File Monitoring Example

[nitekram]

When this line is run -

ConsoleWrite("Sink Name: " & $objAsyncContext.Item ("sinkname").Value & @CRLF)

oÝ÷ Ø̨ºÚn¶+oÝ÷ ضØ^ 6î´¦$x-¢­¶§jg¨~Ø^¦ºzË(y«?ªê-xׯz¹¢Ò¢éÝ­#¬$x¢¶®¶­s`¤6öç6öÆUw&FRgV÷C²&ö6W73¢gV÷C²fײb33c¶ö&¤ÆFW7DWfVçBåF&vWDç7Fæ6RææÖR

[arcker]

ouf ! because i couldn't get go more.

my prefer attribute is Commandline, try it instead of name

i've developed a lot of scripts for my firm to check if a process with some parameter has been started

that's really useful

@Andrew

with my knowledge, i've tried manytimes to get each item name or more

with this script you can't

my solution is to get every object created

i know its slow but that's the only solution i found so far

try something like

$var = objget($targetinstance.PartComponent.value)

then consolewrite $var.name

Edited May 2, 2007 by arcker

[Andrew Peacock]

@Andrew

with my knowledge, i've tried manytimes to get each item name or more

with this script you can't

my solution is to get every object created

i know its slow but that's the only solution i found so far

try something like

$var = objget($targetinstance.PartComponent.value)

then consolewrite $var.name

Thanks for the response, I get "The requested action with this object has failed" on that line.

The full code is:

CODE

;WMI monitoring

#include<array.au3>

#include<date.au3>

Dim $arrComputers, $strQuery, $SINK, $objContext, $objWMIService, $objAsyncContextItem, $return, $account

$arrComputers = _ArrayCreate("Desktop")

$strQuery = "SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'"

$SINK = ObjCreate("WbemScripting.SWbemSink")

ObjEvent($SINK, "SINK_")

For $strComputer In $arrComputers

$objContext = ObjCreate("WbemScripting.SWbemNamedValueSet")

$objContext.Add ("hostname", $strComputer)

$objContext.Add ("SinkName", "sinktest")

$objWMIService = ObjGet("winmgmts:" _

& "!\\" & $strComputer)

If Not @error Then

$objWMIService.ExecNotificationQueryAsync ($SINK, $strQuery, Default, Default, Default, $objContext)

ConsoleWrite("Waiting for processes to start on " & $strComputer & " ..." & @CRLF)

EndIf

Next

ConsoleWrite("In monitoring mode. Press Ctrl+C to exit." & @CRLF)

While 1

Sleep(10000)

WEnd

;******************************************************************************

Func SINK_OnObjectReady($objLatestEvent, $objAsyncContext)

;Trap asynchronous events.

Local $essai1, $essai2

$objAsyncContextItem = $objAsyncContext.Item ("hostname")

$targetInstance = $objLatestEvent.TargetInstance

$filename = objget($targetinstance.PartComponent.value)

ConsoleWrite(@CRLF & "Computer Name: " & $objAsyncContextItem.Value & @CRLF)

ConsoleWrite("Sink Name: " & $objAsyncContext.Item ("sinkname").Value & @CRLF)

ConsoleWrite("Filename: " & $filename & @crlf)

$objLatestEvent.TargetInstance.getowner($essai1,$essai2)

ConsoleWrite(" Owner : " & $essai1 &"\" & $essai2 & @CRLF)

ConsoleWrite(" Time: " & _NowDate() & @CRLF)

EndFunc ;==>SINK_OnObjectReady

func sink_onprogress($iUpperBound,$iCurrent,$strMessage,$objWbemAsyncContext)

ConsoleWrite("progress ... " & @crlf )

ConsoleWrite($iUpperBound & @crlf & $iCurrent & @crlf & $strMessage & @crlf &$objWbemAsyncContext & @crlf )

endfunc

Regards,

Andy

[arcker]

ConsoleWrite("Filename: " & $filename.Name & @crlf)

[Andrew Peacock]

