More Event Scripting with WMI - Using __InstanceModificationEvent
(Page 2 of 4 )
We’ll be using the __InstanceModificationEvent event. This event watches an object for any modifications. These include: changing the object name, adding or removing content, or altering any attributes. Essentially, it watches for any time the object is changed or modified in any way.
This is useful for watching a file or folder for updates, or watching specific registry keys for unwanted changes.
To implement this event, simply use a drop-in replacement in our code sample.
strComputer = "."
Set objWMIService = GetObject("winmgmts:" & strComputer _
& "rootcimv2")
Set colEvents = objWMIService.ExecNotificationQuery _
("SELECT * FROM __InstanceModificationEvent WITHIN 10 WHERE " _
& "Targetinstance ISA 'CIM_DirectoryContainsFile' and " _
& "TargetInstance.GroupComponent= " _
& "'Win32_Directory.Name=""c:\test""'")
Do While True
Set objEvent = colEvents.NextEvent()
WScript.Echo "File Modified:", _
objEvent.TargetInstance.PartComponent
Loop
You can test this by again creating a folder called C:test. Create a plain text file. (It doesn’t matter what you name it.) Now run your script. While your script is running, open the text file in Notepad and add some text. Now save your changes. You script should notify you that the file has been changed.
As you’ve probably noticed by now, WMI returns a pretty interesting file path.
ComputerNamerootcimv2:CIM_DataFile.Name="c:scriptsDocument.txt"
This is probably not what you want. Let’s take a quick look at how to parse this into a usable file path.
Next: Parsing WMI’s results >>
More Windows Scripting Articles
More By Nilpo/Developer Shed Staff Writer
