Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Monitor new Process on remote servers

Posted on 2009-05-13
4
Medium Priority
?
645 Views
Last Modified: 2012-08-14
Hi All,

I have a script below that should monitor when a notepad process is created. The script works fine on local and remote machines. However the problem I have is that the script tends to wait on command objEventSource.NextEvent().

This particular command is causing issues as the script waits on each machine in the loop to complete the task before moving on.

My objective is to trap the notepad process when it is initiated on any of the machines in the process.txt file. IE, I want the script to run across all machines when I push it out from a batch file using psexec.

Can anyone please help move past this huddle? or Suggest a better solution. I tried another approach by using vbscript to copy the file to the servers and was faced with this same problem and security issues. Please help

Run Remote Script
-----------------------
Dim objController, objRemoteScript, objFSO
Dim objTSIn, objTSOut, strComputer

'Create objects
Set objController = CreateObject("WshController")
Set objFSO = CreateObject("Scripting.FileSystemObject")

'Read computer names from file
Set objTSIn = objFSO.OpenTextFile("C:\computers.txt")

'Open output file for log
Set objTSOut = objFSO.CreateTextFile("C:\log.txt", True)

Do Until objTSIn.AtEndOfStream
    'Deploy script to remote computer

    strComputer = objTSIn.ReadLine
    objTSOut.WriteLine strComputer & ": Deploying at " & Now
    Set objRemoteScript = objController.CreateScript( _
        "C:\process.vbs", strComputer)
    WScript.ConnectObject objRemoteScript, "remote_"
    objRemoteScript.Execute
    Do Until objRemoteScript.Status = 1
        WScript.Sleep 1000
    Loop
    objTSOut.WriteLine strComputer & " Completed at " & Now
    Set objRemoteScript = Nothing

Loop

objTSIn.Close
objTSOut.Close
WScript.Echo "Deployment script complete."

Sub remote_Error
    Dim objError
    Set objError = objRemote.Error
    objTSOut.WriteLine strComputer & ": Error at " & Now
    objTSOut.WriteLine " Line: " & objError.Line & _
        ", Char: " & objError.Character & vbCrLf & _
            "Description: " & objError.Description
    WScript.Quit -1
End Sub
Get notepad Process
---------------------------
 
'Get computer name
Set WshNetwork = WScript.CreateObject("WScript.Network")
 
'Create a FileSystemObject
Set oFS = CreateObject("Scripting.FileSystemObject")
'Open a text file of computer names
'with one computer name per line
Set oTS = oFS.OpenTextFile("c:\process.txt")
 
'go through the text file
Do Until oTS.AtEndOfStream
 'get the next computer name
 'store it in variable strComputer
 strComputer = oTS.ReadLine
 
'strComputer = "."
Set objSWbemServices = GetObject("winmgmts:" &_
 "{impersonationLevel=impersonate}!" &_
 "\\" & strComputer & "\root\cimv2")
 
Set objEventSource = objSWbemServices.ExecNotificationQuery( _
 "SELECT * FROM __InstanceCreationEvent " &_
 "WITHIN 10 " &_
 "WHERE TargetInstance " &_
 "ISA 'Win32_Process' " &_
 "AND TargetInstance.Name = 'notepad.exe'")
 
'Echo Computer name
Set objEventObject = objEventSource.NextEvent()
Wscript.Echo "Computer Name: " &  strComputer
 
Set objEmail = CreateObject("CDO.Message")
objEmail.From = "me@test.com"
objEmail.To = "me@test.com"
objEmail.Subject = strComputer 
objEmail.Textbody = "Notepad initiated."
objEmail.Configuration.Fields.Item _
    ("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2
objEmail.Configuration.Fields.Item _
    ("http://schemas.microsoft.com/cdo/configuration/smtpserver") = _
        "Testserver" 
objEmail.Configuration.Fields.Item _
    ("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = 25
objEmail.Configuration.Fields.Update
objEmail.Send
 
  Loop
'close the text file
oTS.Close
'MsgBox "Done!"

