{"id":6974,"date":"2019-11-14T14:34:25","date_gmt":"2019-11-14T19:34:25","guid":{"rendered":"https:\/\/jdhitsolutions.com\/blog\/?p=6974"},"modified":"2019-11-14T14:34:32","modified_gmt":"2019-11-14T19:34:32","slug":"watching-the-watcher-with-powershell","status":"publish","type":"post","link":"https:\/\/jdhitsolutions.com\/blog\/powershell\/6974\/watching-the-watcher-with-powershell\/","title":{"rendered":"Watching the Watcher with PowerShell"},"content":{"rendered":"<p><a href=\"https:\/\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2019\/11\/ostrich-thumb.jpg\"><img loading=\"lazy\" decoding=\"async\" title=\"ostrich\" style=\"margin: 0px 10px 10px 0px; float: left; display: inline; background-image: none;\" alt=\"ostrich\" src=\"https:\/\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2019\/11\/ostrich-thumb_thumb.jpg\" width=\"104\" height=\"154\" border=\"0\" align=\"left\"><\/a>If you followed along with my recent articles about my PowerShell based backup system, you may recall that I used a PowerShell scheduled job an an event subscriber to monitor for file changes in key folders that I want to back up. I created the scheduled task to run at Windows startup and so far it appears to be working just fine. However, I did catch one instance where the scheduled task stopped. I didn't find any reason, although I didn't dig too deeply either. I simply restarted the scheduled task. But it got me thinking that since I'm relying on this task to log new and changed files, I need to make sure it is watching. In other words, I need to watch the watcher. This is the approach I took.<\/p>\n<p><!--more--><\/p>\n<h2>Checking the Task<\/h2>\n<p>It is simple enough to use Get-ScheduledTask to verify the status.<\/p>\n<p><a href=\"https:\/\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2019\/11\/image-12.png\"><img loading=\"lazy\" decoding=\"async\" title=\"checking scheduled task\" style=\"display: inline; background-image: none;\" alt=\"checking scheduled task\" src=\"https:\/\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2019\/11\/image_thumb-12.png\" width=\"1028\" height=\"192\" border=\"0\"><\/a><\/p>\n<p>If it has stopped, I can use Start-ScheduledTask. Naturally, I don't want to remember to run this several times a day so I took a slightly different approach using my PowerShell profile script. Because I always have a PowerShell session open this seemed like a smart idea. The first thing I do when logging on is to open a PowerShell session. In my PowerShell profile script I added this code.<\/p>\n<pre class=\"lang:ps mark:0 decode:true\">$task = Get-ScheduledTask -taskname DailyWatcher\nif ($Task.state -eq 'Ready') {\n    Write-Host \"Restarting scheduled task $($task.Taskname)\" -ForegroundColor yellow\n    $task | Start-ScheduledTask\n}\n<\/pre>\n<p>I realize this only runs once every few days but it's something. However, because my PowerShell session is pretty much constantly running I can create an event subscriber watching for the scheduled task to change.<\/p>\n<h2>Monitoring the Watcher<\/h2>\n<p>If you recall from earlier articles, an event subscriber only lasts for as long as your PowerShell session is open. That's why I created DailyWatcher subscription in a scheduled task that is constantly running. Since my PowerShell session is open almost as constantly, I can create an interactive event subscriber. If I restart PowerShell, I'll simply get a new version of the event subscriber. In my profile script I added these lines:<\/p>\n<pre class=\"lang:ps mark:0 decode:true\">#create the event subscription to monitor the scheduled task\n. C:\\scripts\\MonitorDailyWatcher.ps1 | Out-Null\n<\/pre>\n<p>Let's take a peek at this script.<\/p>\n<pre class=\"lang:ps mark:0 decode:true\">#requires -version 5.1 \n#requires -module CimCmdlets\n\n#verify the scheduled task exists and bail out if it doesn't.\n$name = \"DailyWatcher\"\nTry {\n    $task = Get-ScheduledTask -TaskName $Name -ErrorAction Stop\n}\ncatch {\n    Throw $_\n    #make sure we bail out\n    return\n}\n\n#if by chance the task is not running, go ahead and start it.