ConsoleWrite("Filename: " & $filename.Name & @crlf)

Arcker,

If that is supposed to come after the line

$filename = objget($targetinstance.PartComponent.value)

it won't help - it's that objget that's failing:

(32) : ==> The requested action with this object has failed.: 
$filename = objget($targetinstance.PartComponent.value) 
$filename = objget($targetinstance.PartComponent^ ERROR

Even

$filename = objget($targetinstance.PartComponent)

produces

(32) : ==> The requested action with this object has failed.: 
$filename = objget($targetinstance.PartComponent) 
$filename = ^ ERROR

I'm confused,

Andy

[arcker]

if you want use sink, so you can do it simplier

i've to re-find the syntax (really rare to find it on the web) and i send you this

HEHEHE !

ok i think this command will be useful for more than one person

it definitively shows wmi full capabilities

try this

;WMI monitoring
#include<array.au3>
#include<date.au3>
Dim $arrComputers, $strQuery, $SINK, $objContext, $objWMIService, $objAsyncContextItem, $return, $account
$arrComputers = _ArrayCreate(".")
$strQuery = "SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'"
$SINK = ObjCreate("WbemScripting.SWbemSink")
ObjEvent($SINK, "SINK_")
For $strComputer In $arrComputers
    $objContext = ObjCreate("WbemScripting.SWbemNamedValueSet")
    $objContext.Add ("hostname", $strComputer)
    $objContext.Add ("SinkName", "sinktest")
    $objWMIService = ObjGet("winmgmts:!\\" & $strComputer)
    If Not @error Then
        $objWMIService.ExecNotificationQueryAsync ($SINK, $strQuery, Default, Default, Default, $objContext)
        ConsoleWrite("Waiting for processes to start on " & $strComputer & " ..." & @CRLF)
    EndIf
Next
ConsoleWrite("In monitoring mode. Press Ctrl+C to exit." & @CRLF)
While 1
    Sleep(10000)
WEnd
;******************************************************************************
Func SINK_OnObjectReady ($objLatestEvent, $objAsyncContext)    ;Trap asynchronous events.
    Local $essai1, $essai2
    $objAsyncContextItem = $objAsyncContext.Item ("hostname")
    $filename= $objLatestEvent.TargetInstance.Properties_.item("Name").value
    ConsoleWrite($filename & @CRLF)
    
EndFunc   ;==>SINK_OnObjectReady
Func sink_onprogress ($iUpperBound, $iCurrent, $strMessage, $objWbemAsyncContext)
    ConsoleWrite("progress ... " & @CRLF)
    ConsoleWrite($iUpperBound & @CRLF & $iCurrent & @CRLF & $strMessage & @CRLF & $objWbemAsyncContext & @CRLF)
EndFunc   ;==>sink_onprogress

Edited May 2, 2007 by arcker

[Andrew Peacock]

Arcker,

Thanks very much for taking the time to look into it.

Unfortunately, I can't get your code to register any new/deleted files... but then I can't get my original code to register any either, even though it worked before!!!!!!

Aarrrrggh!

I'll maybe take a look at it tomorrow (it's getting late here in the UK).

Thanks again

Andy

if you want use sink, so you can do it simplier

i've to re-find the syntax (really rare to find it on the web) and i send you this

HEHEHE !

