wmi - WQL query for monitoring file change -


I want some help because I'm new to the WMI event. I have any changes that occure in a file in that specific folder I am trying to write WQL query for monitoring: I come with the following query (C \ data), but WMIEvent never occures 

  Select * __InstanceModificationEvent from within 1 Where TargetInstance Jesus "CIM_DataFile" and TargetInstance.Drive = "C:" and TargetInstance.Path = "\\ Data"

Please do not allow me any Can provide feedback, can I do wrong or if you know in other ways to query for file changes, I would appreciate this as well :)

Text after "

I think the problem is that you have \ alpha characters in your query Ohara is not a reserved character in \ WQL so you should use \ instead of \ "\". The VBSSeptip I was used below and was able to work. I hope this is useful! 

  main sub head () WScript.Echo "Starting WMI ..." strComputer = "." Set objWMIService = GetObject ("winmgmts: \\" & amp; _rComputer & amp; "\ root \ CIMV2") ".wMI start" set EventSink = WScript.CreateObject (_ "WbemScripting.SWbemSink", "SINK_") WScript .Echo Query = "SELECT * FROM __InstanceModificationEvent 1 Where Target Instance ISA 'CIM_DataFile' and TargetInstance.Path = '\\ Data \\' Execute" WScript.Echo "query ..." Set Result = objWMIservice.ExecNotificationQuery (Query ) WScript.Echo "query returns." WScript.Echo "Waiting on incidents ..." set evt = results. NextEvent WScript.Echo "Modified Path:" + evt.TargetInstance.Path WScript.Echo "Modified Path:" + evt.TargetInstance.Name Loop End Sub

You may also be interested in seeing something similar using the .NET language (such as in VB.NET or C #).


Comments

Post a Comment