179 lines
3.1 KiB
XML
179 lines
3.1 KiB
XML
<Job id="EventRegistration">
|
|
<script language="VBScript" src="ExtendedCommonCode.vbs"/>
|
|
<script language="VBScript">
|
|
|
|
'---------------------------------------------------------
|
|
'
|
|
' File:
|
|
'
|
|
' Monitor.VBS
|
|
'
|
|
' Description:
|
|
'
|
|
' Script file to extend the standard WMI event query language
|
|
'
|
|
' Author:
|
|
'
|
|
' Steve Menzies
|
|
'
|
|
' Date:
|
|
'
|
|
' 01/12/00
|
|
'
|
|
' Version:
|
|
'
|
|
' Draft 1.0
|
|
'
|
|
|
|
'---------------------------------------------------------
|
|
'
|
|
' Function:
|
|
'
|
|
' ParseQuery
|
|
'
|
|
' Description:
|
|
'
|
|
' Parse query language extensions
|
|
'
|
|
' Input Arguments:
|
|
'
|
|
' a_Query - Query string to parse
|
|
'
|
|
' Output Arguments:
|
|
'
|
|
' None
|
|
'
|
|
' Return Value:
|
|
'
|
|
' None
|
|
'---------------------------------------------------------
|
|
|
|
Function ParseQuery ( a_Query )
|
|
|
|
ParseQuery = Parser_Success
|
|
|
|
Dim t_NextPosition
|
|
Dim t_PreFilterPosition
|
|
|
|
Dim t_ParseTree
|
|
|
|
Dim Status
|
|
Status = Create_Empty ( t_ParseTree )
|
|
|
|
Status = Parser_Select ( DFA_Definition , a_Query , 1 , t_NextPosition , t_ParseTree , t_PreFilterPosition )
|
|
If Status = Parser_Success Then
|
|
|
|
' If g_Debug And 8 Then
|
|
WScript.Echo "Parser Success"
|
|
Dim t_ExpressionString
|
|
Status = Traverse_Tree ( t_ParseTree ,t_ExpressionString )
|
|
WScript.Echo t_ExpressionString
|
|
' End If
|
|
|
|
Dim TargetEvent
|
|
|
|
Set TargetEvent = GetObject("winmgmts:root/cimv2:EventObject=@")
|
|
|
|
Status = Bind_Identifier_Values ( t_ParseTree , TargetEvent )
|
|
If Status = True Then
|
|
|
|
WScript.Echo "Parser Success"
|
|
t_ExpressionString = ""
|
|
Status = Traverse_Eval_Tree ( t_ParseTree ,t_ExpressionString )
|
|
WScript.Echo t_ExpressionString
|
|
|
|
End If
|
|
|
|
Status = Type_Evaluate_Tree ( t_ParseTree )
|
|
If Status = True Then
|
|
|
|
If g_Debug And 8 Then
|
|
WScript.Echo "Type Evaluation Successful"
|
|
WScript.Echo "Reducing Expression"
|
|
End If
|
|
|
|
Else
|
|
|
|
If g_Debug And 8 Then
|
|
WScript.Echo "Type Evaluation Error"
|
|
End If
|
|
|
|
End If
|
|
|
|
Status = Evaluate_Expression ( t_ParseTree , TargetEvent )
|
|
If Status = True Then
|
|
|
|
'If g_Debug And 8 Then
|
|
WScript.Echo "Evaluation Successful"
|
|
'End If
|
|
|
|
Dim AcceptEvent
|
|
Status = Get_Node_Eval_Value ( t_ParseTree , AcceptEvent )
|
|
|
|
If AcceptEvent = True Then
|
|
|
|
WScript.Echo "Accept"
|
|
|
|
Else
|
|
|
|
WScript.Echo "Reject"
|
|
|
|
End If
|
|
|
|
Else
|
|
|
|
'If g_Debug And 8 Then
|
|
WScript.Echo "Evaluation Error"
|
|
'End If
|
|
|
|
End If
|
|
|
|
Else
|
|
|
|
WScript.Echo "Parser Failure"
|
|
|
|
End If
|
|
|
|
End Function
|
|
|
|
'---------------------------------------------------------
|
|
'
|
|
' Function:
|
|
'
|
|
' Main Function
|
|
'
|
|
' Description:
|
|
'
|
|
' Entry point for visual basic script
|
|
'
|
|
' Input Arguments:
|
|
'
|
|
' None
|
|
'
|
|
' Output Arguments:
|
|
'
|
|
' None
|
|
'
|
|
' Return Value:
|
|
'
|
|
' None
|
|
'---------------------------------------------------------
|
|
|
|
dim t_Query
|
|
t_Query = "Select * from __InstanceModificationEvent Within 5.0 where TargetInstance isa ""EventEmbeddedObject"" And TargetInstance.Freespace * 100 / TargetInstance.Size < 50 "
|
|
|
|
Dim Status
|
|
|
|
Status = Initialize_Globals ()
|
|
|
|
Status = ParseQuery ( t_Query )
|
|
|
|
If Status = Parser_Success Then
|
|
|
|
|
|
End If
|
|
|
|
</Script>
|
|
</Job>
|
|
|