文中所介紹的監(jiān)控類型的WMI消費(fèi)者主要為CommandLineEventConsumer、LogFileEventConsumer

讓客戶滿意是我們工作的目標(biāo)，不斷超越客戶的期望值來自于我們對(duì)這個(gè)行業(yè)的熱愛。我們立志把好的技術(shù)通過有效、簡(jiǎn)單的方式提供給客戶，將通過不懈努力成為客戶在信息化領(lǐng)域值得信任、有價(jià)值的長(zhǎng)期合作伙伴，公司提供的服務(wù)項(xiàng)目有：空間域名、網(wǎng)頁空間、營(yíng)銷軟件、網(wǎng)站建設(shè)、樺甸網(wǎng)站維護(hù)、網(wǎng)站推廣。

詳細(xì)介紹參閱以下鏈接：

CommandLineEventConsumer

LogFileEventConsumer

下面以PowerShell腳本為例，介紹如何創(chuàng)建WMI事件監(jiān)控

一、LogFileEventConsumer示例

1、創(chuàng)建EventFilter，對(duì)需要監(jiān)控的事件進(jìn)行過濾

${EventNamespace} = "the event namespace which is to be monitored"

${QueryLanguage} = 'WQL'

${Namespace}="root\subscription"

${ComputerName}="."

${Query}= "WQL Query Statement";

${Name}="EventFilter Name"

${NewFilter} = ([wmiclass]"\\${ComputerName}\${Namespace}:__EventFilter").CreateInstance()

${NewFilter}.{QueryLanguage} = ${QueryLanguage}

${NewFilter}.{Query} = ${Query}

${NewFilter}.{EventNamespace} = ${EventNamespace}

${NewFilter}.{Name} = ${Name}

$result = $NewFilter.Put()

2、創(chuàng)建Consumer，觸發(fā)相應(yīng)的動(dòng)作

${Text} ='the text which is to be logged'

${FileName}="FileName"

${IsUnicode}="true"

${ComputerName}="."

${Name}="EventConsumer Name";

${NewConsumer} = ([wmiclass]"\\${ComputerName}\root\subscription:LogFileEventConsumer").CreateInstance()

${NewConsumer}.{Name} = ${Name}

${NewConsumer}.{FileName} = ${FileName}

${NewConsumer}.{IsUnicode} = ${IsUnicode}

${NewConsumer}.{Text} = ${Text}

$NewConsumer.Put()

3、創(chuàng)建Binding，綁定EventFilter、Cousumer，使得事件被捕獲時(shí)立即觸發(fā)動(dòng)作

${Namespace}="root\subscription"

${ComputerName}="."

${NewBinding} = ([wmiclass]"\\${ComputerName}\${Namespace}:__FilterToConsumerBinding").CreateInstance()

${NewBinding}.Filter = "\\${ComputerName}\ROOT\Subscription:__EventFilter.Name=`"EventFilter Name`""

${NewBinding}.{Consumer} ="\\${ComputerName}\ROOT\Subscription:LogFileEventConsumer.Name=`"EventConsumer Name`""

${NewBinding}.{MaintainSecurityContext} = ${FALSE}

${NewBinding}.{SlowDownProviders} = ${FALSE}

$NewBinding.Put()

二、CommandLineEventConsumer示例

1、創(chuàng)建EventFilter，對(duì)需要監(jiān)控的事件進(jìn)行過濾

${EventNamespace} = "the event namespace which is to be monitored"

${QueryLanguage} = 'WQL'

${Namespace}="root\subscription"

${ComputerName}="."

${Query}= "WQL Query Statement";

${Name}="EventFilter Name"

${NewFilter} = ([wmiclass]"\\${ComputerName}\${Namespace}:__EventFilter").CreateInstance()

${NewFilter}.{QueryLanguage} = ${QueryLanguage}

${NewFilter}.{Query} = ${Query}

${NewFilter}.{EventNamespace} = ${EventNamespace}

${NewFilter}.{Name} = ${Name}

$result = $NewFilter.Put()

2、創(chuàng)建Consumer，觸發(fā)相應(yīng)的動(dòng)作(以執(zhí)行PowerShell命令行為例)

${Namespace}="root\subscription"

${ComputerName}="."

${Name}="EventConsumer Name";

$ExecutablePath="c:\xxx\xxx\powershell.exe"

$CommandLineTemplate="powershell.exe -File D:\xxx\xxx.ps1"

${NewConsumer} = ([wmiclass]"\\${ComputerName}\${Namespace}:CommandLineEventConsumer").CreateInstance()

${NewConsumer}.{CommandLineTemplate} = ${CommandLineTemplate}

${NewConsumer}.{ExecutablePath} = ${ExecutablePath}

${NewConsumer}.{name}=${Name}

$NewConsumer.Put()

3、創(chuàng)建Binding，綁定EventFilter、Cousumer，使得事件被捕獲時(shí)立即觸發(fā)動(dòng)作

${Namespace}="root\subscription"

${ComputerName}="."

${NewBinding} = ([wmiclass]"\\${ComputerName}\${Namespace}:__FilterToConsumerBinding").CreateInstance()

${NewBinding}.Filter = "\\${ComputerName}\ROOT\Subscription:__EventFilter.Name=`"EventFilter Name`""

${NewBinding}.{Consumer} ="\\${ComputerName}\ROOT\Subscription:CommandLineEventConsumer.Name=`"EventConsumer Name`""

${NewBinding}.{MaintainSecurityContext} = ${FALSE}

${NewBinding}.{SlowDownProviders} = ${FALSE}

$NewBinding.Put()

另外有需要云服務(wù)器可以了解下創(chuàng)新互聯(lián)scvps.cn，海內(nèi)外云服務(wù)器15元起步，三天無理由+7*72小時(shí)售后在線，公司持有idc許可證，提供“云服務(wù)器、裸金屬服務(wù)器、高防服務(wù)器、香港服務(wù)器、美國服務(wù)器、虛擬主機(jī)、免備案服務(wù)器”等云主機(jī)租用服務(wù)以及企業(yè)上云的綜合解決方案，具有“安全穩(wěn)定、簡(jiǎn)單易用、服務(wù)可用性高、性價(jià)比高”等特點(diǎn)與優(yōu)勢(shì)，專為企業(yè)上云打造定制，能夠滿足用戶豐富、多元化的應(yīng)用場(chǎng)景需求。

名稱欄目：MSSQL/WMI/PowerShell結(jié)合篇（二）創(chuàng)建WMI監(jiān)控-創(chuàng)新互聯(lián)
網(wǎng)址分享：http://weahome.cn/article/ddipoe.html