106 lines
3.1 KiB
Plaintext
106 lines
3.1 KiB
Plaintext
//////////////////////////////////////////////////////////////////////////////
|
|
// Notepad.mof contains:
|
|
// Intrinsic event generator for ESSTest
|
|
//
|
|
|
|
#pragma namespace("\\\\.\\root\\cimv2")
|
|
|
|
// Fires __InstanceCreationEvent where TargetInstance ISA "Win32_Process" and
|
|
// TargetInstance.Name = "notepad.exe"
|
|
|
|
instance of MSFT_EssEventGenerator as $Gen1
|
|
{
|
|
Name = "Notepad Event Generator";
|
|
CommandLine = "cscript spawnandkill.js notepad.exe %NumEvents% 10000";
|
|
FullCompare = false;
|
|
Script =
|
|
"PrintMOF();\n"
|
|
"\n"
|
|
"function PrintMOF()\n"
|
|
"{\n"
|
|
" var args = WScript.Arguments;\n"
|
|
" var type = %ScriptRule%;\n"
|
|
"\n"
|
|
" if (type & 1)\n"
|
|
" {\n"
|
|
" for (Index = 0; Index < args(0); Index++)\n"
|
|
" {\n"
|
|
" Obj = \n"
|
|
" \"instance of __InstanceCreationEvent \" +\n"
|
|
" \"{ \" +\n"
|
|
" \" TargetInstance = \" +\n"
|
|
" \" instance of Win32_Process \"+\n"
|
|
" \" {\"+\n"
|
|
" \" Name = \\\"notepad.exe\\\";\" +\n"
|
|
" \" };\" +\n"
|
|
" \"};\";\n"
|
|
"\n"
|
|
" WScript.Echo(Obj);\n"
|
|
" }\n"
|
|
" }\n"
|
|
"\n"
|
|
" if (type & 2)\n"
|
|
" {\n"
|
|
" for (Index = 0; Index < args(0); Index++)\n"
|
|
" {\n"
|
|
" Obj = \n"
|
|
" \"instance of __InstanceDeletionEvent \" +\n"
|
|
" \"{ \" +\n"
|
|
" \" TargetInstance = \" +\n"
|
|
" \" instance of Win32_Process \"+\n"
|
|
" \" {\"+\n"
|
|
" \" Name = \\\"notepad.exe\\\";\" +\n"
|
|
" \" };\" +\n"
|
|
" \"};\";\n"
|
|
"\n"
|
|
" WScript.Echo(Obj);\n"
|
|
" }\n"
|
|
" }\n"
|
|
"};\n";
|
|
};
|
|
|
|
instance of MSFT_EssTestWorkItem
|
|
{
|
|
Name = "Notepad Events";
|
|
EventGenerator = $Gen1;
|
|
|
|
Enabled = false;
|
|
NumEvents = 20;
|
|
TimesToExecute = 1;
|
|
MaxPermConsumers = 0;
|
|
MaxTempConsumers = 2;
|
|
SlowDownProviders = true;
|
|
};
|
|
|
|
instance of MSFT_EssTestFilter
|
|
{
|
|
Name = "Notepad creations";
|
|
|
|
EventGenerator = $Gen1;
|
|
Query =
|
|
"select TargetInstance.Name from __InstanceCreationEvent "
|
|
"within 5 "
|
|
"where TargetInstance ISA 'Win32_Process' and "
|
|
"TargetInstance.Name = 'notepad.exe'";
|
|
|
|
ScriptRule = "1";
|
|
|
|
Behavior = 1;
|
|
};
|
|
|
|
instance of MSFT_EssTestFilter
|
|
{
|
|
Name = "Notepad deletions";
|
|
|
|
EventGenerator = $Gen1;
|
|
Query =
|
|
"select TargetInstance.Name from __InstanceDeletionEvent "
|
|
"within 5 "
|
|
"where TargetInstance ISA 'Win32_Process' and "
|
|
"TargetInstance.Name = 'notepad.exe'";
|
|
|
|
ScriptRule = "2";
|
|
|
|
Behavior = 1;
|
|
};
|