Here is a script that will count file in a directory. If there is more than X file in the directory a event will be generated in the local event viewer. You can create a event rule that runs the script and a collection rule that collections event ID 2 from your machine. The local event will have event ID 2, you can also add criteria to check if description includes “There is more than”.

In the following example the script will monitor if C:\ have more than 2 files.

Set fs = CreateObject(“Scripting.FileSystemObject”)
folderName = “c:\”
numbers = fs.GetFolder(folderName).Files.Count
if (numbers > 2) Then
Const EVENT_WARNING = 2
Set objShell = CreateObject(“Wscript.Shell”)
objShell.LogEvent 2, “There are more than 2 files in the directory. The directory is ” & folderName & “. Number of files are ” & numbers  End If 

This is a script that will monitor if a process is running more that once, if it is this script will kill them and restart it.  This example check if notepad.exe is running more than twice.

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colProcesses = objWMIService.ExecQuery _
("Select * from Win32_Process Where Name = 'notepad.exe'")
'mineapp = "notepad.exe"
If colProcesses.Count => 2 Then
' Wscript.Echo mineapp & " is running 2 or more instances"
Set colProcessList = objWMIService.ExecQuery _
("Select * from Win32_Process Where Name = 'notepad.exe'")For Each objProcess in colProcessList
objProcess.Terminate()
Next

Sometimes it can be difficult to monitor a application. For example even if the application hand the process can still be there. A solution can be to monitor if the application still write anything to the logfile. I have written a simple VB script that will monitor that.

strComputer = "."
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objFile = objFSO.GetFile("c:\log.txt")
Const EVENT_WARNING = 2
Set objShell = CreateObject("Wscript.Shell")If DateDiff("n", objFile.DateLastModified, Now) > 1 Then
objShell.LogEvent EVENT_WARNING, _
"objFile is older than 4 hours. Please investigate. The file is: " & objFile
end If

If DateDiff("n", objFile.DateLastModified, Now) > 1 Then
This line is interesting. “n” menas minute, in this case an alert will be generated if the file haven’t been updated for a minute.
You can switch “n” to one of the following:

m – months
d – days
h – hours
n – minutes
s – seconds

If the file isent newer than your settings a event will be generated in the local event viewer. That event we can collect with MOM.

This line controlls which file to monitor
Set objFile = objFSO.GetFile("c:\log.txt")

How-to make MOM send alerts

• Insert the script into MOM
• Create a rule that monitor the event viewer
• Create a rule that runs the script

You insert the script as a VBscript in Administrator Console under
Administrator Console
-Management Packs
–Scripts

You dont have to create any parameters for that script.

Create a new computer group and add you server to that group. Create a new rule group and associate your new computer group with that rule group. Under event rules create a new rule with the following settings

Data Provider> Provider name: Application
Data Provider> Windows NT Event log
Criteria> From source: WSH
Criteria> of type: Warning
Alert: markGenerate alert

Then one more rule that will run the script

Data Provider> Choose a time provider with a suitable time, or create a new (Modify…) 
Responses> Add your script (Add -> Launch a script)

That should do it. Note that it can take some minutes before the new rules works.