WMI和MOF事件订阅 [英] WMI and MOF Event Subscription

问题描述

例如，我有这个mof文件:

For Example i have this mof file:

#pragma namespace ("\\\\.\\Root\\subscription")
instance of ActiveScriptEventConsumer as $CONSUMER
{
Name = "ExternalScriptConsumer";
ScriptingEngine = "VBScript";
ScriptFileName = "C:\\Consumer.vbs";
};
 
instance of __EventFilter as $FILTER
{
EventNamespace = "\\\\.\\Root\\Cimv2";
Name = "MyRemDevFilter2"; 
Query = "Select * From __InstanceDeletionEvent Within 2" 
"Where TargetInstance Isa \"Win32_Process\" "
"And Targetinstance.Name = \"notepad.exe\" ";
QueryLanguage = "WQL"; 
};
instance of __FilterToConsumerBinding
{
Consumer = $CONSUMER;
Filter = $FILTER;
};

这是我从mof文件中调用的Consumer.vbs:

And This is Consumer.vbs that i call from mof file:

strComputer = "."
strService = " ''Alerter'' "
 
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" _
& strComputer & "\root\cimv2")
Set colListOfServices = objWMIService.ExecQuery _
("Select * from Win32_Service Where Name ="_
& strService & " ")
For Each objService in colListOfServices
objService.StartService()
Next 

现在是一个问题.我尝试过将脚本Consumer.vbs写入$ CONSUMER中，例如以下示例:

And now a question. I was tried write a script Consumer.vbs into $CONSUMER like in this example:

instance of ActiveScriptEventConsumer as $Consumer
{
Name = "TestConsumer2";
ScriptingEngine = "VBScript";
ScriptText = 
"Set objFSO = CreateObject(\"Scripting.FileSystemObject\")\n"
"Set objFile = objFSO.OpenTextFile(\"c:\\log.txt\", 8, True)\n"
"objFile.WriteLine Time & \" \" & \" Notepad started stoped\"\n"
"objFile.Close\n";
};

但这是行不通的……也许是因为我的脚本也可以与WMI一起使用???谁能帮我?谢谢... ...

But it''s doesn''t work ... Maybe because my script work with WMI too ??? Can anyone help me? Thank''s ...

推荐答案

消费者 { 名称="ExternalScriptConsumer"; ScriptingEngine ="VBScript"; ScriptFileName ="C:\\ Consumer.vbs"; }; __EventFilter的实例为

CONSUMER { Name = "ExternalScriptConsumer"; ScriptingEngine = "VBScript"; ScriptFileName = "C:\\Consumer.vbs"; }; instance of __EventFilter as

FILTER { EventNamespace ="\\\\.\\ Root \\ Cimv2"; 名称="MyRemDevFilter2"; Query ="Select * From __InstanceDeletionEvent 2 在TargetInstance Isa \" Win32_Process \" 和Targetinstance.Name = \" notepad.exe \"; QueryLanguage ="WQL"; }; __FilterToConsumerBinding的实例 { 消费者=

FILTER { EventNamespace = "\\\\.\\Root\\Cimv2"; Name = "MyRemDevFilter2"; Query = "Select * From __InstanceDeletionEvent Within 2" "Where TargetInstance Isa \"Win32_Process\" " "And Targetinstance.Name = \"notepad.exe\" "; QueryLanguage = "WQL"; }; instance of __FilterToConsumerBinding { Consumer =

CONSUMER; 筛选=

CONSUMER; Filter =

这篇关于WMI和MOF事件订阅的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！