Find string in report file

[electrico]

Hi guys, I am almost new to the AutoIt. As I am totally exausted searching the forum, then I decided to ask for help. I need the small script that could MsgBox me if the process (for example winword.exe) is running on my local machine. As I already have typed "tasklist >C:\tasklog.log", I just want to examine this file and if there is process winword.exe in the report, notify me with MsgBox. Here what I already found searching the forum:

#include <file.au3>
Dim $aRecords
If Not _FileReadToArray("C:\tasklog.log",$aRecords) Then
   MsgBox(4096,"Error", " Error reading log to Array     error:" & @error)
   Exit
EndIf
For $x = 1 to $aRecords[0]
    Msgbox(0,'Record:' & $x, $aRecords[$x])
Next

Then i added this:

$searchstr = StringInStr($aRecords[$x], "csrss")
If $searchstr = True Then
    MsgBox(0, "", "y")
Else 
    MsgBox(0, "", "n")
EndIf

But that was n00b idea...

Thanks for the help guys.

[99ojo]

Hi,

autoit version without dos cmd:

Dim $arproc
$arproc = ProcessList ()
For $x = 1 to UBound ($arproc) - 1
    If StringInStr ($arproc [$x][0], "csrss") Then Msgbox(0,'Record:' & $x, $arproc[$x][0])
Next

Your version:

#include <file.au3>
Dim $aRecords
If Not _FileReadToArray("C:\tasklog.log",$aRecords) Then
   MsgBox(4096,"Error", " Error reading log to Array     error:" & @error)
   Exit
EndIf

For $x = 1 to $aRecords[0]
    If StringInStr ($arecords [$x], "csrss") Then Msgbox (0,'Record:' & $x, $aRecords[$x])
Next

;-))

Stefan

[electrico]

Stefan, thanks. Your answer is very good. But I forgot that i use tasklist with the /s key to capture REMOTE process tree, so i search the process name in the report file. If you can write the same but for remote, it would be cool. Thank you.

[electrico]

You are looking my post again. This is cool. Please help me just to search 'csrss.exe' in the text file, so if there is csrss.exe msgbox is appear, if not, no msgbox, (may be just sleep(10)).

[99ojo]

Hi,

Please help me just to search 'csrss.exe' in the text file

-> It is already there, have a look at my 1. st post.

Post again:

#include <file.au3>
Dim $aRecords
;You may use run function to execute your tasklist command
;RunWait (@ComSpec & " /c " & "tasklist /S RemoteSystem >c:\tasklog.log", "", @SW_HIDE)
If Not _FileReadToArray("C:\tasklog.log",$aRecords) Then
   MsgBox(4096,"Error", " Error reading log to Array     error:" & @error)
   Exit
EndIf

For $x = 1 to $aRecords[0]
    If StringInStr ($arecords [$x], "csrss") Then Msgbox (0,'Record:' & $x, $aRecords[$x])
Next

Another way is to use WMI for remote systems:

;Global $strComputer = "localhost"
Global $strComputer = "Name_of_host" ; WMI enabled and Firewall open for WMI
$arproc = _getproc ()
If IsArray ($arproc) Then
    For $i = 0 To UBound ($arproc) - 1
        If StringInStr ($arproc [$i], "csrss") Then MsgBox (0,"Process Found", "Process " & $arproc [$i] & " at position " & $i)
    Next
Else
    MsgBox (0, "Error", "Error WMI query on host ")
EndIf

Func _getproc ()
    ; Generated by AutoIt Scriptomatic
    Local $artemp [1], $count = 1
    $wbemFlagReturnImmediately = 0x10
    $wbemFlagForwardOnly = 0x20
    $colItems = ""
    $objWMIService = ObjGet("winmgmts:\\" & $strComputer & "\root\CIMV2")
    $colItems = $objWMIService.ExecQuery("SELECT * FROM Win32_Process", "WQL", _
                                              $wbemFlagReturnImmediately + $wbemFlagForwardOnly)

    If IsObj($colItems) then
        For $objItem In $colItems
            ReDim $artemp [$count]
            $artemp [$count - 1] = $objItem.Caption
            $count += 1
        Next
    Else
        Return 0
    EndIf
    Return $artemp
EndFunc

;-))

Stefan

[electrico]

Stefan, great help. Thank you. In conclusion, could you please provide me where to get information about WMI and how to use it?

Thanks a lot.

[99ojo]

Hi,

here's the download for scriptomatic.au3.

http://www.autoitscript.com/forum/index.php?automodule=downloads&showfile=29

Here are some information from Microsoft about scriptomatic:

http://technet.microsoft.com/de-de/scriptcenter/dd939957(en-us).aspx

You can query specific WMI Classes and code out what you want. Just play around. At the beginning you could start with WMI Class W32_Process.

;-))

Stefan

[electrico]

Stefan thanks. I will take it into account. BTW thx for quick help and replies.

elect.