Jump to content
Sign in to follow this  
ptrex

File Monitoring Example

Recommended Posts

When this line is run -

ConsoleWrite("Sink Name: " & $objAsyncContext.Item ("sinkname").Value & @CRLF)

oÝ÷ Ø̨ºÚn¶+oÝ÷ ضØ^ 6î´¦$x-¢­¶§jg¨~Ø^¦ºzË(?ªê-xׯz¹¢Ò¢éÝ­#¬$x¢¶®¶­s`¤6öç6öÆUw&FRgV÷C²&ö6W73¢gV÷C²fײb33c¶ö&¤ÆFW7DWfVçBåF&vWDç7Fæ6RææÖR

All by me:

"Sometimes you have to go back to where you started, to get to where you want to go." 

"Everybody catches up with everyone, eventually" 

"As you teach others, you are really teaching yourself."

From my dad

"Do not worry about yesterday, as the only thing that you can control is tomorrow."

 

WindowsError.gif

WIKI | Tabs; | Arrays; | Strings | Wiki Arrays | How to ask a Question | Forum Search | FAQ | Tutorials | Original FAQ | ONLINE HELP | UDF's Wiki | AutoIt PDF

AutoIt Snippets | Multple Guis | Interrupting a running function | Another Send

StringRegExp | StringRegExp Help | RegEXTester | REG TUTOR | Reg TUTOT 2

AutoItSetOption | Macros | AutoIt Snippets | Wrapper | Autoit  Docs

SCITE | SciteJump | BB | MyTopics | Programming | UDFs | AutoIt 123 | UDFs Form | UDF

Learning to script | Tutorials | Documentation | IE.AU3 | Games? | FreeSoftware | Path_Online | Core Language

Programming Tips

Excel Changes

ControlHover.UDF

GDI_Plus

Draw_On_Screen

GDI Basics

GDI_More_Basics

GDI Rotate

GDI Graph

GDI  CheckExistingItems

GDI Trajectory

Replace $ghGDIPDll with $__g_hGDIPDll

DLL 101?

Array via Object

GDI Swimlane

GDI Plus French 101 Site

GDI Examples UEZ

GDI Basic Clock

GDI Detection

Ternary operator

Share this post


Link to post
Share on other sites

ouf ! because i couldn't get go more.

my prefer attribute is Commandline, try it instead of name

i've developed a lot of scripts for my firm to check if a process with some parameter has been started

that's really useful

@Andrew

with my knowledge, i've tried manytimes to get each item name or more

with this script you can't

my solution is to get every object created

i know its slow but that's the only solution i found so far

try something like

$var = objget($targetinstance.PartComponent.value)

then consolewrite $var.name

Edited by arcker

-- Arck System _ Soon -- Ideas make everything

"La critique est facile, l'art est difficile"

Projects :

[list] [*]Au3Service : Run your exe as service V3 / Updated 29/07/2013 Get it Here [/list]

Share this post


Link to post
Share on other sites

@Andrew

with my knowledge, i've tried manytimes to get each item name or more

with this script you can't

my solution is to get every object created

i know its slow but that's the only solution i found so far

try something like

$var = objget($targetinstance.PartComponent.value)

then consolewrite $var.name

Thanks for the response, I get "The requested action with this object has failed" on that line.

The full code is:

CODE

;WMI monitoring

#include<array.au3>

#include<date.au3>

Dim $arrComputers, $strQuery, $SINK, $objContext, $objWMIService, $objAsyncContextItem, $return, $account

$arrComputers = _ArrayCreate("Desktop")

$strQuery = "SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'"

$SINK = ObjCreate("WbemScripting.SWbemSink")

ObjEvent($SINK, "SINK_")

For $strComputer In $arrComputers

$objContext = ObjCreate("WbemScripting.SWbemNamedValueSet")

$objContext.Add ("hostname", $strComputer)

$objContext.Add ("SinkName", "sinktest")

$objWMIService = ObjGet("winmgmts:" _

& "!\\" & $strComputer)

If Not @error Then

$objWMIService.ExecNotificationQueryAsync ($SINK, $strQuery, Default, Default, Default, $objContext)

ConsoleWrite("Waiting for processes to start on " & $strComputer & " ..." & @CRLF)

EndIf

Next

ConsoleWrite("In monitoring mode. Press Ctrl+C to exit." & @CRLF)

While 1

Sleep(10000)

WEnd

;******************************************************************************

Func SINK_OnObjectReady($objLatestEvent, $objAsyncContext)

;Trap asynchronous events.

