Solved

Need a vbscript that will monitor task manager processes for dumprep.exe

Posted on 2010-11-19
12
1,303 Views
Last Modified: 2013-11-08
i'm managing a terminal server that several users work on.  I'm looking for a vbscript (?) that I can use to  monitor processes and notify me when it detects dumprep.exe.  (I have billers that are killing their Great Plains client when they think it's taking too long to generate an invoice batch - which causes all manner of chaos).

I know how to loop through the processes using vbscript, but the only thing I can think to do with it now is to make is a scheduled task and repeat it every minute - I don't think that will do the trick for me.  
0
Comment
Question by:jaypappas
12 Comments
 
LVL 66

Expert Comment

by:johnb6767
ID: 34182040
In batch, all you need to do is a tasklist | find /i "dumprep.exe" && ACTION

Replace action with maybe a simple command line SMTP engine?

Perhaps you can use the same theory in VBS?
0
 

Author Comment

by:jaypappas
ID: 34183887
manythanks - but I would use wmi most likely to list tasks - is there any way to actually monitor the task manager and trigger an event when a specific process starts?  Even using WMI I'm stuck basically running a program to loop through processes and triggering an email when dumprep.exe is found.  even repeating this every minute would seem to leave open the possibility of missing a brief dumprep.exe appearance.
0
 
LVL 66

Expert Comment

by:johnb6767
ID: 34184363
Thats outside of my scripting abilities im afraid.......
0
 
LVL 66

Expert Comment

by:johnb6767
ID: 34184368
Maybe even instead of loopiong, just let the script sleep for 15-20 seoncds, requerying etc.....

What exactly are you trying to achieve.... Are you trying to find reactively who has done this? Seems like it might need to be approached as more of a training issue...... To make sure they use patience in dealing with it.....
0
DevOps Toolchain Recommendations

Read this Gartner Research Note and discover how your IT organization can automate and optimize DevOps processes using a toolchain architecture.

 
LVL 65

Accepted Solution

by:
RobSampson earned 500 total points
ID: 34184447
Hi there, try this script.

The __InstanceCreationEvent class of the ExecNotificationQuery method will allow you to recurse through any instance of the raised event in the last n seconds, where n is given by the integer after the Within keyword.

The Do While loop will endlessly loop through the notifications received.

Regards,

Rob.
strComputer = "."

Set objNetwork = CreateObject("WScript.Network")

Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

Set colMonitoredProcesses = objWMIService.ExecNotificationQuery("SELECT * FROM __InstanceCreationEvent Within 5 WHERE TargetInstance Isa Win32_Process And TargetInstance.Name = 'dumprep.exe'")

Do While True

	Set objProcess = colMonitoredProcesses.NextEvent

	' Email variables:

	strServer = "mailhost.abc.com"

	strTo = "john.doe@abc.com"

	strFrom = "john.doe@abc.com"

	strSubject = "Dumprep.exe Detected on " & objNetwork.ComputerName & " by user " & objNetwork.UserName

	strBody = "This is the body:" & VbCrLf

	SendEmail strServer, strTo, strFrom, strSubject, strBody, ""

Loop



Sub SendEmail(strServer, strTo, strFrom, strSubject, strBody, strAttachment)

        Dim objMessage

        

        Set objMessage = CreateObject("CDO.Message")

        objMessage.To = strTo

        objMessage.From = strFrom

        objMessage.Subject = strSubject

        objMessage.TextBody = strBody

  		If strAttachment <> "" Then objMessage.AddAttachment strAttachment

  		

        '==This section provides the configuration information for the remote SMTP server.

        objMessage.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2

        'Name or IP of Remote SMTP Server

        objMessage.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpserver") = strServer

        'Server port (typically 25)

        objMessage.Configuration.Fields.Item("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = 25      

        objMessage.Configuration.Fields.Update

        '==End remote SMTP server configuration section==

 

        objMessage.Send

        Set objMessage = Nothing

End Sub

Open in new window

0
 
LVL 65

Expert Comment

by:RobSampson
ID: 34438287
Dhaest, my code in comment ID:34184447 should do the job.  It will monitor for the process, and send an email, which is the author's intent.

Rob.
0
 
LVL 66

Expert Comment

by:johnb6767
ID: 34439958
I second it.....
0
 
LVL 65

Expert Comment

by:RobSampson
ID: 34467669
My code in comment ID:34184447 should do the job.  It will monitor for the process, and send an email, which is the author's intent.

Rob.
0
 
LVL 1

Expert Comment

by:Vee_Mod
ID: 34509891
All,
 
Following an 'Objection' by RobSampson (at http://www.experts-exchange.com/Q_26713111.html) to the intended closure of this question, it has been reviewed by at least one Moderator and is being closed as recommended by the Expert.
 
At this point I am going to re-start the auto-close procedure.
 
Thank you,
 
Vee_Mod
Experts-Exchange Moderator
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

This article will show, step by step, how to integrate R code into a R Sweave document
If you’re thinking to yourself “That description sounds a lot like two people doing the work that one could accomplish,” you’re not alone.
Learn how to match and substitute tagged data using PHP regular expressions. Demonstrated on Windows 7, but also applies to other operating systems. Demonstrated technique applies to PHP (all versions) and Firefox, but very similar techniques will w…
The viewer will learn how to dynamically set the form action using jQuery.

920 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now