\nif ($task.State -ne 'running') {\n    $task | Start-ScheduledTask\n}\n\n&lt;#\nthe scheduled task object is of this CIM type\nMicrosoft.Management.Infrastructure.CimInstance#Root\/Microsoft\/Windows\/TaskScheduler\/MSFT_ScheduledTask\n#&gt;\n\n\n$query = \"Select * from __InstanceModificationEvent WITHIN 10 WHERE TargetInstance ISA 'MSFT_ScheduledTask' AND TargetInstance.TaskName='$Name'\"\n$NS = 'Root\\Microsoft\\Windows\\TaskScheduler'\n\n#define a scriptblock to execute if the event fires\n$Action = {\n $previous =  $Event.SourceEventArgs.NewEvent.PreviousInstance\n $current =  $Event.SourceEventArgs.NewEvent.TargetInstance\n if ($previous.state -eq 'Running' -AND $current.state -ne 'Running') {\n    Write-Host \"[$(Get-Date)] Restarting the DailyWatcher task\" -ForegroundColor green\n    Get-ScheduledTask -TaskName DailyWatcher | Start-ScheduledTask\n }\n}\nRegister-CimIndicationEvent -SourceIdentifier \"TaskChange\" -Namespace $NS -query $query -MessageData \"The task $Name has changed\" -MaxTriggerCount 7 -Action $action\n<\/pre>\n<p>The script is written to be independent of my PowerShell profile. It first verifies that scheduled task exists and bails out with an error if it isn't found. The script will also start the task if it is not running. Now for the good stuff.<\/p>\n<p>One way to create an event subscriber is through WMI. We've always been able to set up something to watch for changes to an instance of something from WMI. But because I think of the WMI-specific cmdlets as deprecated, I am going to use the CIM equivalent commands. The command to create the event subscription is Register-CimIndicationEvent. The key element is the query.<\/p>\n<pre class=\"lang:ps mark:0 decode:true\">$query = \"Select * from __InstanceModificationEvent WITHIN 10 WHERE TargetInstance ISA 'MSFT_ScheduledTask' AND TargetInstance.TaskName='$Name'\"\n<\/pre>\n<p>The __InstanceModificationEvent reference is to a system class that should exist in all namespaces. This class should fire an event whenever a changes is made to a specified type of object. In my query this is specified by using the TargetInstance property and the <em>ISA<\/em> operator. If the modified object is a ScheduledTask, which I discovered by piping Get-ScheduledTask to <a title=\"Read online help for this command\" href=\"http:\/\/go.microsoft.com\/fwlink\/?LinkID=113322\" target=\"_blank\" rel=\"noopener noreferrer\">Get-Member<\/a>, <strong><em>and<\/em><\/strong> if the specific scheduled task name matches my task, an event will be triggered and handled by the event subscriber. The other very important part of this query is the polling. In the query I'm asking to be notified <em>within<\/em> 10 seconds of a change. In other words, check every 10 seconds. You want this number to be small enough to meet your needs but not so small that you end up constantly polling.<\/p>\n<p>The other element in my script is the Action scriptblock. When an event fires, part of the event arguments are references to the previous instance of the object and the new, or target instance. This comes in handy when when want to do something based on a property difference which is more or less what I am doing. If the previous instance was running, and the new instance is not running, then I'll start the scheduled task. It is really that simple.<\/p>\n<p>When&nbsp; my profile runs, I end up with this event subscriber.<\/p>\n<p><a href=\"https:\/\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2019\/11\/image-13.png\"><img loading=\"lazy\" decoding=\"async\" title=\"a PowerShell event subscriber\" style=\"display: inline; background-image: none;\" alt=\"a PowerShell event subscriber\" src=\"https:\/\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2019\/11\/image_thumb-13.png\" width=\"1028\" height=\"329\" border=\"0\"><\/a><\/p>\n<p>If the task stops, the event subscriber runs the action script block, which as written, displays a message using <a title=\"Read online help for this command\" href=\"http:\/\/go.microsoft.com\/fwlink\/?LinkID=113426\" target=\"_blank\" rel=\"noopener noreferrer\">Write-Host<\/a> in my PowerShell session.