ok i think this command will be useful for more than one person

it definitively shows wmi full capabilities

try this

;WMI monitoring
#include<array.au3>
#include<date.au3>
Dim $arrComputers, $strQuery, $SINK, $objContext, $objWMIService, $objAsyncContextItem, $return, $account
$arrComputers = _ArrayCreate(".")
$strQuery = "SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'"
$SINK = ObjCreate("WbemScripting.SWbemSink")
ObjEvent($SINK, "SINK_")
For $strComputer In $arrComputers
    $objContext = ObjCreate("WbemScripting.SWbemNamedValueSet")
    $objContext.Add ("hostname", $strComputer)
    $objContext.Add ("SinkName", "sinktest")
    $objWMIService = ObjGet("winmgmts:!\\" & $strComputer)
    If Not @error Then
        $objWMIService.ExecNotificationQueryAsync ($SINK, $strQuery, Default, Default, Default, $objContext)
        ConsoleWrite("Waiting for processes to start on " & $strComputer & " ..." & @CRLF)
    EndIf
Next
ConsoleWrite("In monitoring mode. Press Ctrl+C to exit." & @CRLF)
While 1
    Sleep(10000)
WEnd
;******************************************************************************
Func SINK_OnObjectReady ($objLatestEvent, $objAsyncContext)    ;Trap asynchronous events.
    Local $essai1, $essai2
    $objAsyncContextItem = $objAsyncContext.Item ("hostname")
    $filename= $objLatestEvent.TargetInstance.Properties_.item("Name").value
    ConsoleWrite($filename & @CRLF)
    
EndFunc   ;==>SINK_OnObjectReady
Func sink_onprogress ($iUpperBound, $iCurrent, $strMessage, $objWbemAsyncContext)
    ConsoleWrite("progress ... " & @CRLF)
    ConsoleWrite($iUpperBound & @CRLF & $iCurrent & @CRLF & $strMessage & @CRLF & $objWbemAsyncContext & @CRLF)
EndFunc   ;==>sink_onprogress

[Andrew Peacock]

Got it working. But I've realised what's going on. This script is detecting new PROCESSES, yes?

I thought it detected new files (eg, text docs), as mentioned in the thread title!

Any way to change this to monitor new/deleted files?

EDIT = I've tried just changing the $strQuery in the code provided by Arcker to the statement in the first post in the thread

"SELECT * FROM __InstanceOperationEvent WITHIN 5 WHERE " _
        & "Targetinstance ISA 'CIM_DirectoryContainsFile' and " _
            & "TargetInstance.GroupComponent= " _
                & "'Win32_Directory.Name=""c:\\\\1""'"

But it's not doing anything when I create/delete files.

Andy

Edited May 2, 2007 by Andrew Peacock

[Andrew Peacock]

Sorry! Like I said, it's late for me.

I got THE ORIGINAL SCRIPT working. I was creating files in C:, not C:\1 as mentioned in the first post.

OK. Next question :-)

So, I took the "sql" from the ORIGINAL SCRIPT and placed it into Arcker's code, and I get that old bugaboo:

C:\Documents and Settings\apeacock\My Documents\data\My Products\The File Tagger\Future Versions\Support\Autoit File Monitor\monitor.au3 (39) : ==> The requested action with this object has failed.:

$filename= $objLatestEvent.TargetInstance.Properties_.item("Name").value

$filename= $objLatestEvent.TargetInstance.Properties_.item("Name")^ ERROR

Is there any way to detect ANY file changes in ANY folder?

I tried just using

[jefhal]

arcker-

I tried your first script and got this error on Windows Home Edition. Should this run on WHE?

C:\Program Files\AutoIt3\Examples\WMIMonitor.au3 (17) : ==> The requested action with this object has failed.:

$objWMIService.ExecNotificationQueryAsync ($SINK, $strQuery, Default, Default, Default, $objContext)

$objWMIService.ExecNotificationQueryAsync ($SINK, $strQuery, Default, Default, Default, $objContext)^ ERROR

[arcker]

@ jefhal = yes it run on whe, but i think you need service pack or something because wmi is not installed on home edition if i remember well.

