用于监控文件更改的WQL查询

发布于 2024-07-11 21:49:55 字数 351 浏览 8 评论 0原文

由于我是 WMI 事件的新手，因此我需要一些帮助。我正在尝试编写 WQL 查询来监视文件中发生的任何更改放置在特定文件夹（C:\Data）中我提出了以下查询，但 WMIEvent 从未发生。

SELECT * FROM __InstanceModificationEvent WITHIN 1 WHERE TargetInstance ISA "CIM_DataFile" AND TargetInstance.Drive="C:" AND TargetInstance.Path="\\Data"

请您向我提供任何反馈，我做错了什么，或者如果您知道查询文件更改的其他方式，我也将不胜感激:)

原文

I need some help since I am new to WMI Events.
I am trying to write WQL query for monitoring any changes that occure in a file
that is placed in specific folder(C:\Data)
I come up with the following query,but WMIEvent never occures.

SELECT * FROM __InstanceModificationEvent WITHIN 1 WHERE TargetInstance ISA "CIM_DataFile" AND TargetInstance.Drive="C:" AND TargetInstance.Path="\\Data"

Please can you provide me any feedback, what I do wrong or if you know other way to query for file changes I'll appreciate it as well :)

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

放肆 2024-07-18 21:49:55

我认为问题在于您没有将查询中的 \ 字符加倍。 \ 是 WQL 中的保留字符，因此必须使用 \ 代替。下面是我使用的 VBScipt，并且能够正常工作。我希望这是有帮助的！

Main

Sub Main()

    WScript.Echo "Initializing WMI..."

    strComputer = "." 
    Set objWMIService = GetObject("winmgmts:\\" & _
        strComputer & "\root\CIMV2") 
    Set EventSink = WScript.CreateObject( _
        "WbemScripting.SWbemSink","SINK_")

    WScript.Echo "WMI Initialized."

    query = "SELECT * FROM __InstanceModificationEvent WITHIN 1 WHERE TargetInstance ISA 'CIM_DataFile' AND TargetInstance.Path='\\data\\'"

    WScript.Echo "Executing Query..."
    set results = objWMIservice.ExecNotificationQuery(query)
    WScript.Echo "Query Returned."

    Do
        WScript.Echo "Waiting on events..."
        Set evt = results.NextEvent
        WScript.Echo "Modified Path:" + evt.TargetInstance.Path
        WScript.Echo "Modified Path:" + evt.TargetInstance.Name
    Loop
End Sub

您可能还有兴趣了解如何使用 FileSystemWatcher 通过某些 .NET 语言（例如 VB.NET 或 C#）执行相同的操作。

I think the problem is that you didn't double up the \ characters in your query. \ is a reserved character in WQL so you must use \ instead. Below is the VBScipt I used and was able to get working. I hope this is helpful!

Main

Sub Main()

    WScript.Echo "Initializing WMI..."

    strComputer = "." 
    Set objWMIService = GetObject("winmgmts:\\" & _
        strComputer & "\root\CIMV2") 
    Set EventSink = WScript.CreateObject( _
        "WbemScripting.SWbemSink","SINK_")

    WScript.Echo "WMI Initialized."

    query = "SELECT * FROM __InstanceModificationEvent WITHIN 1 WHERE TargetInstance ISA 'CIM_DataFile' AND TargetInstance.Path='\\data\\'"

    WScript.Echo "Executing Query..."
    set results = objWMIservice.ExecNotificationQuery(query)
    WScript.Echo "Query Returned."

    Do
        WScript.Echo "Waiting on events..."
        Set evt = results.NextEvent
        WScript.Echo "Modified Path:" + evt.TargetInstance.Path
        WScript.Echo "Modified Path:" + evt.TargetInstance.Name
    Loop
End Sub

You might also be interested in looking at using the FileSystemWatcher via some .NET language (such as VB.NET or C#) to do the same.

回复收藏 0 原文

~没有更多了~