Monitoring File Deletion

Microsoft® Windows® 2000 Scripting Guide

« Previous | Next »   

The CIM_DataContainsFile class can be used to keep track of the files within a specified folder. This means that CIM_DataContainsFile not only tracks which files are currently in a folder but can also keep track of changes to the contents of that folder. As shown in the preceding script, CIM_DataContainsFile can be used to identify new files added to a folder. It can also be used to identify files that are deleted from that folder.

Monitoring file deletion is similar to monitoring file creation; the only difference is that you must monitor for instances of the __InstanceDeletionEvent class. New instances of this class are created each time a managed object is deleted from the computer. By using the CIM_DataContainsFile class to limit data retrieval to deleted objects from a specific folder, you can be notified whenever a file is deleted from that folder.

Scripting Steps

Listing 11.30 contains a script that issues an alert whenever a file is deleted from the folder C:\Scripts. To carry out this task, the script must perform the following steps:

1. Create a variable to specify the computer name.
2. Use a GetObject call to connect to the WMI namespace root\cimv2, and set the impersonation level to "impersonate."
3. Use the ExecNotificationQuery method to monitor for deleted instances of the CIM_DirectoryContainsFile class, where the GroupComponent (the folder being monitored) is equal to "c:\\\\scripts". All four backslashes must be included in the query.
4. Create a Do Loop with no exit condition. This causes the loop to continue (and the script to run) indefinitely. The only way to stop the loop is to terminate the script process.
5. Create an object (objLatestEvent) to represent deleted instances of the CIM_DirectoryContainsFile class. Each time a file is deleted from C:\Scripts, a new instance of objLatestEvent is created.
6. Echo the PartComponent of the objLatestEvent.TargetInstance. In the association between CIM_DirectoryContainsFile and Win32_Directory, the PartComponent represents the path name of the newly deleted file.

Listing 11.30   Monitoring File Deletion

1 2 3 4 5 6 7 8 9 10 11 12 

strComputer = "." Set objWMIService = GetObject("winmgmts:" _     & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colMonitoredEvents = objWMIService.ExecNotificationQuery _     ("SELECT * FROM __InstanceDeletionEvent WITHIN 10 WHERE " _         & "Targetinstance ISA 'CIM_DirectoryContainsFile' AND " _             & "TargetInstance.GroupComponent= " _                 & "'Win32_Directory.Name=""c:\\\\scripts""'") Do     Set objLatestEvent = colMonitoredEvents.NextEvent     Wscript.Echo objLatestEvent.TargetInstance.PartComponent Loop

---

 Send us your feedback

« Previous | Next »