我的磁盘上有几项不同的操作。我想确定大约有多少磁盘活动是由文件共享引起的。有没有计数器可以解决这个问题?
另外,我可能一直在做梦,我似乎记得看到过一些程序,可以让我监视共享中特定文件夹的文件活动。有没有想起什么?谢谢。
答案1
关于监控文件夹的活动:
您可以使用 WMI(CIM_DataFile)来监视文件夹是否有任何修改,使用类似于以下查询:
从 __InstanceOperationEvent 中选择 *,其中 TargetInstance ISA“CIM_DataFile”和 TargetInstance.Drive="C:" 以及 TargetInstance.Path="\Data"
像这样:
' Full path to the folder to monitor
sPath = "\\localhost\c$\Scripts"
sComputer = split(sPath,"\")(2)
sDrive = split(sPath,"\")(3)
sDrive = REPLACE(sDrive, "$", ":")
sFolders = split(sPath,"$")(1)
sFolders = REPLACE(sFolders, "\", "\\") & "\\"
' Create our WMI instance
Set objWMIService = GetObject("winmgmts:\\" & sComputer & "\root\cimv2")
' Begin monitoring
Set colMonitoredEvents = objWMIService.ExecNotificationQuery _
("SELECT * FROM __InstanceOperationEvent WITHIN 1 WHERE " _
& "TargetInstance ISA 'CIM_DataFile' AND " _
& "TargetInstance.Drive='" & sDrive & "' AND " _
& "TargetInstance.Path='" & sFolders & "'")
Wscript.Echo vbCrlf & Now & vbTab & _
"Begin Monitoring for a Folder Change Event..." & vbCrlf
Do
Set objLatestEvent = colMonitoredEvents.NextEvent
Select Case objLatestEvent.Path_.Class
Case "__InstanceCreationEvent"
WScript.Echo Now & vbTab & objLatestEvent.TargetInstance.FileName _
& " was created" & vbCrlf
Case "__InstanceDeletionEvent"
WScript.Echo Now & vbTab & objLatestEvent.TargetInstance.FileName _
& " was deleted" & vbCrlf
Case "__InstanceOperationEvent"
If objLatestEvent.TargetInstance.LastModified <> _
objLatestEvent.PreviousInstance.LastModified then
WScript.Echo Now & vbTab & objLatestEvent.TargetInstance.FileName _
& " was modified" & vbCrlf
End If
IF objLatestEvent.TargetInstance.LastAccessed <> _
objLatestEvent.PreviousInstance.LastAccessed then
WScript.Echo Now & vbTab & objLatestEvent.TargetInstance.FileName _
& " was accessed" & vbCrlf
End If
End Select
Loop
Set objWMIService = nothing
Set colMonitoredEvents = nothing
Set objLatestEvent = nothing