Monitor folders for new files

I was looking for something I could purchase but this may work with a little effort on my part. If no one else puts an easier solution up by tomorrow, I will accept this as a solution. Thanks again for your response

My concern is how much resources is a monitor going to use and how reliable and stable is it.
I post the following for fun mainly ;^)  Dr kicks my butt (real experience in the real world), so really, if no one else posts, he should get the points.

I just wanted a reference point since I found the question interesting and did some digging on my own (no expertise required ;^)

##############################


MyFileWatcher... another C# project
http://www.c-sharpcorner.com/UploadFile/thiagu304/FileSystemWatcher03192007133144PM/FileSystemWatcher.aspx

Tripwire has been around a long time
http://sourceforge.net/projects/tripwire/

I think this may be an extension off a pseudo-popular delphi project sometime back...
http://www.greatis.com/delphicb/foldmon/

A little less geeky (maybe).  semi-popular
http://www.datamystic.com/filewatcher.html

Seems very well liked
http://leelusoft.blogspot.com/2010/07/watch-4-folder-22.html



========================
No idea on these
------------------------
http://www.coolutils.com/TotalFolderMonitor
http://www.monkeyjob.com/FoldMonk.html


========================
For posterity
-------------------------

Build a Service
http://www.blackwasp.co.uk/WindowsService.aspx

Using WMI (geeks do not recommend this, go figure)
http://forums11.itrc.hp.com/service/forums/questionanswer.do?admit=109447626+1285736494501+28353475&threadId=1353349

Vbscript: do you really need a link? Find them all over

Windows EventTriggers (can be easily scripted vb/pwrshel/dos/etc... I have sometimes used this method for monitor/audit-ing stuff in the registry and/or filesystem)
http://technet.microsoft.com/en-us/library/bb490901.aspx
example http://www.petri.co.il/how-to-use-eventtriggersexe-to-send-e-mail-based-on-event-ids.htm

Cheers!
HTH

Hi BSServices,

The code below uses no processor while monitoring.  It is VBScript using WMI to monitor the folder every 10 seconds to see if a new file was created in there since it last looked.

If a file is found it pops up a message with the file name.

This is based on code found and explained here:

http://blogs.technet.com/b/heyscriptingguy/archive/2007/02/14/how-can-i-automatically-open-new-files-added-to-a-folder.aspx

Change line 2 to the folder that you want to monitor.

Tested on XP SP3.

Hope this helps,
Daz.

strComputer = "."
strMonitorFolder = "H:\test"

strMonitorFolderConverted = Replace(strMonitorFolder, "\", "\\\\")
Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colMonitoredEvents = objWMIService.ExecNotificationQuery _
    ("SELECT * FROM __InstanceCreationEvent WITHIN 10 WHERE " _
      & "Targetinstance ISA 'CIM_DirectoryContainsFile' and " _
        & "TargetInstance.GroupComponent= " _
          & "'Win32_Directory.Name=""" & strMonitorFolderConverted & """'")
WScript.Echo "Monitoring new files inside " & strMonitorFolder


Do
    Set objLatestEvent = colMonitoredEvents.NextEvent
    strFileFound = objLatestEvent.TargetInstance.PartComponent
    arrFileFound = Split(strFileFound, "=")
    strFileFound = arrFileFound(1)
    strFileFound = Replace(strFileFound, "\\", "\")
    strFileFound = Replace(strFileFound, """", "")
    iBtn = MsgBox ("New file found in " & strMonitorFolder & ":" & vbCrlf & strFileFound & vbCrlf & vbCrlf & "Press Cancel to exit script or OK to keep monitoring", vbOKCancel, "Found: ")
    If iBtn = vbCancel Then WScript.Quit
Loop

Select allOpen in new window

Sweet, Daz.  I was thinking that wmi would be the trick for a practically no resources approach...
...can you explain how it is possible for wmi not to be taking up cpu cycles, or tell me where I can read about that (without drowning in the technet wmi pages ;^)

I assume wscript is not using cycles because its only function is to "set it up" and then "respond when an event is triggered ...yes?

Thanks. Good job.

Just to note... I think eventtriggers has similar capacity.  I wonder if it is any different in nature than wmi in how it would monitor a system object.  If anyone can speak to this I would greatly appreciate it ;^)

Hi, to be honest I don't know the ins and outs of exactly how it works.

It uses the __InstanceCreationEvent class - based on the Common Information Model (CIM).  See here for some more info:

http://msdn.microsoft.com/en-us/library/aa394583(v=VS.85).aspx

Here is information on the WMI architecture:

http://msdn.microsoft.com/en-us/library/aa394553(v=VS.85).aspx

... and more general info about WMI:

http://msdn.microsoft.com/en-us/library/aa384642(v=VS.85).aspx

Classes with double underscore names are WMI system classes - these are part of the core WMI service and they must have some small overhead - but it looks like because they are intrinsically part of the WMI service they are efficient in their execution and use of computer resources.

I apologise I can't give you a proper answer on this: the nitty-gritty of the detail is a little bit over my head.

The script I posted above has a 10 second poll time.  This means that the WMI class is doing literally nothing in between those polls:  if a file was created and deleted before the next __InstanceCreationEvent poll, the script would not detect the file creation and the event would not fire.  At the time of the next poll, the class only compares what it sees with what it found before at the last poll.  Each poll is such a small amount of processing that it is not easily measurable in this case.  I would imagine that if you had a folder with thousands of files being created often, then the processing overhead would increase, even if it was the processing by the program or script handling the event and not the WMI class itself.

Regards,
Daz.

Thanks for your responses, Daz..
Your timing comments brings up an important point.  
Many of these utilities seem to be geared toward detection and then immediate firing.
If I were to set something like this up, I would limit knee-jerk firing to "logging only" (like one-liners only), and then have the (or another) script check the log, say, once or a couple times a day, and then compose the administrative alert email and send that when resource usage is fairly idle.

I hope any other passers-by will chime in, I really would like to know more about wmi and event trigger resource impact ...and compared to other monitoring options...

I was creating some monitoring scripts (vb, dos batch, etc) and found them to be rather annoying in the resource impact department.  It was very frustrating. Then I discovered eventtriggers.  While using scripts with them was just as annoying, it seemed I could have steady raw monitoring (without scripts) taking place with seemingly no impact !  I mean, I'd look in the event log and it would be filling up, but the process monitor remained practically idle... and I am talking about persistent event monitoring, flike keeping a dead-eye on a registry key or a file, etc., not just  "checking every ten seconds" kind of thing.

So its not that there was no impact, just very very little.  However, Impact would spike when having any script respond.  Of course, using vbscript monitoring... well I threw that out the window after the first few scripts, they wouldn't leave the processor alone.  Other methods weren't doing much better.  I never made it into PowerShell so I cannot comment on that (get there eventually).
So considering the scripting failures I did not even bothered looking at application utilities for handling this sort of thing... I don't trust any running any utility is going to be innocuous enough.

*I think wmi and/or eventtriggers is the way for serious administrators to go, but I do not have enough understanding about it to definitively say.  Maybe you can understand my interest in BBServices posting here ;^)

BTW, @BSServices:  I am not at all meaning to discourage you (or anyone) from checking out some of the suggested utilities.  I would bet that the more popular ones have some built in resource handling management for taming them.  It just seems relevant to raise these other questions in this venue.

After all, aren't we here to pool our best ideas (as well as idiot musings) and learn from each others mistakes and success?  ;^)

I just got through setting up the program and it works fine thanks and thanks to all those who responded. It took me awhile to evaluate the answers