WMI intrinsic events is not work

hi!

i try monitor service state through wmi intrinsic events. purpose have made next vbs scripts:

'wmi event filter creation script   option explicit  on error resume next    dim strcomputer            dim strnamespace           dim objservice             dim objeventfilterclass    dim objeventfilter           strcomputer = "."  strnamespace = "root\cimv2"    set objservice = getobject("winmgmts:\\" &  strcomputer & "\" & strnamespace)    set objeventfilterclass = objservice.get("__eventfilter")  set objeventfilter = objeventfilterclass.spawninstance_()    objeventfilter.name = "monitoringservices"  objeventfilter.querylanguage = "wql"  objeventfilter.query = "select * __instancemodificationevent within 1 targetinstance isa 'win32_service'"  

objeventfilter.put_()  

 

'event consumer creation script  option explicit  on error resume next    dim strcomputer           dim strnamespace   dim objservice             dim objconsumerclass   dim objconsumer             strcomputer = "."  strnamespace = "root\subscription"    set objservice = getobject("winmgmts:\\" & strcomputer & "\" & strnamespace)  set objconsumerclass = objservice.get("logfileeventconsumer")    set objconsumer = objconsumerclass.spawninstance_()    objconsumer.name = "servicelog"  objconsumer.filename = "c:\temp\logservice.txt"  objconsumer.text = "service %targetinstance.displayname% %targetinstance.state%"  objconsumer.put_()  

'binding filter consumer  option explicit  on error resume next    dim strcomputer           dim strnamespace        dim objservice             dim objeventfilter         dim objconsumer            dim objbindingclass    dim objbindinginstance       strcomputer = "."  strnamespace = "root\cimv2"    set objservice = getobject("winmgmts:\\" & strcomputer & "\" & strnamespace)  set objeventfilter = objservice.get("__eventfilter.name='monitoringservices'")    strnamespace = "root\subscription"  set objservice = getobject("winmgmts:\\" & strcomputer & "\" & strnamespace)    set objconsumer = objservice.get("logfileeventconsumer.name=""servicelog""")    set objbindingclass = objservice.get("__filtertoconsumerbinding")  set objbindinginstance = objbindingclass.spawninstance_()    objbindinginstance.filter =  objeventfilter.path_  objbindinginstance.consumer = objconsumer.path_  objbindinginstance.put_()  

when run scripts - right , don't see errors. objects present.

 

ps c:\windows\system32> get-wmiobject -class __eventfilter      __genus          : 2  __class          : __eventfilter  __superclass     : __indicationrelated  __dynasty        : __systemclass  __relpath        : __eventfilter.name="monitoringservices"  __property_count : 6  __derivation     : {__indicationrelated, __systemclass}  __server         : n937  __namespace      : root\cimv2  __path           : \\n937\root\cimv2:__eventfilter.name="monitoringservices"  creatorsid       : {1, 5, 0, 0...}  eventaccess      :  eventnamespace   :  name             : monitoringservices  query            : select * __instancemodificationevent within 1 targetinstance isa 'win32_service'  querylanguage    : wql  

ps c:\windows\system32> get-wmiobject -namespace root\subscription -class logfileeventconsumer      __genus          : 2  __class          : logfileeventconsumer  __superclass     : __eventconsumer  __dynasty        : __systemclass  __relpath        : logfileeventconsumer.name="servicelog"  __property_count : 8  __derivation     : {__eventconsumer, __indicationrelated, __systemclass}  __server         : n937  __namespace      : root\subscription  __path           : \\n937\root\subscription:logfileeventconsumer.name="servicelog"  creatorsid       : {1, 5, 0, 0...}  filename         : c:\temp\logservice.txt  isunicode        :  machinename      :  maximumfilesize  : 65535  maximumqueuesize :  name             : servicelog  text             : Служба %targetinstance.displayname% перешла в состояние %targetinstance.state%  

ps c:\windows\system32> get-wmiobject -namespace root\subscription -class __filtertoconsumerbinding | {$_.filter -  eq '\\n937\root\cimv2:__eventfilter.name="monitoringservices"'}      __genus                 : 2  __class                 : __filtertoconsumerbinding  __superclass            : __indicationrelated  __dynasty               : __systemclass  __relpath               : __filtertoconsumerbinding.consumer="\\\\n937\\root\\subscription:logfileeventconsumer.name=\"                            servicelog\"",filter="\\\\n937\\root\\cimv2:__eventfilter.name=\"monitoringservices\""  __property_count        : 7  __derivation            : {__indicationrelated, __systemclass}  __server                : n937  __namespace             : root\subscription  __path                  : \\n937\root\subscription:__filtertoconsumerbinding.consumer="\\\\n937\\root\\subscription:log                            fileeventconsumer.name=\"servicelog\"",filter="\\\\n937\\root\\cimv2:__eventfilter.name=\"mon                            itoringservices\""  consumer                : \\n937\root\subscription:logfileeventconsumer.name="servicelog"  creatorsid              : {1, 5, 0, 0...}  deliversynchronously    : false  deliveryqos             :  filter                  : \\n937\root\cimv2:__eventfilter.name="monitoringservices"  maintainsecuritycontext : false  slowdownproviders       : false  

when try restart service on computer (computername: n937) - c:\temp\logservice.txt doesn't appear.

how make service monitoring through wmi events correctly ?

---

andy mishechkin

  strnamespace = "root\subscription"  set objservice = getobject("winmgmts:\\" &  strcomputer & "\" & strnamespace)  set objeventfilterclass = objservice.get("__eventfilter") set objeventfilter = objeventfilterclass.spawninstance_()  objeventfilter.name = "monitoringservices" objeventfilter.querylanguage = "wql" objeventfilter.query = "select * __instancemodificationevent within 1 targetinstance isa 'win32_service'" objeventfilter.eventnamespace = "root\cimv2"   objeventfilter.put_()  

Windows Server  >  Windows PowerShell