WMI: File creation notification

[Dmitry Perets]

Hello,

I need a WMI query that will notify me whenever a new file is created inside specific directory OR any of its subdirectories.

I tried to catch __InstanceCreationEvent for CIM_DataFile, but that didn't work... Then I tried to catch the same event for CIM_DirectoryContainsFile. That one worked, but I couldn't make it control the subdirectories - it controlled only the directory itself...

Can you help me with the query?

[PeejAvery]

So are you wanting the whole subdirectory tree or just one folder deep into the tree? Either way, you are going to have to personally query CIM_DirectoryContainsFile for each folder that you want to monitor. This will involve recursive directory monitoring which will slow down a machine significantly if you plan to update the search often.

[Dmitry Perets]

So are you wanting the whole subdirectory tree or just one folder deep into the tree? Either way, you are going to have to personally query CIM_DirectoryContainsFile for each folder that you want to monitor. This will involve recursive directory monitoring which will slow down a machine significantly if you plan to update the search often.

I want the whole subdirectory tree. Subdirectories, sub-subdirectories and so on. Isn't there any better way to query that? I mean, each time when a file is being created, some event is being rised, and it has the path of the newly created file. Can't I just ask something like:
SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'File' WHERE TargetInstance.Path StartsWith 'C:\Test'?

[PeejAvery]

SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'File' WHERE TargetInstance.Path StartsWith 'C:\Test'?

Can you try using LIKE 'C:\Test%'?

[Dmitry Perets]

Can you try using LIKE 'C:\Test%'?

I tried... It just hags up...

[PeejAvery]

It just hags up...

If you refer back to my first post, that is part of what I tried to explain to you. Monitoring so many folders will use so many resources and hard disk spin time that it is practically impossible. You can create an index, such as a file search program would do, but I think you have to hook window messages in order to see if they are saving a new file.

[Dmitry Perets]

Well, thank you...

[PeejAvery]

Sorry that things could not work out to your liking.