WMI Query? 1

[bowwow]

All

I have the below WMI Notification Query on winodws 2000, it runs but sends the resources crazy and appears to be searching through ALL files. Does anyone know how I can modify this to run more efficently?

Any help much appreciated!!


select * from __InstanceCreationEvent within 10 where TargetInstance isa "CIM_DataFile" and TargetInstance.Drive="C:" and TargetInstance.Path="\\Testfolder\\" and TargetInstance.FileSize=0

 

[mrmovie]

does it actually work? i thought in a WQL query you used ' rather than

 

[tsuji]

bowwow,

I don't know... It's a terrible thing to do with your query string! somebody's advice or you invent it yourself? cim_datafile is a monster to deal with like that.

Try this.

set svc=getobject("winmgmts:root\cimv2")
squery="select * from __InstanceCreationEvent within 50 where TargetInstance ISA 'CIM_DirectoryContainsFile' " & _
	"and TargetInstance.GroupComponent='win32_directory.name=""c:\\\\testfolder""'"
set oevtsrc=svc.execnotificationquery(squery)
wscript.echo "The notification query is now running..."
do while true
    set oevt = oevtsrc.nextevent
    if svc.get(oevt.TargetInstance.PartComponent).properties_("filesize")=0 then
        'do something as a zero-byte file is created
        'setting exit condition if necessary
        wscript.echo "A new zero byte file is created." & vbcrlf & "This program will be terminated."    'to be commented out
        exit do    'testing only once, to be commented out
    else
        'might be doing nothing
        'setting exit condition if necessary
        wscript.echo "A new nonzero byte file is created." & vbcrlf & "This program will be terminated."    'to be commented out
        exit do    'testing only once, to be commented out
    end if
loop
set oevt=nothing
set oevtsrc=nothing
set svc=nothing

regards - tsuji

 

[bowwow]

Thanks Tsuji, apologies for my crime! ; ) although it was under advise (thats my excuse!) Above looks hopeful, but Im fairly certain it needs to be as pure a WMI query as possible (eg. runs ok through wbemtest). A Microsoft MOM Agent will be running this as a 'WMI Event Query', so needs to be WQL format (is that the case for all of the above?). Please see below for my attempt, although I know the below is probably wrong, I hope it conveys where Im trying to get to :

select * from __InstanceCreationEvent within 50 where TargetInstance ISA ‘CIM_DirectoryContainsFile’ & _ and TargetInstance.GroupComponent=’win32_directory.name=””c:\\\\testfolder””’ and <some way of checking the filesize whithout perf issues?>

Thanks once again for help and patience!

 

[tsuji]

bowwow,

I just wanted to put thing in "relief" . So the comment is not to be taken at heart and personal. I know you don't. And my respect to your advisor too.

My rule of thumb, and it is my pure invention/observation, is that whenever you make a query string for execnotif for __instancecreateionevent _and_ __instancedeletionevent, never(?) take in cim_datafile in any direct conditional. In __instancemodificationevent, you can.

But in broad context, you're not query only once but there must be some periodic pooling or else asyn custom provider for the event's consumption? Hence, I would guess, in any case, the event signal will get a fair chance to be processed. So I would say the approach I proposed would still be viable. Else, I am all ears... and I may take a harder look some other times?

- tsuji

 

[bowwow]

Hi Tsuji, no offence taken at all. Ive taken your advise and tried to include the neccessary action (create error Event), but the script is not closing, it appears to remain in the 'Loop', however when I remove the 'loop' I et a Syntax error at the start of the Sub component (Line16)so Im not certain Im inlcuding the Sub at the end correctly, once again any suggestions most welcome!!

Code:

set svc=getobject("winmgmts:root\cimv2")
squery="select * from __InstanceCreationEvent within 20 where TargetInstance ISA 'CIM_DirectoryContainsFile' " & _
"and TargetInstance.GroupComponent='win32_directory.name=""c:\\\\testfolder""'"
set oevtsrc=svc.execnotificationquery(squery)
do while true
set oevt = oevtsrc.nextevent
if svc.get(oevt.TargetInstance.PartComponent).properties_("filesize")=0 then
CreateSubmitEvent
end if
exit do
loop
set oevt=nothing
set oevtsrc=nothing
set svc=nothing

Sub CreateSubmitEvent
Dim oNewEvent
Set oNewEvent = ScriptContext.CreateEvent
oNewEvent.Message = ("File of 0 Bytes in Size Discovered")
oNewEvent.EventNumber = 9999
oNewEvent.EventType = cError
ScriptContext.Submit(oNewEvent)
Set oNewEvent = Nothing
End Sub

Quit

 

[tsuji]

bowwow,

There is a exit do (for testing targetted event filesize=0 only once). Hence if you remove do loop, it will error out.

