MSSQL/WMI/PowerShell結(jié)合篇（二）創(chuàng)建WMI監(jiān)控

文中所介紹的監(jiān)控類型的WMI消費者主要為CommandLineEventConsumer、LogFileEventConsumer

詳細(xì)介紹參閱以下鏈接：

CommandLineEventConsumer 

LogFileEventConsumer

下面以PowerShell腳本為例，介紹如何創(chuàng)建WMI事件監(jiān)控

一、LogFileEventConsumer示例

1、創(chuàng)建EventFilter，對需要監(jiān)控的事件進(jìn)行過濾

${EventNamespace} = "the event namespace which is to be monitored"

${QueryLanguage} = 'WQL'

${Namespace}="root\subscription"

${ComputerName}="."

${Query}= "WQL Query Statement";

${Name}="EventFilter Name"

${NewFilter} = ([wmiclass]"\\${ComputerName}\${Namespace}:__EventFilter").CreateInstance()

${NewFilter}.{QueryLanguage} = ${QueryLanguage}

${NewFilter}.{Query} = ${Query}

${NewFilter}.{EventNamespace} = ${EventNamespace}

${NewFilter}.{Name} = ${Name}

$result = $NewFilter.Put()

2、創(chuàng)建Consumer，觸發(fā)相應(yīng)的動作

${Text} ='the text which is to be logged'

${FileName}="FileName"

${IsUnicode}="true"

${ComputerName}="."

${Name}="EventConsumer Name";

${NewConsumer} = ([wmiclass]"\\${ComputerName}\root\subscription:LogFileEventConsumer").CreateInstance()

${NewConsumer}.{Name} = ${Name}

${NewConsumer}.{FileName} = ${FileName}

${NewConsumer}.{IsUnicode} = ${IsUnicode}

${NewConsumer}.{Text} = ${Text}

$NewConsumer.Put()

3、創(chuàng)建Binding，綁定EventFilter、Cousumer，使得事件被捕獲時立即觸發(fā)動作

${Namespace}="root\subscription"

${ComputerName}="."

${NewBinding} = ([wmiclass]"\\${ComputerName}\${Namespace}:__FilterToConsumerBinding").CreateInstance()

${NewBinding}.Filter = "\\${ComputerName}\ROOT\Subscription:__EventFilter.Name=`"EventFilter Name`""

${NewBinding}.{Consumer} ="\\${ComputerName}\ROOT\Subscription:LogFileEventConsumer.Name=`"EventConsumer Name`""

${NewBinding}.{MaintainSecurityContext} = ${FALSE}

${NewBinding}.{SlowDownProviders} = ${FALSE}

$NewBinding.Put()

二、CommandLineEventConsumer示例

1、創(chuàng)建EventFilter，對需要監(jiān)控的事件進(jìn)行過濾

${EventNamespace} = "the event namespace which is to be monitored"

${QueryLanguage} = 'WQL'

${Namespace}="root\subscription"

${ComputerName}="."

${Query}= "WQL Query Statement";

${Name}="EventFilter Name"

${NewFilter} = ([wmiclass]"\\${ComputerName}\${Namespace}:__EventFilter").CreateInstance()

${NewFilter}.{QueryLanguage} = ${QueryLanguage}

${NewFilter}.{Query} = ${Query}

${NewFilter}.{EventNamespace} = ${EventNamespace}

${NewFilter}.{Name} = ${Name}

$result = $NewFilter.Put()

2、創(chuàng)建Consumer，觸發(fā)相應(yīng)的動作(以執(zhí)行PowerShell命令行為例)

${Namespace}="root\subscription"

${ComputerName}="."

${Name}="EventConsumer Name";

$ExecutablePath="c:\xxx\xxx\powershell.exe"

$CommandLineTemplate="powershell.exe -File D:\xxx\xxx.ps1"

${NewConsumer} = ([wmiclass]"\\${ComputerName}\${Namespace}:CommandLineEventConsumer").CreateInstance()

${NewConsumer}.{CommandLineTemplate} = ${CommandLineTemplate}

${NewConsumer}.{ExecutablePath} = ${ExecutablePath}

${NewConsumer}.{name}=${Name}

$NewConsumer.Put()

3、創(chuàng)建Binding，綁定EventFilter、Cousumer，使得事件被捕獲時立即觸發(fā)動作

${Namespace}="root\subscription"

${ComputerName}="."

${NewBinding} = ([wmiclass]"\\${ComputerName}\${Namespace}:__FilterToConsumerBinding").CreateInstance()

${NewBinding}.Filter = "\\${ComputerName}\ROOT\Subscription:__EventFilter.Name=`"EventFilter Name`""

${NewBinding}.{Consumer} ="\\${ComputerName}\ROOT\Subscription:CommandLineEventConsumer.Name=`"EventConsumer Name`""

${NewBinding}.{MaintainSecurityContext} = ${FALSE}

${NewBinding}.{SlowDownProviders} = ${FALSE}

$NewBinding.Put()