Local $essai1, $essai2

$objAsyncContextItem = $objAsyncContext.Item ("hostname")

$targetInstance = $objLatestEvent.TargetInstance

$filename = objget($targetinstance.PartComponent.value)

ConsoleWrite(@CRLF & "Computer Name: " & $objAsyncContextItem.Value & @CRLF)

ConsoleWrite("Sink Name: " & $objAsyncContext.Item ("sinkname").Value & @CRLF)

ConsoleWrite("Filename: " & $filename & @crlf)

$objLatestEvent.TargetInstance.getowner($essai1,$essai2)

ConsoleWrite(" Owner : " & $essai1 &"\" & $essai2 & @CRLF)

ConsoleWrite(" Time: " & _NowDate() & @CRLF)

EndFunc ;==>SINK_OnObjectReady

func sink_onprogress($iUpperBound,$iCurrent,$strMessage,$objWbemAsyncContext)

ConsoleWrite("progress ... " & @crlf )

ConsoleWrite($iUpperBound & @crlf & $iCurrent & @crlf & $strMessage & @crlf &$objWbemAsyncContext & @crlf )

endfunc

Regards,

Andy

Share this post


Link to post
Share on other sites

ConsoleWrite("Filename: " & $filename.Name & @crlf)


-- Arck System _ Soon -- Ideas make everything

"La critique est facile, l'art est difficile"

Projects :

[list] [*]Au3Service : Run your exe as service V3 / Updated 29/07/2013 Get it Here [/list]

Share this post


Link to post
Share on other sites

ConsoleWrite("Filename: " & $filename.Name & @crlf)

Arcker,

If that is supposed to come after the line

$filename = objget($targetinstance.PartComponent.value)

it won't help - it's that objget that's failing:

(32) : ==> The requested action with this object has failed.: 
$filename = objget($targetinstance.PartComponent.value) 
$filename = objget($targetinstance.PartComponent^ ERROR

Even

$filename = objget($targetinstance.PartComponent)

produces

(32) : ==> The requested action with this object has failed.: 
$filename = objget($targetinstance.PartComponent) 
$filename = ^ ERROR

I'm confused,

Andy

Share this post


Link to post
Share on other sites

if you want use sink, so you can do it simplier

i've to re-find the syntax (really rare to find it on the web) and i send you this

HEHEHE !

ok i think this command will be useful for more than one person

it definitively shows wmi full capabilities

try this

;WMI monitoring
#include<array.au3>
#include<date.au3>
Dim $arrComputers, $strQuery, $SINK, $objContext, $objWMIService, $objAsyncContextItem, $return, $account
$arrComputers = _ArrayCreate(".")
$strQuery = "SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'"
$SINK = ObjCreate("WbemScripting.SWbemSink")
ObjEvent($SINK, "SINK_")
For $strComputer In $arrComputers
    $objContext = ObjCreate("WbemScripting.SWbemNamedValueSet")
    $objContext.Add ("hostname", $strComputer)
    $objContext.Add ("SinkName", "sinktest")
    $objWMIService = ObjGet("winmgmts:!\\" & $strComputer)
    If Not @error Then
        $objWMIService.ExecNotificationQueryAsync ($SINK, $strQuery, Default, Default, Default, $objContext)
        ConsoleWrite("Waiting for processes to start on " & $strComputer & " ..." & @CRLF)
    EndIf
Next
ConsoleWrite("In monitoring mode. Press Ctrl+C to exit." & @CRLF)
While 1
    Sleep(10000)
WEnd
;******************************************************************************
Func SINK_OnObjectReady ($objLatestEvent, $objAsyncContext)    ;Trap asynchronous events.
    Local $essai1, $essai2
    $objAsyncContextItem = $objAsyncContext.Item ("hostname")
    $filename= $objLatestEvent.TargetInstance.Properties_.item("Name").value
    ConsoleWrite($filename & @CRLF)
    
EndFunc   ;==>SINK_OnObjectReady
Func sink_onprogress ($iUpperBound, $iCurrent, $strMessage, $objWbemAsyncContext)
    ConsoleWrite("progress ... " & @CRLF)
    ConsoleWrite($iUpperBound & @CRLF & $iCurrent & @CRLF & $strMessage & @CRLF & $objWbemAsyncContext & @CRLF)
EndFunc   ;==>sink_onprogress
Edited by arcker

-- Arck System _ Soon -- Ideas make everything

"La critique est facile, l'art est difficile"

Projects :

[list] [*]Au3Service : Run your exe as service V3 / Updated 29/07/2013 Get it Here [/list]

Share this post


Link to post
Share on other sites

Arcker,

Thanks very much for taking the time to look into it.

Unfortunately, I can't get your code to register any new/deleted files... but then I can't get my original code to register any either, even though it worked before!!!!!!

Aarrrrggh!

I'll maybe take a look at it tomorrow (it's getting late here in the UK).

