Use PowerShell to Monitor for the Creation of New Files

re: Use PowerShell to Monitor for the Creation of New Files

Ed Wilson — Wed, 25 Jul 2012 16:45:11 GMT

@K_Schulte Yes, I like the .NET Filesystem watcher, and have written some PowerShell scripts using it. Finding this stuff? Well as you said it is documented in MSDN, and in my WMI book. A blog is also documentation? Right? But one of the great things about PowerShell is that it is self discovering, and it also makes it easy to take an idea and test it out. In the old days, when you had to horribly complicated VBScripts it did not make it possible to experiment to easily.

re: Use PowerShell to Monitor for the Creation of New Files

K_Schulte — Wed, 25 Jul 2012 13:55:07 GMT

Hi Ed,

I've already seen this kind of FileSystemWatcher ( which is a .Net framework object that could be used to watch file events) using WMI somewhere on this blog before. Maybe I remember the old VBScript version but I'm not that sure ... I didn't find it by now :-)

Anyway ... it's great what we can do with WMI events and I'm sure that is much more to find out.

But the difficulty is "how to find out what we can do and how it could be done" ( I'm sure that there will be some documentation on MSDN or other sites ... but I hardly would ever guessed how to associate the classes and what the required classes are. This is the hardest part.

The "$fileEvent.SourceEventArgs.NewEvent.TargetInstance.PartComponent" is such a thing.

Who would ever have found out, that this is the way to get at the name of the newly created file !?

This is the voodoo part of it ... (un)Registering and waiting for the event is quite easy with PS 2.0 (or 3.0)

Way cool

Klaus.

re: Use PowerShell to Monitor for the Creation of New Files

IamMred — Thu, 19 Jul 2012 14:17:29 GMT

@Rick on a Windows Server FTP is a folder, and therefore yes it would monitor a FTP site.

re: Use PowerShell to Monitor for the Creation of New Files

Rick — Wed, 18 Jul 2012 17:11:01 GMT

I know this could monitor local drive. Is it possible to monitor a ftp site?

re: Use PowerShell to Monitor for the Creation of New Files

IamMred — Wed, 18 Jul 2012 15:56:48 GMT

@hallstev5 no. you will need one event per folder. Using this exact query it only montors the top folder.

re: Use PowerShell to Monitor for the Creation of New Files

IamMred — Wed, 18 Jul 2012 15:55:37 GMT

@Rjcox you are absolutely correct ... this is not a replacement for process monitor from Sysinternals. But, this IS in the box, and the Sysinternals tools are not, and for quick things IF you know this technique it will come in useful. In addition, this exact technique can monitor for nearly any of the thousands of WMI classes, and so from that perspective it is more flexible. In addition, this article is a building block, and later in the week (like on Friday) I will turn this query into a permenant event ... and so it will monitor all the time.

re: Use PowerShell to Monitor for the Creation of New Files

IamMred — Wed, 18 Jul 2012 15:52:51 GMT

Sorry about not including the full source code in the posting. I have uploaded the script to the TechNet Script Repository and added a sentence to the end of the article that points to that code. Thank you for pointing this out to me. Sorry for the inconvience.

re: Use PowerShell to Monitor for the Creation of New Files

hallstev5 — Wed, 18 Jul 2012 14:12:14 GMT

Is it possible to monitor more than 1 folder per event? Also is it going to monitor the top level folder only or can it do subfolders as well?

re: Use PowerShell to Monitor for the Creation of New Files

rjcox — Wed, 18 Jul 2012 11:06:57 GMT

Of course, for most purposes Process Monitor is far more powerful and detailed (eg. see individual IO operations with call stacks etc.)

re: Use PowerShell to Monitor for the Creation of New Files

Баф — Wed, 18 Jul 2012 09:52:58 GMT

Hi!

Why you didn't include full source code of your script in a post?