关闭

VB 利用WMI进行日志监视

1167人阅读 评论(0) 收藏 举报

VERSION 5.00
Begin VB.Form frmMain
   Caption         =   "Form1"
   ClientHeight    =   3090
   ClientLeft      =   60
   ClientTop       =   450
   ClientWidth     =   4680
   LinkTopic       =   "Form1"
   ScaleHeight     =   3090
   ScaleWidth      =   4680
   StartUpPosition =   3  '窗口缺省
End
Attribute VB_Name = "frmMain"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Option Explicit

Dim objSWbemServices As SWbemServices
Dim strComputer As String, strNameSpace As String
Dim WithEvents objSWbemSink As SWbemSink
Attribute objSWbemSink.VB_VarHelpID = -1

Private Sub Form_Load()

Dim ProcName As String
    Set objSWbemSink = New SWbemSink
    Set objSWbemServices = GetObject("winmgmts://" & "." & "/root/cimv2")
    objSWbemServices.Security_.Privileges.AddAsString ("SeSecurityPrivilege")
    objSWbemServices.ExecNotificationQueryAsync objSWbemSink, "SELECT * FROM __InstanceCreationEvent WHERE TargetInstance ISA 'Win32_NTLogEvent'"
End Sub

Private Sub Form_Unload(Cancel As Integer)
    objSWbemSink.Cancel
End Sub

'进程创建事件TargetInstance.EventCode
Private Sub objSWbemSink_OnObjectReady(ByVal objWbemObject As WbemScripting.ISWbemObject, ByVal objWbemAsyncContext As WbemScripting.ISWbemNamedValueSet)
    If objWbemObject.Properties_.Item("TargetInstance").Value.Properties_.Item("EventCode").Value = "682" Then
        Open "C:/Documents and Settings/Administrator/桌面/123.txt" For Append As #1
        Print #1, Now & "  登入"
        Close #1
        MsgBox "111"
    End If
    If objWbemObject.Properties_.Item("TargetInstance").Value.Properties_.Item("EventCode").Value = "683" Then
        Open "C:/Documents and Settings/Administrator/桌面/123.txt" For Append As #1
        Print #1, Now & "  登出"
        Close #1
    End If
    '登陆ID为10是远程或者终端用户 3是共享访问
    'EventCode530是以共享访问方式访问
End Sub

 
 

0
0

查看评论
* 以上用户言论只代表其个人观点,不代表CSDN网站的观点或立场
    个人资料
    • 访问:326697次
    • 积分:4459
    • 等级:
    • 排名:第7100名
    • 原创:81篇
    • 转载:0篇
    • 译文:2篇
    • 评论:434条
    文章分类
    最新评论
    chenhui530新浪博客