Please take a moment to read, to help share the message and support the initiative to tell our leaders to focus on addressing the global world problems, instead of complaining about the effects of their lack of leadership. Be a leader yourself, and share this with as many people as possible. #demandglobalchange //

Please consider donating:


Monitor file age with Operations Manager 2007 (vbscript monitor)

In this post, I will explain one of the techniques to monitor the age of a given file, using vbscript and Operations Manager 2007

This is what the script looks like :

Option Explicit

‘ Script that returns the difference in number of days between now() and
‘ the last modified timestamp of a file
‘ feed the full path to the file as the first parameter
‘ Written by Peter Van Eeckhoutte
‘ Feb 2008

Dim oArgs
Set oArgs = Wscript.Arguments
Dim oAPI
Set oAPI = CreateObject("MOM.ScriptAPI")
if oArgs.Count < 1 Then
‘ If the script is called without the required argument,
‘ create an information event and then quit.
Call oAPI.LogScriptEvent(WScript.ScriptName,101,0,WScript.ScriptName+" script was called without any arguments and was not executed. ")
††† Wscript.Quit -1
End If

Dim objFile
Dim ValueToReturn
Dim oFso
Dim oFile
Dim oBag
Dim filename
Set oFso = CreateObject("Scripting.FileSystemObject")

‘replace single slashes with double slashes
filename = Replace(oArgs(0),"\",\\)
‘see if file exists
if (oFso.FileExists(filename)) Then†
††† set objFile = oFso.GetFile(filename)†
††† ValueToReturn=DateDiff("d",objFile.DateLastModified,Now)
††† ValueToReturn=9999
End If

Set oBag = oAPI.CreatePropertyBag()
Call oBag.AddValue("DaysAgo",ValueToReturn)
Call oAPI.LogScriptEvent(WScript.ScriptName,101,0,ValueToReturn) Call oAPI.Return(oBag)

This is how it works

Open the authoring pane in OpsMgr and go to monitors

Find the Windows Computers (or any other scope that contains computer objects). Create a new unit monitor (Script based, two state monitor) and save the monitor in your custom management pack. Specify a good name, make sure to leave the monitor disabled for now (uncheck the "Monitor is enabled" checkbox at the bottom). We only want to run this script on one server, so we will create an override for this server lateron.

Quick note before continuing : you’ll have to create a monitor for each file that you want to watch. So you can put the name of the server and the name of the file in the monitor name field.

Configure the schedule (e.g. once per day)

Define the script filename (don’t forget the .vbs extension) and set a timeout. This is a just a simple script, so 1 minute will be fine.

Click "Parameters" and enter the absolute path to the file that you want to monitor. (between double quotes)

Paste the entire script from the table above in the Script: field

Expressions :
Unhealthy :
Parameter Name : Property[@Name=’DaysAgo’]
Operator : is greater than
Value :

(Note : as you can see in the script, if the file is not found, the script will return 9999… it’s up to you how you want to deal with that. You can write another monitor that checks for the presence of the file and look at the 9999 value… )

Healthy :
Parameter Name : Property[@Name=’DaysAgo’]
Operator : is less than or equal to
Value :

Finish the monitor by allowing the monitor to create an alert. In the alert description field, you can specify some text :

The file is $Data/Context/Property[@Name=’DaysAgo’]$ days old, which is older than …. days

Save the monitor

Edit the monitor again and create an override for the server that contains the file you want to look at.

Enable the monitor for that server, and wait until it kicks it.

© 2008, Corelan Team (corelanc0d3r). All rights reserved.

Related Posts:

2 Responses to Monitor file age with Operations Manager 2007 (vbscript monitor)

  • Ernie says:

    Hi, thanks for writing this script, I am hoping it will help me out,
    Is it possible to request a few enhancments?

    For example it takes the date/time NOW as a value to workout the age of a file i.e. how much time has elapsed from NOW. I would like to specify a given time (and if possible date) instead of NOW, preferably specified via a Override, or a varibale which can be picked up as a command line parameter.

    Can you kidnly let me know, thanks

Corelan Live training

Since 2011, Corelan GCV has been teaching live win32 exploit dev classes at various security cons and private companies & organizations.

You can read more about the training and schedules here

Demand Global Change

The world needs your help !

Please take a few moments to read the "Demand Global Change Call For Action" document at
Read the full document at and share the message with as many people as possible.

Like the Facebook page, and SHARE it with everyone you know.


Want to support the Corelan Team community ? Click here to go to our donations page.

Want to donate BTC to Corelan Team?

Your donation will help funding server hosting.

Protected by Copyscape Web Plagiarism Tool

Corelan Team Merchandise

You can support Corelan Team by donating or purchasing items from the official Corelan Team merchandising store.

Corelan on IRC

You can chat with us and our friends on #corelan (freenode IRC)