Monitor File modifications

[ajtsystems]

I need to compare file modification times so I can monitor an error log for changes and at some time in the future check for particular error messages.

I found a WMI query which monitors every X seconds and can echo previously checked date and new check date using instances. The problem is it monitors continoulsy and not just when the script is run as there is a WITHIN x statement in the query.

Question: Can the monitor aspect of this script be disabled. I have tried WITHIN 0 and even removed WITHN but no luck,

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colMonitoredEvents = objWMIService.ExecNotificationQuery _
("SELECT * FROM __InstanceModificationEvent WITHIN 10 WHERE " _
& "TargetInstance ISA 'CIM_DataFile' AND " _
& "TargetInstance.Name='c:\\scripts\\index.vbs'")

'Do
Set objLatestEvent = colMonitoredEvents.NextEvent
Wscript.Echo "File: " & objLatestEvent.TargetInstance.Name
Wscript.Echo "New size: " & objLatestEvent.TargetInstance.FileSize
Wscript.Echo "Old size: " & objLatestEvent.PreviousInstance.FileSize
'Loop

if objLatestEvent.TargetInstance.FileSize < objLatestEvent.PreviousInstance.FileSize then
changed = 1
else changed = 0
end if

wscript.echo changed

Microsoft say that removing the Do, Loop stops the check looping but this doesn't work either,

Any help be good.

James

 

[mrmovie]

sorry, i am sure i am being thick, but i really dont understand your question.?

The WITHIN is a bit of a red-herring, i wouldnt worry about the setting too much, well, saying that i wouldnt have it too low, 10 sounds ok.

'this line
Set objLatestEvent = colMonitoredEvents.NextEvent
'is a blocked method call. So, once you issue it your script will sit there and wait for the event you are monitoring to occur. I believe you may be interested in looking at 'asynchronous event notification' with WMI. This involves stuff like SWbemSink etc