WQL WMI Query to watch for newly created files

0
votes

The following query should return a set of files that were created to the G drive in the folder test.

I am having trouble getting the following WMI query to work:

SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE 
TargetInstance ISA 'CIM_DataFile' AND TargetInstance.Drive = 'G:' AND 
TargetInstance.Path = '\\test\\'

The wbemtest utility gives me the following error:

Number: 0x80041017
Facility: WMI
Description: Invalid query

Thanks!

2
filewmiwql
The WQL looks ok, maybe your are using the wrong method to execute the query (the wmi events must be executed using the ExecNotificationQueryAsync or ExecNotificationQuery methods ). can you show your source code? – RRUZ

2 Answers

2
votes

There is a space in the event class name, ie. __ InstanceCreationEvent should be __InstanceCreationEvent. Other than that you shouldn't use the LIKE operator in the query because it will force WMI to search your machine for all files that have 'test' as one of their parent directories. Better to use the exact path.

1
votes

This is giving you Invalid query error as you are runnign this as a query, but _instancecreationEvent or all subClass of "_InstanceOperationEvent" must be called as NotificationQuery.

Thanks.