none
Monitorar Arquivos RRS feed

  • Pergunta

  • Gostaria de saber se existe um script para monitorar alterações em uma pasta e subpastas assim como seus devidos arquivos e gerasse um arquivo log com as informações de data e usuario que fez a modificação como criar ou deletar uma pasta ou arquivos e subpastas.
    sexta-feira, 9 de julho de 2010 14:41

Respostas

  • Existe.

    How to monitoring folder files by vbs

    http://stackoverflow.com/questions/10041057/how-to-monitoring-folder-files-by-vbs

    Exemplo:

    sPath = "C:\scripts\test"
    sComputer = "."
    sDrive = split(sPath,":")(0)
    sFolders1 = split(sPath,":")(1)
    sFolders = REPLACE(sFolders1, "\", "\\") & "\\"
    
    'SELECT * FROM __InstanceOperationEvent WITHIN 1 WHERE TargetInstance ISA 'CIM_DataFile' 
    'AND TargetInstance.Drive='E:' AND 
    'TargetInstance.Path='\\trials\\SoTrials\\answers\\10041057\\data\\'
    ' AND TargetInstance.Extension = 'txt'
    
    Set objWMIService = GetObject("winmgmts:\\" & sComputer & "\root\cimv2")
    Set colMonitoredEvents = objWMIService.ExecNotificationQuery _
    ("SELECT * FROM __InstanceOperationEvent WITHIN 1 WHERE " _
    & "TargetInstance ISA 'CIM_DataFile' AND " _
    & "TargetInstance.Drive='" & sDrive & "' AND " _
    & "TargetInstance.Path='" & sFolders & "' AND " _
    & "TargetInstance.Extension = 'txt' ")
    
    Wscript.Echo vbCrlf & Now & vbTab & _
    "Begin Monitoring for a Folder " & sDrive & ":" & sFolders1 & " Change Event..." & vbCrlf
    
    Do
        Set objLatestEvent = colMonitoredEvents.NextEvent
        Select Case objLatestEvent.Path_.Class
    
        Case "__InstanceCreationEvent"
        WScript.Echo Now & vbTab & objLatestEvent.TargetInstance.FileName & "." & objLatestEvent.TargetInstance.Extension _
        & " was created" & vbCrlf
    
        Case "__InstanceDeletionEvent"
        WScript.Echo Now & vbTab & objLatestEvent.TargetInstance.FileName & "." & objLatestEvent.TargetInstance.Extension _
        & " was deleted" & vbCrlf
    
        Case "__InstanceModificationEvent"
        If objLatestEvent.TargetInstance.LastModified <> _
        objLatestEvent.PreviousInstance.LastModified then
        WScript.Echo Now & vbTab & objLatestEvent.TargetInstance.FileName & "." & objLatestEvent.TargetInstance.Extension _
        & " was modified" & vbCrlf
        End If
        End Select
    Loop
    
    Set objWMIService = nothing
    Set colMonitoredEvents = nothing
    Set objLatestEvent = nothing

    Outra forma, que eu acho mais segura, é você habilitar os logs de auditoria de arquivos e ler o eventos gerados.

    ---------------------------

    Mutirão de Respostas

    ---------------------------


    Fábio de Paula Junior


    terça-feira, 19 de novembro de 2013 13:27
    Moderador