Thanks again

Andy

if you want use sink, so you can do it simplier

i've to re-find the syntax (really rare to find it on the web) and i send you this

HEHEHE !

ok i think this command will be useful for more than one person

it definitively shows wmi full capabilities

try this

;WMI monitoring
#include<array.au3>
#include<date.au3>
Dim $arrComputers, $strQuery, $SINK, $objContext, $objWMIService, $objAsyncContextItem, $return, $account
$arrComputers = _ArrayCreate(".")
$strQuery = "SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'"
$SINK = ObjCreate("WbemScripting.SWbemSink")
ObjEvent($SINK, "SINK_")
For $strComputer In $arrComputers
    $objContext = ObjCreate("WbemScripting.SWbemNamedValueSet")
    $objContext.Add ("hostname", $strComputer)
    $objContext.Add ("SinkName", "sinktest")
    $objWMIService = ObjGet("winmgmts:!\\" & $strComputer)
    If Not @error Then
        $objWMIService.ExecNotificationQueryAsync ($SINK, $strQuery, Default, Default, Default, $objContext)
        ConsoleWrite("Waiting for processes to start on " & $strComputer & " ..." & @CRLF)
    EndIf
Next
ConsoleWrite("In monitoring mode. Press Ctrl+C to exit." & @CRLF)
While 1
    Sleep(10000)
WEnd
;******************************************************************************
Func SINK_OnObjectReady ($objLatestEvent, $objAsyncContext)    ;Trap asynchronous events.
    Local $essai1, $essai2
    $objAsyncContextItem = $objAsyncContext.Item ("hostname")
    $filename= $objLatestEvent.TargetInstance.Properties_.item("Name").value
    ConsoleWrite($filename & @CRLF)
    
EndFunc   ;==>SINK_OnObjectReady
Func sink_onprogress ($iUpperBound, $iCurrent, $strMessage, $objWbemAsyncContext)
    ConsoleWrite("progress ... " & @CRLF)
    ConsoleWrite($iUpperBound & @CRLF & $iCurrent & @CRLF & $strMessage & @CRLF & $objWbemAsyncContext & @CRLF)
EndFunc   ;==>sink_onprogress

Share this post


Link to post
Share on other sites

Got it working. But I've realised what's going on. This script is detecting new PROCESSES, yes?

I thought it detected new files (eg, text docs), as mentioned in the thread title!

Any way to change this to monitor new/deleted files?

EDIT = I've tried just changing the $strQuery in the code provided by Arcker to the statement in the first post in the thread

"SELECT * FROM __InstanceOperationEvent WITHIN 5 WHERE " _
        & "Targetinstance ISA 'CIM_DirectoryContainsFile' and " _
            & "TargetInstance.GroupComponent= " _
                & "'Win32_Directory.Name=""c:\\\\1""'"

But it's not doing anything when I create/delete files.

Andy

Edited by Andrew Peacock

Share this post


Link to post
Share on other sites

Sorry! Like I said, it's late for me.

I got THE ORIGINAL SCRIPT working. I was creating files in C:, not C:\1 as mentioned in the first post.

OK. Next question :-)

So, I took the "sql" from the ORIGINAL SCRIPT and placed it into Arcker's code, and I get that old bugaboo:

C:\Documents and Settings\apeacock\My Documents\data\My Products\The File Tagger\Future Versions\Support\Autoit File Monitor\monitor.au3 (39) : ==> The requested action with this object has failed.:

$filename= $objLatestEvent.TargetInstance.Properties_.item("Name").value

$filename= $objLatestEvent.TargetInstance.Properties_.item("Name")^ ERROR

Is there any way to detect ANY file changes in ANY folder?

I tried just using

Share this post


Link to post
Share on other sites

arcker-

I tried your first script and got this error on Windows Home Edition. Should this run on WHE?

C:\Program Files\AutoIt3\Examples\WMIMonitor.au3 (17) : ==> The requested action with this object has failed.:

$objWMIService.ExecNotificationQueryAsync ($SINK, $strQuery, Default, Default, Default, $objContext)

$objWMIService.ExecNotificationQueryAsync ($SINK, $strQuery, Default, Default, Default, $objContext)^ ERROR


...by the way, it's pronounced: "JIF"... Bob Berry --- inventor of the GIF format

Share this post


Link to post
Share on other sites

@ jefhal = yes it run on whe, but i think you need service pack or something because wmi is not installed on home edition if i remember well.

