How can I use ExecNotificationQuery to get Win32_ProcessStartTrace and
Win32_ProcessStopTrace events and distinguish them from each other? The
following script gives me two events per user application, and these are
likely the StartTrace and StopTrace events that are subclasses of the Trace
event asked for by the script. If this is so, how can I tell them apart as
the arrive? Of course, I can query for Win_32ProcessStartTrace or
Win_32ProcessStopTrace separately, and that works too, but I want to see
both events as they occur.
on error resume next
set objServices = GetObject("winmgmts:root\cimv2")
objServices.Security_.ImpersonationLevel = 3
set events = objServices.ExecNotificationQuery _
("select * from Win32_ProcessTrace")
for i = 1 to 2
Set NTEvent = events.NextEvent
For Each objProperty in ntevent.properties_
wscript.echo objProperty.name
Next
WScript.Echo now() & " " & ntevent.processid & " " & ntevent.processname
next
Thanks.
Randy Scarborough