Open in new window

0
Comment
Question by:neosteo
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
4 Comments
 
LVL 14

Accepted Solution

by:
rejoinder earned 1000 total points
ID: 24379236
Try this...
This script uses an event sink which monitors the processes.  This will not have any hang-ups as mentioned in the script above but will happily monitor endlessly.
Near the top of the script is a dictionary object so that you can monitor multiple files - why limit your script right?  In this case, the script will monitor notepad and calc.  Add more entries or take out the line, it is up to you.
My thinking is that you would copy the file onto each drive as described.  Then you would schedule the script to run at the system start up.  This way, the user would never see the script start and the script would catch any application you tell it to monitor right from the get go.

Dim ScanSpeed
Dim strComputer
Dim objDictionary
 
Set WshNetwork = WScript.CreateObject("WScript.Network")
strComputer = WshNetwork.ComputerName 
 
ScanSpeed = 5
 
Set objDictionary = CreateObject("scripting.dictionary")
objDictionary.Add "notepad.exe", "notepad.exe"
objDictionary.Add "calc.exe", "calc.exe"
 
Set ProcessSink = WScript.CreateObject("WbemScripting.SWbemSink", "ProcessSink_")
Set Process = GetObject("winMgmts:{(security)}\\" & strComputer & "\root\cimv2")
Process.ExecNotificationQueryAsync ProcessSink, "select * from __InstanceCreationEvent WITHIN " & ScanSpeed & " where targetinstance isa 'Win32_Process'"
 
Sub ProcessSink_OnObjectReady(objObject, objAsyncContext)
    strName = objObject.TargetInstance.Name
    strPath = objObject.TargetInstance.ExecutablePath
    if objDictionary.Exists(lcase(strName)) then
        Set objEmail = CreateObject("CDO.Message")
        objEmail.From = "me@test.com"
        objEmail.To = "me@test.com"
        objEmail.Subject = strComputer 
        objEmail.Textbody = strName & " initiated."
        objEmail.Configuration.Fields.Item ("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2
        objEmail.Configuration.Fields.Item ("http://schemas.microsoft.com/cdo/configuration/smtpserver") = "Testserver" 
        objEmail.Configuration.Fields.Item ("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = 25
        objEmail.Configuration.Fields.Update
        objEmail.Send
    end if
End Sub
 
wscript.echo "Click OK to stop monitor."

Open in new window

0
 

Author Comment

by:neosteo
ID: 24382989
Hi Rejoinder,

Thanks a lot for the script. Its much better than mine. What I am trying to do is run the script remotely? With the echo in their, the script is also waiting for the job to complete. I am pushing out the script using the command below. These are production servers which I can't afford to reboot for the startup script to kick off. I am trying to track a defrag application, I used notepad as an example because I can play with this process without launching the defragmentation tool.

I really need to run it without schedulling it. If you can help with this, It will be much appreciated.

for /f %i in (c:\computers.txt) do @echo %i: && xcopy c:\process.vbs \\%i\c$\ /i /y /r /q
for /f %i in (c:\computers.txt) do @echo %i: && xcopy c:\process.bat \\%i\c$\ /i /y /r /q

psexec.exe @computers.txt c:\process.bat
0
 

Author Comment

by:neosteo
ID: 24383893
Hi Rejoinder

Thanks, I eventually used my script as the one stated above prompted for user input. However, I got an idea to create a scheduled task that will run it from the network. Thanks for your help.

Regards
0
 
LVL 14

Expert Comment

by:rejoinder
ID: 24386260
I hope everything works out then and thanks for the points.
0

Featured Post

Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This is an addendum to the following article: Acitve Directory based Outlook Signature (http://www.experts-exchange.com/Programming/Languages/Visual_Basic/VB_Script/Q_24950055.html) The script is fine, and works in normal client-server domains…
When you see single cell contains number and text, and you have to get any date out of it seems like cracking our heads.
Do you want to know how to make a graph with Microsoft Access? First, create a query with the data for the chart. Then make a blank form and add a chart control. This video also shows how to change what data is displayed on the graph as well as form…
This tutorial will teach you the special effect of super speed similar to the fictional character Wally West aka "The Flash" After Shake : http://www.videocopilot.net/presets/after_shake/ All lightning effects with instructions : http://www.mediaf…

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question