Board logo

标题: 转载几个系统监视的VBS脚本 [打印本页]

作者: lxzzr    时间: 2009-7-19 01:11     标题: 转载几个系统监视的VBS脚本

脚本来自微软官方,(其中有几个未做测试,第7个略做修改)
这是个好“地方”:http://www.microsoft.com/china/technet/community/scriptcenter/default.mspx
1.监视进程创建
  1. strComputer = "."
  2. Set objWMIService = GetObject("winmgmts:" _
  3.     & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
  4. Set colMonitoredProcesses = objWMIService. _        
  5.     ExecNotificationQuery("select * from __instancecreationevent " _
  6.         & " within 1 where TargetInstance isa 'Win32_Process'")
  7. i = 0
  8. Do While i = 0
  9.     Set objLatestProcess = colMonitoredProcesses.NextEvent
  10.     Wscript.Echo objLatestProcess.TargetInstance.Name
  11. Loop
复制代码
2.监视进程退出
  1. strComputer = "."
  2. Set objWMIService = GetObject("winmgmts:" _
  3.     & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
  4. Set colMonitoredProcesses = objWMIService. _
  5.     ExecNotificationQuery("select * from __instancedeletionevent " _
  6.             & "within 1 where TargetInstance isa 'Win32_Process'")
  7. i = 0
  8. Do While i = 0
  9.     Set objLatestProcess = colMonitoredProcesses.NextEvent
  10.     Wscript.Echo objLatestProcess.TargetInstance.Name
  11. Loop
复制代码
3.监视服务状态的改变
  1. strComputer = "."
  2. Set objWMIService = GetObject("winmgmts:" _
  3. & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
  4. Set colServices = objWMIService. _
  5. ExecNotificationQuery("Select * from __instancemodificationevent " _
  6. & "within 30 where TargetInstance isa 'Win32_Service'")
  7. i = 0
  8. Do While i = 0
  9. Set objService = colServices.NextEvent
  10. If objService.TargetInstance.State <> _
  11. objService.PreviousInstance.State Then
  12. Wscript.Echo objService.TargetInstance.Name _
  13. & " is " & objService.TargetInstance.State _
  14. & ". The service previously was " & objService.PreviousInstance.State & "."
  15. End If
  16. Loop
复制代码
4.监视可用磁盘空间
  1. Const LOCAL_HARD_DISK = 3
  2. strComputer = "."
  3. Set objWMIService = GetObject("winmgmts:" _
  4.     & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
  5. Set colMonitoredDisks = objWMIService.ExecNotificationQuery _
  6.     ("Select * from __instancemodificationevent within 30 where " _
  7.         & "TargetInstance isa 'Win32_LogicalDisk'")
  8. i = 0
  9. Do While i = 0
  10.     Set objDiskChange = colMonitoredDisks.NextEvent
  11.     If objDiskChange.TargetInstance.DriveType = LOCAL_HARD_DISK Then
  12.         If objDiskChange.TargetInstance.Size < 100000000 Then
  13.             Wscript.Echo "Hard disk space is below 100000000 bytes."
  14.         End If
  15.     End If
  16. Loop
复制代码
5.监视磁盘驱动器的剩余空间
  1. strComputer = "."
  2. Set objWMIService = GetObject("winmgmts:" _
  3.     & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
  4. Set colDiskDrives = objWMIService.ExecQuery _
  5.     ("Select * from win32_perfformatteddata_perfdisk_logicaldisk where Name <> '_Total'")
  6. For each objDiskDrive in colDiskDrives
  7.     Wscript.Echo "Drive Name: " & objDiskDrive.Name
  8.     Wscript.Echo "Free Space: " & objDiskDrive.FreeMegabytes
  9. Next
复制代码
6.监视事件日志
  1. strComputer = "."
  2. Set objWMIService = GetObject("winmgmts:" _
  3. & "{impersonationLevel=impersonate, (Security)}!\\" & strComputer & "\root\cimv2")
  4. Set colMonitoredEvents = objWMIService.ExecNotificationQuery _
  5. ("Select * from __instancecreationevent where TargetInstance isa 'Win32_NTLogEvent' and TargetInstance.EventCode = '533' ")
  6. Do
  7. Set objLatestEvent = colMonitoredEvents.NextEvent
  8. strAlertToSend = objLatestEvent.TargetInstance.User _
  9. & " attempted to access DatabaseServer."
  10. Wscript.Echo strAlertToSend
  11. Loop
复制代码
7.监视用户登陆
  1. StrComputer = "."
  2. Set objWMIService = GetObject("winmgmts:" _
  3. & "{impersonationLevel=impersonate, (Security)}!\\" & strComputer & "\root\cimv2")
  4. Set colMonitoredEvents = objWMIService.ExecNotificationQuery _
  5. ("Select * from __instancecreationevent where TargetInstance isa 'Win32_NTLogEvent' and TargetInstance.EventCode = '528' ")
  6. Do
  7. Set objLatestEvent = colMonitoredEvents.NextEvent
  8. strAlertToSend = objLatestEvent.TargetInstance.user _
  9. &MSGBOX ("某个用户已经成功登陆此计算机!.",48,"警告!")
  10. Loop
复制代码
8.监视注册表子项事件
  1. Set wmiServices = GetObject("winmgmts:root/default")
  2. Set wmiSink = WScript.CreateObject("WbemScripting.SWbemSink", "SINK_")
  3. wmiServices.ExecNotificationQueryAsync wmiSink, _
  4. "SELECT * FROM RegistryKeyChangeEvent WHERE Hive='HKEY_LOCAL_MACHINE' AND " & _
  5. "KeyPath='SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion'"
  6. WScript.Echo "Listening for Registry Change Events..." & vbCrLf
  7. While(1)
  8. WScript.Sleep 1000
  9. Wend
  10. Sub SINK_OnObjectReady(wmiObject, wmiAsyncContext)
  11. WScript.Echo "Received Registry Change Event" & vbCrLf & _
  12. "------------------------------" & vbCrLf & _
  13. wmiObject.GetObjectText_()
  14. End Sub
复制代码

