WQL query for monitoring file change

Question

Hi Guys, I need some help since I am new to WMI Events. I am trying to write WQL query for monitoring any changes that occure in a file that is placed in specific folder(C:\Data) I come up with the following query,but WMIEvent never occures.

SELECT * FROM __InstanceModificationEvent WITHIN 1 WHERE TargetInstance ISA "CIM_DataFile" AND TargetInstance.Drive="C:" AND TargetInstance.Path="\Data"

Please can you provide me any feedback, what I do wrong or if you know other way to query for file changes I'll appreciate it as well :)

Thanks in advance

Answer 1

I think the problem is that you didn't double up the \ characters in your query. \ is a reserved character in WQL so you must use \ instead. Below is the VBScipt I used and was able to get working. I hope this is helpful!

Main

Sub Main()

    WScript.Echo "Initializing WMI..."

    strComputer = "." 
    Set objWMIService = GetObject("winmgmts:\\" & _
     strComputer & "\root\CIMV2") 
    Set EventSink = WScript.CreateObject( _
     "WbemScripting.SWbemSink","SINK_")

    WScript.Echo "WMI Initialized."

    query = "SELECT * FROM __InstanceModificationEvent WITHIN 1 WHERE TargetInstance ISA 'CIM_DataFile' AND TargetInstance.Path='\\data\\'"

    WScript.Echo "Executing Query..."
    set results = objWMIservice.ExecNotificationQuery(query)
    WScript.Echo "Query Returned."

    Do
     WScript.Echo "Waiting on events..."
     Set evt = results.NextEvent
     WScript.Echo "Modified Path:" + evt.TargetInstance.Path
     WScript.Echo "Modified Path:" + evt.TargetInstance.Name
    Loop
End Sub

You might also be interested in looking at using the FileSystemWatcher via some .NET language (such as VB.NET or C#) to do the same.