WQL query for monitoring file change

Question

I need some help since I am new to WMI Events. I am trying to write WQL query for monitoring any changes that occure in a file that is placed in specific folder(C:\Data) I come up with the following query,but WMIEvent never occures.

SELECT * FROM __InstanceModificationEvent WITHIN 1 WHERE TargetInstance ISA "CIM_DataFile" AND TargetInstance.Drive="C:" AND TargetInstance.Path="\\Data"

Please can you provide me any feedback, what I do wrong or if you know other way to query for file changes I'll appreciate it as well :)

I have a similar problem. I find the event only fires if I delete and recreate the file. If I just overwrite it or modify it, the event wont' fire. — sqlconsumer.net, Oct 05 '15 at 15:04

Scott Willeke · Answer 1 · 2009-01-27T15:29:13.193

I think the problem is that you didn't double up the \ characters in your query. \ is a reserved character in WQL so you must use \ instead. Below is the VBScipt I used and was able to get working. I hope this is helpful!

Main

Sub Main()

    WScript.Echo "Initializing WMI..."

    strComputer = "." 
    Set objWMIService = GetObject("winmgmts:\\" & _
        strComputer & "\root\CIMV2") 
    Set EventSink = WScript.CreateObject( _
        "WbemScripting.SWbemSink","SINK_")

    WScript.Echo "WMI Initialized."

    query = "SELECT * FROM __InstanceModificationEvent WITHIN 1 WHERE TargetInstance ISA 'CIM_DataFile' AND TargetInstance.Path='\\data\\'"

    WScript.Echo "Executing Query..."
    set results = objWMIservice.ExecNotificationQuery(query)
    WScript.Echo "Query Returned."

    Do
        WScript.Echo "Waiting on events..."
        Set evt = results.NextEvent
        WScript.Echo "Modified Path:" + evt.TargetInstance.Path
        WScript.Echo "Modified Path:" + evt.TargetInstance.Name
    Loop
End Sub

You might also be interested in looking at using the FileSystemWatcher via some .NET language (such as VB.NET or C#) to do the same.

WQL query for monitoring file change

1 Answers1