Powershell - Monitoring folder Content - powershell

Question

I would like to be able to monitor the changes in a folder for a short period of time when a lot of files will be created and other changes will be made.
The code below is working but doesn't catch all the changes.
$folder = ’C:\Data’
$timeout = 1000
$FileSystemWatcher = New-Object System.IO.FileSystemWatcher $folder
Write-Host ”Press CTRL+C to abort monitoring $folder”
while ($true) {
$result = $FileSystemWatcher.WaitForChanged(‘all’, $timeout)
if ($result.TimedOut -eq $false)
{
Write-Warning (‘File {0} : {1}’ -f $result.ChangeType, $result.name)
}
}
Write-Host ’Monitoring aborted.’
If I use this on C:\Data it works but:
I create a .txt and it says 2 times new text document.txt.
Then I fill the name for the new txt and it outputs it 3 times. Or the other way around.
Please see below the output of
creating a hello.txt in my folder
creating a new folder with the name HiThere and
then renaming hello.txt to someTxt.txt
then deleting them both
output:
`Press CTRL+C to abort monitoring C:\Data
WARNING: File Created : New Text Document.txt
WARNING: File Changed : New Text Document.txt
WARNING: File Changed : New Text Document.txt
WARNING: File Changed : hello.txt
WARNING: File Created : New folder
WARNING: File Renamed : HiThere
WARNING: File Renamed : someTxt.txt
WARNING: File Changed : someTxt.txt
WARNING: File Changed : someTxt.txt
WARNING: File Changed : someTxt.txt
WARNING: File Deleted : someTxt.txt
WARNING: File Deleted : HiThere`
More problems: If I use this on a newtwork drive then not all the changes are being catched. (And this would be the point of this script, to monitor a folder from a mapped drive).
Test the code on your machine by only changing the folder path.
Using Powershell ISE 3.0

Answer 1

Insted of the while($true) loop, have you tried the "Register-ObjectEvent"?
I just tested one of my script using this method and could easily take 2000 empty files (generated in powershell). Unfortunatly, this was on a local machine.
Instructions: Define function like normal and off you go.
The command you use is:
Start-BackupScript -WatchFolder "C:\temp\my watch folder\" -DestinationFolder "C:\temp\backup\"
The script now monitors "C:\temp\my watch folder\" for new files created in that specific folder and will move them to "C:\temp\backup\". It will also append the date and time to the file.
Lets say you have started the script with the parameters above. You now place "hello_world.txt" in the watch folder. The script will move the file to "C:\temp\backup\" with the new filename being: "hello_world_2016-02-10_10-00-00.txt"
The script runs in the background. If you want to know how it's doing, then use the command:
Get-Job $backupscript -Keep
There you can see what it has been doing when. Please note that the -Keep parameter keeps the output in the "log", so you can check it later.
Script:
function Start-BackupScript
{
[CmdletBinding()]
Param
(
[Parameter()]
[String]$WatchFolder,
[Parameter()]
[String]$DestinationFolder
)
Process
{
$filter = '*.*'
$fsw = New-Object IO.FileSystemWatcher $WatchFolder, $filter -Property #{IncludeSubdirectories = $false;NotifyFilter = [IO.NotifyFilters]'FileName, LastWrite'}
$action = {
$fileMissing = $false
$FileInUseMessage = $false
$copied = $false
$file = Get-Item $Args.FullPath
$dateString = Get-Date -format "_yyyy-MM-dd_HH-mm-ss"
$DestinationFolder = $event.MessageData
$DestinationFileName = $file.basename + $dateString + $file.extension
$resultfilename = Join-Path $DestinationFolder $DestinationFileName
Write-Output ""
while(!$copied) {
try {
Move-Item -Path $file.FullName -Destination $resultfilename -ErrorAction Stop
$copied = $true
}
catch [System.IO.IOException] {
if(!$FileInUseMessage) {
Write-Output "$(Get-Date -Format "yyyy-MM-dd # HH:mm:ss") - $file in use. Waiting to move file"
$FileInUseMessage = $true
}
Start-Sleep -s 1
}
catch [System.Management.Automation.ItemNotFoundException] {
$fileMissing = $true
$copied = $true
}
}
if($fileMissing) {
Write-Output "$(Get-Date -Format "yyyy-MM-dd # HH:mm:ss") - $file not found!"
} else {
Write-Output "$(Get-Date -Format "yyyy-MM-dd # HH:mm:ss") - Moved $file to backup! `n`tFilename: `"$resultfilename`""
}
}
$backupscript = Register-ObjectEvent -InputObject $fsw -EventName "Created" -Action $action -MessageData $DestinationFolder
Write-Host "Started. WatchFolder: `"$($WatchFolder)`" DestinationFolder: `"$($DestinationFolder)`". Job is in: `$backupscript"
}
}

Answer 2

Have you looked at Register-WMIEvent?
Something like this:
Register-WmiEvent -Query "SELECT * FROM __InstanceModificationEvent WITHIN 5 WHERE TargetInstance ISA 'CIM_DataFile' and TargetInstance.Path = '\\Users\\Administrator\\' and targetInstance.Drive = 'C:' and (targetInstance.Extension = 'txt' or targetInstance.Extension = 'doc' or targetInstance.Extension = 'rtf') and targetInstance.LastAccessed > '$($cur)' " -sourceIdentifier "Accessor" -Action $action `
You can monitor a folder and then specific extensions within the folder. And then you set up a PowerShell scriptblock to handle any accesses. There's more here on this if you're interested: https://blog.varonis.com/practical-powershell-for-it-security-part-i-file-event-monitoring/
Agree with some of the comments above that file monitoring is not reliable -- lags and hiccups. Anywyay, hope this helps.