oObj_OnCompleted
End Sub
Sub oObj_OnObjectPut
End Sub
Sub oObj_OnObjectReady
End Sub
Sub oObj_OnProgress
End Sub
===============================================================================
"Michael Harris (MVP)" <mik...@mvps.org> wrote in message
news:O3tP46vFCHA.2444@tkmsftngp05...
Michael Harris (MVP)
On thing to note is that in VBScript, you *must* make sure the parameter list of the OnWhatever event handlers you write match what the event source sends otherwise WSH won't match them up.