[ 本帖最后由 lxzzr 于 2009-7-19 01:37 编辑 ]
作者: Batcher    时间: 2009-7-19 09:24

微软脚本中心实乃初学者必到之处^_^
作者: BBCC    时间: 2009-7-19 18:52

可惜bat不能做实时监控啊...
作者: Taurus    时间: 2009-11-12 06:22

原帖由 BBCC 于 2009-7-19 18:52 发表
可惜bat不能做实时监控啊...

应该可以,只是Wscript.Sleep较节省资源
'>nul 2>nul&@echo off&cls&color 70&setlocal EnableDelayedExpansion&set Get=2&set /a BSc=59&set /a BSl=3&set sec=%time:~3,2%&set min=0&mode con: cols=!BSc! lines=!BSl!&title C^:\^>Process Monitor_
':setPuocess>nul 2>nul
'>nul 2>nul&cls&echo.          Please input the name of target process^:
'>nul 2>nul&set /p Puocess1= ^>
'>nul 2>nul&if "!Puocess1!"=="" goto :setPuocess>nul 2>nul
':SetAlarm>nul 2>nul
'>nul 2>nul&cls&echo. If catch up the target object then send out alarm ? (Y/N)
'>nul 2>nul&set /p alarm= ^>
'>nul 2>nul&If !alarm!==Y (set "alarm1=   ALARM  ON"&set "alarm2=   ALARM OFF "&set "c1=a"&set "c2=c"&goto :box>nul 2>nul)
'>nul 2>nul&If !alarm!==y (set "alarm1=   ALARM  ON"&set "alarm2=   ALARM OFF "&set "c1=a"&set "c2=c"&goto :box>nul 2>nul)
'>nul 2>nul&If !alarm!==N (set "alarm2=   ALARM  ON"&set "alarm1=   ALARM OFF "&set "c2=a"&set "c1=c"&goto :box>nul 2>nul)
'>nul 2>nul&If !alarm!==n (set "alarm2=   ALARM  ON"&set "alarm1=   ALARM OFF "&set "c2=a"&set "c1=c"&goto :box>nul 2>nul)
'>nul 2>nul&goto :SetAlarm>nul 2>nul
':box>nul 2>nul
'>nul 2>nul&set /a BSc-=2
'>nul 2>nul&mode con: cols=!BSc!
'>nul 2>nul&If not !BSc!==15 ( goto :box>nul 2>nul )
'>nul 2>nul&title !min! /mins
':loop>nul 2>nul
'>nul 2>nul&cls&color 0a
'>nul 2>nul&if not %time:~3,2%==!sec! ( set /a min+=1 &set sec=%time:~3,2%&title  !min! /mins )
'>nul 2>nul&for /f  "skip=3" %%a in ('tasklist /svc /fi "imagename eq !Puocess1!" 2^>NUL') do set Puocess2=%%a
'>nul 2>nul&if "!Puocess1!"=="!Puocess2!" set Get=1
'>nul 2>nul&call color %%c!Get!%%0&echo.&call echo.%%alarm!Get!%%&set Get=2&set Puocess2=
'>nul 2>nul&CScript.EXE ""%0 2"" //Nologo //e:VBS
'>nul 2>nul&goto :loop>nul 2>nul
Wscript.Sleep 1000

作者: spfnug    时间: 2009-11-29 16:36

如果想同时监视进程和服务该怎么写呢?
作者: keen    时间: 2009-11-29 18:20     标题: 回复 5楼 的帖子

在别人的帖子里面跟帖提问的话,很少有人能看到你的问题,愿意回答问题的就更少了。以后有问题请到相应版块单独发帖提问,这样才可能使问题得到快速的解决。





欢迎光临 批处理之家 (http://bbs.bathome.net/) Powered by Discuz! 7.2