Monitoring File Modification

Microsoft® Windows® 2000 Scripting Guide

« Previous | Next »   

Some documents are far more important to an organization than others. Because of this, you might want to keep a closer watch on these documents and be notified whenever they change in some way. For example, you might have a manual that describes the roles and responsibilities for each of your Information Technology (IT) personnel. If this document is modified, you need to look at it immediately to see whether the changes affect your daily routine. Or, if the home page for your Web site is modified, you might want to know right away so you can quickly verify that this is a valid change, and not the result of an attack by a hacker.

You can use a WMI event notification query to issue an alert whenever a particular file is modified in any way.

Scripting Steps

Listing 11.31 contains a script that issues an alert anytime the file C:\Scripts\Index.vbs is modified. To carry out this task, the script must perform the following steps:

1. Create a variable to specify the computer name.
2. Use a GetObject call to connect to the WMI namespace root\cimv2, and set the impersonation level to "impersonate."
3. Use the ExecNotificationQuery method to monitor for any changes made to the file "C:\\Scripts\\Index.vbs". The two sets of double backslashes must be included in the file name.
4. Create a Do Loop with no exit condition. This causes the loop to continue (and the script to run) indefinitely. The only way to stop the loop is to terminate the script process.
5. Create an object (objLatestEvent) to represent new instances of the CIM_DirectoryContainsFile class. Each time the file C:\Scripts\Index.vbs is modified, a new instance of objLatestEvent is created as well.
6. Each time the file is modified, echo:
   • The file name.
   • The current size of the file (TargetInstance.FileSize).
   • The previous size of the file (PreviousInstance.File Size).

Listing 11.31   Monitoring File Modification

1 2 3 4 5 6 7 8 9 10 11 12 13 14 

strComputer = "." Set objWMIService = GetObject("winmgmts:" _     & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colMonitoredEvents = objWMIService.ExecNotificationQuery _     ("SELECT * FROM __InstanceModificationEvent WITHIN 10 WHERE " _         & "TargetInstance ISA 'CIM_DataFile' AND " _             & "TargetInstance.Name='c:\\scripts\\index.vbs'") Do     Set objLatestEvent = colMonitoredEvents.NextEvent     Wscript.Echo "File: " & objLatestEvent.TargetInstance.Name     Wscript.Echo "New size: " & objLatestEvent.TargetInstance.FileSize     Wscript.Echo "Old size: " & objLatestEvent.PreviousInstance.FileSize Loop

---

 Send us your feedback

« Previous | Next »