文中所介紹的監(jiān)控類型的WMI消費(fèi)者主要為CommandLineEventConsumer、LogFileEventConsumer

創(chuàng)新互聯(lián)建站于2013年開始，先為武山等服務(wù)建站，武山等地企業(yè)，進(jìn)行企業(yè)商務(wù)咨詢服務(wù)。為武山企業(yè)網(wǎng)站制作PC+手機(jī)+微官網(wǎng)三網(wǎng)同步一站式服務(wù)解決您的所有建站問題。

詳細(xì)介紹參閱以下鏈接：

CommandLineEventConsumer 

LogFileEventConsumer

下面以PowerShell腳本為例，介紹如何創(chuàng)建WMI事件監(jiān)控

一、LogFileEventConsumer示例

1、創(chuàng)建EventFilter，對需要監(jiān)控的事件進(jìn)行過濾

${EventNamespace} = "the event namespace which is to be monitored"

${QueryLanguage} = 'WQL'

${Namespace}="root\subscription"

${ComputerName}="."

${Query}= "WQL Query Statement";

${Name}="EventFilter Name"

${NewFilter} = ([wmiclass]"\\${ComputerName}\${Namespace}:__EventFilter").CreateInstance()

${NewFilter}.{QueryLanguage} = ${QueryLanguage}

${NewFilter}.{Query} = ${Query}

${NewFilter}.{EventNamespace} = ${EventNamespace}

${NewFilter}.{Name} = ${Name}

$result = $NewFilter.Put()

2、創(chuàng)建Consumer，觸發(fā)相應(yīng)的動(dòng)作

${Text} ='the text which is to be logged'

${FileName}="FileName"

${IsUnicode}="true"

${ComputerName}="."

${Name}="EventConsumer Name";

${NewConsumer} = ([wmiclass]"\\${ComputerName}\root\subscription:LogFileEventConsumer").CreateInstance()

${NewConsumer}.{Name} = ${Name}

${NewConsumer}.{FileName} = ${FileName}

${NewConsumer}.{IsUnicode} = ${IsUnicode}

${NewConsumer}.{Text} = ${Text}

$NewConsumer.Put()

3、創(chuàng)建Binding，綁定EventFilter、Cousumer，使得事件被捕獲時(shí)立即觸發(fā)動(dòng)作

${Namespace}="root\subscription"

${ComputerName}="."

${NewBinding} = ([wmiclass]"\\${ComputerName}\${Namespace}:__FilterToConsumerBinding").CreateInstance()

${NewBinding}.Filter = "\\${ComputerName}\ROOT\Subscription:__EventFilter.Name=`"EventFilter Name`""

${NewBinding}.{Consumer} ="\\${ComputerName}\ROOT\Subscription:LogFileEventConsumer.Name=`"EventConsumer Name`""

${NewBinding}.{MaintainSecurityContext} = ${FALSE}

${NewBinding}.{SlowDownProviders} = ${FALSE}

$NewBinding.Put()

二、CommandLineEventConsumer示例

1、創(chuàng)建EventFilter，對需要監(jiān)控的事件進(jìn)行過濾

${EventNamespace} = "the event namespace which is to be monitored"

${QueryLanguage} = 'WQL'

${Namespace}="root\subscription"

${ComputerName}="."

${Query}= "WQL Query Statement";

${Name}="EventFilter Name"

${NewFilter} = ([wmiclass]"\\${ComputerName}\${Namespace}:__EventFilter").CreateInstance()

${NewFilter}.{QueryLanguage} = ${QueryLanguage}

${NewFilter}.{Query} = ${Query}

${NewFilter}.{EventNamespace} = ${EventNamespace}

${NewFilter}.{Name} = ${Name}

$result = $NewFilter.Put()

2、創(chuàng)建Consumer，觸發(fā)相應(yīng)的動(dòng)作(以執(zhí)行PowerShell命令行為例)

${Namespace}="root\subscription"

${ComputerName}="."

${Name}="EventConsumer Name";

$ExecutablePath="c:\xxx\xxx\powershell.exe"

$CommandLineTemplate="powershell.exe -File D:\xxx\xxx.ps1"

${NewConsumer} = ([wmiclass]"\\${ComputerName}\${Namespace}:CommandLineEventConsumer").CreateInstance()

${NewConsumer}.{CommandLineTemplate} = ${CommandLineTemplate}

${NewConsumer}.{ExecutablePath} = ${ExecutablePath}

${NewConsumer}.{name}=${Name}

$NewConsumer.Put()

3、創(chuàng)建Binding，綁定EventFilter、Cousumer，使得事件被捕獲時(shí)立即觸發(fā)動(dòng)作

${Namespace}="root\subscription"

${ComputerName}="."

${NewBinding} = ([wmiclass]"\\${ComputerName}\${Namespace}:__FilterToConsumerBinding").CreateInstance()

${NewBinding}.Filter = "\\${ComputerName}\ROOT\Subscription:__EventFilter.Name=`"EventFilter Name`""

${NewBinding}.{Consumer} ="\\${ComputerName}\ROOT\Subscription:CommandLineEventConsumer.Name=`"EventConsumer Name`""

${NewBinding}.{MaintainSecurityContext} = ${FALSE}

${NewBinding}.{SlowDownProviders} = ${FALSE}

$NewBinding.Put()

新聞名稱：MSSQL/WMI/PowerShell結(jié)合篇（二）創(chuàng)建WMI監(jiān)控
URL鏈接：http://aaarwkj.com/article48/peejep.html

成都網(wǎng)站建設(shè)公司_創(chuàng)新互聯(lián)，為您提供定制開發(fā)、面包屑導(dǎo)航、動(dòng)態(tài)網(wǎng)站、企業(yè)網(wǎng)站制作、App開發(fā)、移動(dòng)網(wǎng)站建設(shè)

廣告

聲明：本網(wǎng)站發(fā)布的內(nèi)容（圖片、視頻和文字）以用戶投稿、用戶轉(zhuǎn)載內(nèi)容為主，如果涉及侵權(quán)請盡快告知，我們將會在第一時(shí)間刪除。文章觀點(diǎn)不代表本網(wǎng)站立場，如需處理請聯(lián)系客服。電話：028-86922220；郵箱：631063699@qq.com。內(nèi)容未經(jīng)允許不得轉(zhuǎn)載，或轉(zhuǎn)載時(shí)需注明來源： 創(chuàng)新互聯(lián)