文中所介紹的監(jiān)控類型的WMI消費者主要為CommandLineEventConsumer、LogFileEventConsumer

創(chuàng)新互聯(lián)建站于2013年開始，先為武山等服務建站，武山等地企業(yè)，進行企業(yè)商務咨詢服務。為武山企業(yè)網(wǎng)站制作PC+手機+微官網(wǎng)三網(wǎng)同步一站式服務解決您的所有建站問題。

詳細介紹參閱以下鏈接：

CommandLineEventConsumer 

LogFileEventConsumer

下面以PowerShell腳本為例，介紹如何創(chuàng)建WMI事件監(jiān)控

一、LogFileEventConsumer示例

1、創(chuàng)建EventFilter，對需要監(jiān)控的事件進行過濾

${EventNamespace} = "the event namespace which is to be monitored"

${QueryLanguage} = 'WQL'

${Namespace}="root\subscription"

${ComputerName}="."

${Query}= "WQL Query Statement";

${Name}="EventFilter Name"

${NewFilter} = ([wmiclass]"\\${ComputerName}\${Namespace}:__EventFilter").CreateInstance()

${NewFilter}.{QueryLanguage} = ${QueryLanguage}

${NewFilter}.{Query} = ${Query}

${NewFilter}.{EventNamespace} = ${EventNamespace}

${NewFilter}.{Name} = ${Name}

$result = $NewFilter.Put()

2、創(chuàng)建Consumer，觸發(fā)相應的動作

${Text} ='the text which is to be logged'

${FileName}="FileName"

${IsUnicode}="true"

${ComputerName}="."

${Name}="EventConsumer Name";

${NewConsumer} = ([wmiclass]"\\${ComputerName}\root\subscription:LogFileEventConsumer").CreateInstance()

${NewConsumer}.{Name} = ${Name}

${NewConsumer}.{FileName} = ${FileName}

${NewConsumer}.{IsUnicode} = ${IsUnicode}

${NewConsumer}.{Text} = ${Text}

$NewConsumer.Put()

3、創(chuàng)建Binding，綁定EventFilter、Cousumer，使得事件被捕獲時立即觸發(fā)動作

${Namespace}="root\subscription"

${ComputerName}="."

${NewBinding} = ([wmiclass]"\\${ComputerName}\${Namespace}:__FilterToConsumerBinding").CreateInstance()

${NewBinding}.Filter = "\\${ComputerName}\ROOT\Subscription:__EventFilter.Name=`"EventFilter Name`""

${NewBinding}.{Consumer} ="\\${ComputerName}\ROOT\Subscription:LogFileEventConsumer.Name=`"EventConsumer Name`""

${NewBinding}.{MaintainSecurityContext} = ${FALSE}

${NewBinding}.{SlowDownProviders} = ${FALSE}

$NewBinding.Put()

二、CommandLineEventConsumer示例

1、創(chuàng)建EventFilter，對需要監(jiān)控的事件進行過濾

${EventNamespace} = "the event namespace which is to be monitored"

${QueryLanguage} = 'WQL'

${Namespace}="root\subscription"

${ComputerName}="."

${Query}= "WQL Query Statement";

${Name}="EventFilter Name"

${NewFilter} = ([wmiclass]"\\${ComputerName}\${Namespace}:__EventFilter").CreateInstance()

${NewFilter}.{QueryLanguage} = ${QueryLanguage}

${NewFilter}.{Query} = ${Query}

${NewFilter}.{EventNamespace} = ${EventNamespace}

${NewFilter}.{Name} = ${Name}

$result = $NewFilter.Put()

2、創(chuàng)建Consumer，觸發(fā)相應的動作(以執(zhí)行PowerShell命令行為例)

${Namespace}="root\subscription"

${ComputerName}="."

${Name}="EventConsumer Name";

$ExecutablePath="c:\xxx\xxx\powershell.exe"

$CommandLineTemplate="powershell.exe -File D:\xxx\xxx.ps1"

${NewConsumer} = ([wmiclass]"\\${ComputerName}\${Namespace}:CommandLineEventConsumer").CreateInstance()

${NewConsumer}.{CommandLineTemplate} = ${CommandLineTemplate}

${NewConsumer}.{ExecutablePath} = ${ExecutablePath}

${NewConsumer}.{name}=${Name}

$NewConsumer.Put()

3、創(chuàng)建Binding，綁定EventFilter、Cousumer，使得事件被捕獲時立即觸發(fā)動作

${Namespace}="root\subscription"

${ComputerName}="."

${NewBinding} = ([wmiclass]"\\${ComputerName}\${Namespace}:__FilterToConsumerBinding").CreateInstance()

${NewBinding}.Filter = "\\${ComputerName}\ROOT\Subscription:__EventFilter.Name=`"EventFilter Name`""

${NewBinding}.{Consumer} ="\\${ComputerName}\ROOT\Subscription:CommandLineEventConsumer.Name=`"EventConsumer Name`""

${NewBinding}.{MaintainSecurityContext} = ${FALSE}

${NewBinding}.{SlowDownProviders} = ${FALSE}

$NewBinding.Put()