{"id":41,"date":"2006-06-16T09:51:18","date_gmt":"2006-06-16T07:51:18","guid":{"rendered":"http:\/\/contoso.se\/blog\/?p=41"},"modified":"2006-12-28T16:26:24","modified_gmt":"2006-12-28T14:26:24","slug":"overvaka-modifiering-av-en-fil","status":"publish","type":"post","link":"http:\/\/contoso.se\/blog\/?p=41","title":{"rendered":"Monitor File Modification"},"content":{"rendered":"<p class=\"MsoNormal\" style=\"margin: 0cm 0cm 10pt\"><font face=\"Calibri\" size=\"3\">Sometimes it can be difficult to monitor a application. For example even if the application hand the process can still be there. A solution can be to monitor if the application still write anything to the logfile. I have written a simple VB script that will monitor that.<\/font><\/p>\n<p><code>strComputer = \".\"<br \/>\nSet objFSO = CreateObject(\"Scripting.FileSystemObject\")<br \/>\nSet objFile = objFSO.GetFile(\"c:\\log.txt\")<br \/>\nConst EVENT_WARNING = 2<br \/>\nSet objShell = CreateObject(\"Wscript.Shell\")<\/code><code>If DateDiff(\"n\", objFile.DateLastModified, Now) > 1 Then<br \/>\nobjShell.LogEvent EVENT_WARNING, _<br \/>\n\"objFile is older than 4 hours. Please investigate. The file is: \" & objFile<br \/>\nend If<\/p>\n<p><\/code><code>If DateDiff(\"n\", objFile.DateLastModified, Now) > 1 Then <\/code><br \/>\nThis line is interesting. &#8220;n&#8221;\u00c2\u00a0menas minute, in this case an alert will be generated if the file haven&#8217;t been updated for a minute.<br \/>\nYou can switch &#8220;n&#8221; to one of the following:<\/p>\n<p>m &#8211; months<br \/>\nd &#8211; days<br \/>\nh &#8211; hours<br \/>\nn &#8211; minutes<br \/>\ns &#8211; seconds<\/p>\n<p>If the file isent newer than your settings a event will be generated in the local event viewer. That event we can collect with MOM.<\/p>\n<p>This line controlls which file to monitor<br \/>\n<code>Set objFile = objFSO.GetFile(\"c:\\log.txt\")<\/code><\/p>\n<p>How-to make MOM send alerts<\/p>\n<ul>\n<li>Insert the script into MOM<\/li>\n<li>Create a rule that monitor the event viewer<\/li>\n<li>Create a rule that runs the script<\/li>\n<\/ul>\n<p>You insert the script as a VBscript in Administrator Console under<br \/>\nAdministrator Console<br \/>\n-Management Packs<br \/>\n&#8211;Scripts<\/p>\n<p>You dont have to create any parameters for that script.<\/p>\n<p>Create a new computer group and add you server to that group. Create a new rule group and associate your new computer group with that rule group. Under event rules create a new rule with the following settings<\/p>\n<p>Data Provider> Provider name: Application<br \/>\nData Provider> Windows NT Event log<br \/>\nCriteria> From source: WSH<br \/>\nCriteria> of type: Warning<br \/>\nAlert: markGenerate alert<\/p>\n<p>Then one more rule that will run the script<\/p>\n<p>Data Provider>\u00c2\u00a0Choose a\u00c2\u00a0time provider\u00c2\u00a0with a suitable time, or create a new\u00c2\u00a0(Modify&#8230;)\u00c2\u00a0<br \/>\nResponses>\u00c2\u00a0Add your script\u00c2\u00a0(Add -> Launch a script)<\/p>\n<p>That should do it. Note that it can take some minutes before the new rules works.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Sometimes it can be difficult to monitor a application. For example even if the application hand the process can still be there. A solution can be to monitor if the application still write anything to the logfile. I have written a simple VB script that will monitor that. strComputer = &#8220;.&#8221; Set objFSO = CreateObject(&#8220;Scripting.FileSystemObject&#8221;) &hellip; <a href=\"http:\/\/contoso.se\/blog\/?p=41\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[2,13],"tags":[],"_links":{"self":[{"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/41"}],"collection":[{"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=41"}],"version-history":[{"count":0,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/41\/revisions"}],"wp:attachment":[{"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}