Keep the do-loop, and you still have to move exit do to within the if-end if.
[tt]
do while true
set oevt = oevtsrc.nextevent
if svc.get(oevt.TargetInstance.PartComponent).properties_("filesize")=0 then
CreateSubmitEvent
[blue]exit do[/blue]
end if
'[red]exit do[/red]
loop
[/tt]
- tsuji

 

[bowwow]

hi Tsuji

after your suggested modification the script now runs and creates the event log... which is great, and thanks again for helping me get to this point... however, Im finding the script doesent appear to exit ... does the loop or the script itself need exiting in some way/ again thanks for help on this, cheers Andrew

 

[tsuji]

bowwow,

The script block shown as such would run on the background until it picks up one targetted event with filesize=0 in the __instancecreationevent. If it never detects one, it will persist and wait eternally.

If you want to terminate this after certain period of time, you have invent something. One way I did is to make a parallel process which eventually create on artificial event after some time lack.

- tsuji

 

[bowwow]

Hi Tsuji

Id thought that the "within 20" would limit this to querying only the last 20 seconds? How does this function in the script?

Also is it simple to modify so that it only runs through on demand (it'll be scheduled to run periodicly via the Agent) and does a one-off check and then exits out?

Cheers
Andrew

 

[tsuji]

bowwow,

A vbs to create a bogus zero-byte file and hence triggered the event will be like this.

'named:trigger.vbs, say
filespec="c:\testfolder\bogus"
set fso=createobject("scripting.filesystemobject")
if fso.fileexists(filespec) then fso.deletefile filespec
wscript.sleep 20000	'20 sec delay
set ofile=fso.createtextfile(filespec)
ofile.close
set ofile=nothing
wscript.sleep 10000    'delete it in 10 sec, cleaning up
fso.deletefile filespec,true
set fso=nothing

Then in the main script call this vbs located in the same folder as the main script.

[blue]trigger="trigger.vbs"

'host by wscript, else modify this to point to seed.vbs directly
triggerfilespec=replace(wscript.scriptfullname,wscript.scriptname,trigger)
[/blue]
set svc=getobject("winmgmts:root\cimv2")
squery="select * from __InstanceCreationEvent within 20 where TargetInstance ISA 'CIM_DirectoryContainsFile' " & _
    "and TargetInstance.GroupComponent='win32_directory.name=""c:\\\\testfolder""'"
set oevtsrc=svc.execnotificationquery(squery)
[blue]createobject("wscript.shell").run triggerfilespec,0,false	'hidden, asyn[/blue]
do while true
    set oevt = oevtsrc.nextevent
    if svc.get(oevt.TargetInstance.PartComponent).properties_("filesize")=0 then
    CreateSubmitEvent
    end if
    exit do    [blue]'detect only once or die at time expiry[/blue]
loop
set oevt=nothing
set oevtsrc=nothing
set svc=nothing
[red]Wscript.[/red]Quit

Sub CreateSubmitEvent
Dim oNewEvent
    Set     oNewEvent = ScriptContext.CreateEvent
        oNewEvent.Message = ("File of 0 Bytes in Size Discovered")
        oNewEvent.EventNumber = 9999
        oNewEvent.EventType = cError
ScriptContext.Submit(oNewEvent)
    Set     oNewEvent = Nothing
End Sub

The file can be generated dynamically within the script without independent preparation. But, that's another thing.

- tsuji

 

[bowwow]

Hi Tsuji

The above would be great except my code sits within an Agent configuration "field", and isnt running as a file on the disk. The script is run 'within' an Agent on the targeted server (part of an application called Microsoft Operations Manager, or MOM for short). Would it be possible to use some time integer, that exits after a certain count?

 

[tsuji]

bowwow,

Microsoft Support WebCast
Best practices for Microsoft Operations Manager, Service Pack 1
November 12, 2003​

... As you know, we support JScript®, VBScript, and actually any custom scripting engine. And you can run that response automatically, helping to resolve the problem, which, one, helps you reduce your mean time to resolution, and, two, saves your operator time to either work on projects or go look at some other critical alert that he or she is trying to finish....

ref

http://support.microsoft.com/?scid=...cedesks/webcasts/en/transcripts/wct111203.asp

Or you ask your money back.

- tsuji

 

[bowwow]

Hi Tsuji, ok I'll try and test this out first thing tomorrow.

On a slightly different issue, what is the best method of calculating the number of files within a folder? and then having that resulting numer avalaible for reuse?

Cheers
Andew

 

[tsuji]

Correction:

I cut and paste the script as you shown but forgot to a correction we covered. So the exit do still has to be placed within the if end-if in the latest version.
[tt]
if svc.get(oevt.TargetInstance.PartComponent).properties_("filesize")=0 then
CreateSubmitEvent
exit do 'detect only once or die at time expiry
end if
'[red]exit do 'detect only once or die at time expiry[/red]
[/tt]
- tsuji

 

[tsuji]

bowwow,

The number of files immediately under a folder (c:\testfolder) is this.
[tt]
n=createobject("scripting.filesystemobject").getfolder("c:\testfolder").files.count
[/tt]
Use any intermediate instance if avail, else, this is the one-liner version.

- tsuji

 

[bowwow]

Thanks again Tsuji, will have a play shortly, cheers!