@ andrew = yes i've the same problem (and yes, the other one was for processes)

the problem is that we return any object from instancecreationevent ( select *)

i've to re-find the script that permit to say to wmi that we want 'CIM_DataFile' as return, something like targetinstance.partcomponent = 'CIM_DataFile'

i miss WMI and i have some time today, so i will do my possible to make it work


-- Arck System _ Soon -- Ideas make everything

"La critique est facile, l'art est difficile"

Projects :

[list] [*]Au3Service : Run your exe as service V3 / Updated 29/07/2013 Get it Here [/list]

Share this post


Link to post
Share on other sites

ok here the script

it can monitor the file and more, it can report file modification

if you want sub monitoring juste replace targetinstance.path = '//1//' by targetinstance.path like '//1//%'

BUT IT CONSUMES A LOT OF RESSOURCES, EVEN IF YOU SET WITHIN 60

i've an alernative for it: it's to create a script that will sink everydirectories

i send you an example as soon as possible

here is my current work

$strComputer = "."
 $objWMIService = ObjGet("winmgmts:\\" & $strComputer & "\root\cimv2")

 $colMonitoredEvents = $objWMIService.ExecNotificationQuery _
    ("SELECT * FROM __InstanceOperationEvent WITHIN 5 WHERE " _
        & "Targetinstance ISA 'CIM_DataFile' and " _
             & "TargetInstance.Path = '\\1\\' and " _ 
                & " TargetInstance.Drive = 'C:' ")




While 1
     $objEventObject = $colMonitoredEvents.NextEvent()

    Select 
        Case $objEventObject.Path_.Class()="__InstanceCreationEvent"
           ConsoleWrite ("A new file was just created: " & $objEventObject.TargetInstance.Properties_.Item("Name").Value & @CR)
        Case $objEventObject.Path_.Class()="__InstanceDeletionEvent"
           ConsoleWrite ("A file was just deleted: " & $objEventObject.TargetInstance.Properties_.Item("Name").Value  & @CR)
        Case $objEventObject.Path_.Class()="__InstanceModificationEvent"
           ConsoleWrite ("A file was just modified: " & $objEventObject.TargetInstance.Properties_.Item("Name").Value  & @CR)   
    EndSelect
WEnd

-- Arck System _ Soon -- Ideas make everything

"La critique est facile, l'art est difficile"

Projects :

[list] [*]Au3Service : Run your exe as service V3 / Updated 29/07/2013 Get it Here [/list]

Share this post


Link to post
Share on other sites

Hi Arcker,

I want to just say thank you for all the help so far... but please don't spend any more time on it (at least, not for my benefit).

I was hoping to do this within Autoit, since I can include the file monitoring within an existing app. However, I've been searching around for applications (freeware) that to the same thing, and have found one that seems to do the trick. It's not supported or developed any more, but it seems to be flexible and stable. I'll use it for a while to see how I get on with it.

I'll just use NSIS Installer to install both my app and this third party one, and have my app configure the third party one for the appropriate folder and actions.

Many thanks once again,

Andy

Share this post


Link to post
Share on other sites

I should add that this app monitors subfolders, gives near-instantaneous notifications of file adds/deletes/changes, and is consuming less than 3% of CPU resources, so it kinds of does the trick. I just hope it is as stable as it looks.

Andy

Hi Arcker,

I want to just say thank you for all the help so far... but please don't spend any more time on it (at least, not for my benefit).

I was hoping to do this within Autoit, since I can include the file monitoring within an existing app. However, I've been searching around for applications (freeware) that to the same thing, and have found one that seems to do the trick. It's not supported or developed any more, but it seems to be flexible and stable. I'll use it for a while to see how I get on with it.

I'll just use NSIS Installer to install both my app and this third party one, and have my app configure the third party one for the appropriate folder and actions.

Many thanks once again,

Andy

Share this post


Link to post
Share on other sites

can you tell us what the application you find for monitoring folders and files ?


-- Arck System _ Soon -- Ideas make everything

"La critique est facile, l'art est difficile"

Projects :

[list] [*]Au3Service : Run your exe as service V3 / Updated 29/07/2013 Get it Here [/list]

Share this post


Link to post
Share on other sites

can you tell us what the application you find for monitoring folders and files ?

Sure, it's called LogMon or LogMonitor... but I can't remember now where I got it. I downloaded a whole bunch of similar apps over the last couple of days. I do remember that it was a russian site originally, but the site is now defunct - a copy of the software was available ..... somewhere else! Sorry!

Andy

Share this post


Link to post
Share on other sites

I found this: Logmonitor, but I wouldn't touch it with a 10 ft pole given what is going on these days with bots...


...by the way, it's pronounced: "JIF"... Bob Berry --- inventor of the GIF format

Share this post


Link to post
Share on other sites

not bad, but not fully scriptable

btw, i would like to create some plugin because wmi is really faster in C++


-- Arck System _ Soon -- Ideas make everything

"La critique est facile, l'art est difficile"

Projects :

[list] [*]Au3Service : Run your exe as service V3 / Updated 29/07/2013 Get it Here [/list]

Share this post


Link to post
Share on other sites

not bad, but not fully scriptable

btw, i would like to create some plugin because wmi is really faster in C++

Arcker,

You're right, it's not fully scriptable. But it does a great deal more than some of the apps out there that cost alot more. The docs are not good at all on this project, but for basic operations, it's easy to see how it works.

Andy

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...