@ andrew = yes i've the same problem (and yes, the other one was for processes)

the problem is that we return any object from instancecreationevent ( select *)

i've to re-find the script that permit to say to wmi that we want 'CIM_DataFile' as return, something like targetinstance.partcomponent = 'CIM_DataFile'

i miss WMI and i have some time today, so i will do my possible to make it work

[arcker]

ok here the script

it can monitor the file and more, it can report file modification

if you want sub monitoring juste replace targetinstance.path = '//1//' by targetinstance.path like '//1//%'

BUT IT CONSUMES A LOT OF RESSOURCES, EVEN IF YOU SET WITHIN 60

i've an alernative for it: it's to create a script that will sink everydirectories

i send you an example as soon as possible

here is my current work

$strComputer = "."
 $objWMIService = ObjGet("winmgmts:\\" & $strComputer & "\root\cimv2")

 $colMonitoredEvents = $objWMIService.ExecNotificationQuery _
    ("SELECT * FROM __InstanceOperationEvent WITHIN 5 WHERE " _
        & "Targetinstance ISA 'CIM_DataFile' and " _
             & "TargetInstance.Path = '\\1\\' and " _ 
                & " TargetInstance.Drive = 'C:' ")




While 1
     $objEventObject = $colMonitoredEvents.NextEvent()

    Select 
        Case $objEventObject.Path_.Class()="__InstanceCreationEvent"
           ConsoleWrite ("A new file was just created: " & $objEventObject.TargetInstance.Properties_.Item("Name").Value & @CR)
        Case $objEventObject.Path_.Class()="__InstanceDeletionEvent"
           ConsoleWrite ("A file was just deleted: " & $objEventObject.TargetInstance.Properties_.Item("Name").Value  & @CR)
        Case $objEventObject.Path_.Class()="__InstanceModificationEvent"
           ConsoleWrite ("A file was just modified: " & $objEventObject.TargetInstance.Properties_.Item("Name").Value  & @CR)   
    EndSelect
WEnd

[Andrew Peacock]

Hi Arcker,

I want to just say thank you for all the help so far... but please don't spend any more time on it (at least, not for my benefit).

I was hoping to do this within Autoit, since I can include the file monitoring within an existing app. However, I've been searching around for applications (freeware) that to the same thing, and have found one that seems to do the trick. It's not supported or developed any more, but it seems to be flexible and stable. I'll use it for a while to see how I get on with it.

I'll just use NSIS Installer to install both my app and this third party one, and have my app configure the third party one for the appropriate folder and actions.

Many thanks once again,

Andy

[Andrew Peacock]

I should add that this app monitors subfolders, gives near-instantaneous notifications of file adds/deletes/changes, and is consuming less than 3% of CPU resources, so it kinds of does the trick. I just hope it is as stable as it looks.

Andy

Hi Arcker,

I want to just say thank you for all the help so far... but please don't spend any more time on it (at least, not for my benefit).

I was hoping to do this within Autoit, since I can include the file monitoring within an existing app. However, I've been searching around for applications (freeware) that to the same thing, and have found one that seems to do the trick. It's not supported or developed any more, but it seems to be flexible and stable. I'll use it for a while to see how I get on with it.

I'll just use NSIS Installer to install both my app and this third party one, and have my app configure the third party one for the appropriate folder and actions.

Many thanks once again,

Andy

[arcker]

can you tell us what the application you find for monitoring folders and files ?

[Andrew Peacock]

can you tell us what the application you find for monitoring folders and files ?

Sure, it's called LogMon or LogMonitor... but I can't remember now where I got it. I downloaded a whole bunch of similar apps over the last couple of days. I do remember that it was a russian site originally, but the site is now defunct - a copy of the software was available ..... somewhere else! Sorry!

Andy

[jefhal]

I found this: Logmonitor, but I wouldn't touch it with a 10 ft pole given what is going on these days with bots...

[Andrew Peacock]

I found this: Logmonitor, but I wouldn't touch it with a 10 ft pole given what is going on these days with bots...

That's the very fellow. My AV and spyware software says everythings OK.

Andy

[arcker]

not bad, but not fully scriptable

btw, i would like to create some plugin because wmi is really faster in C++

[Andrew Peacock]

not bad, but not fully scriptable

btw, i would like to create some plugin because wmi is really faster in C++

Arcker,

You're right, it's not fully scriptable. But it does a great deal more than some of the apps out there that cost alot more. The docs are not good at all on this project, but for basic operations, it's easy to see how it works.

Andy