<\/p>\n<p><a href=\"https:\/\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2019\/11\/image-14.png\"><img loading=\"lazy\" decoding=\"async\" title=\"An alert from the PowerShell event subscriber\" style=\"display: inline; background-image: none;\" alt=\"An alert from the PowerShell event subscriber\" src=\"https:\/\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2019\/11\/image_thumb-14.png\" width=\"1028\" height=\"244\" border=\"0\"><\/a><\/p>\n<p>I'm not expecting this to happen often if at all. This code is more like insurance for me.<\/p>\n<p>Creating a CIM-based event subscription can be a useful management tool. I recommend starting out simple and be sure to read full help and examples.<\/p>\n<p>I'll be back next time with some other fun stuff derived from my PowerShell backup work.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>If you followed along with my recent articles about my PowerShell based backup system, you may recall that I used a PowerShell scheduled job an an event subscriber to monitor for file changes in key folders that I want to back up. I created the scheduled task to run at Windows startup and so far&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"Just published: Watching the Watcher with #PowerShell and a CIMIndicationEvent","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[4],"tags":[387,358,534],"class_list":["post-6974","post","type-post","status-publish","format-standard","hentry","category-powershell","tag-cim","tag-eventsubscriber","tag-powershell"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Watching the Watcher with PowerShell &#8226; The Lonely Administrator<\/title>\n<meta name=\"description\" content=\"Learn how I added another event subscription, this one CIM based, to monitor my PowerShell daily backup system.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/jdhitsolutions.com\/blog\/powershell\/6974\/watching-the-watcher-with-powershell\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Watching the Watcher with PowerShell &#8226; The Lonely Administrator\" \/>\n<meta property=\"og:description\" content=\"Learn how I added another event subscription, this one CIM based, to monitor my PowerShell daily backup system.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/jdhitsolutions.com\/blog\/powershell\/6974\/watching-the-watcher-with-powershell\/\" \/>\n<meta property=\"og:site_name\" content=\"The Lonely Administrator\" \/>\n<meta property=\"article:published_time\" content=\"2019-11-14T19:34:25+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2019-11-14T19:34:32+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2019\/11\/ostrich-thumb_thumb.jpg\" \/>\n<meta name=\"author\" content=\"Jeffery Hicks\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@JeffHicks\" \/>\n<meta name=\"twitter:site\" content=\"@JeffHicks\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Jeffery Hicks\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/powershell\\\/6974\\\/watching-the-watcher-with-powershell\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/powershell\\\/6974\\\/watching-the-watcher-with-powershell\\\/\"},\"author\":{\"name\":\"Jeffery Hicks\",\"@id\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/#\\\/schema\\\/person\\\/d0258030b41f07fd745f4078bdf5b6c9\"},\"headline\":\"Watching the Watcher with PowerShell\",\"datePublished\":\"2019-11-14T19:34:25+00:00\",\"dateModified\":\"2019-11-14T19:34:32+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/powershell\\\/6974\\\/watching-the-watcher-with-powershell\\\/\"},\"wordCount\":771,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/#\\\/schema\\\/person\\\/d0258030b41f07fd745f4078bdf5b6c9\"},\"image\":{\"@id\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/powershell\\\/6974\\\/watching-the-watcher-with-powershell\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/11\\\/ostrich-thumb_thumb.jpg\",\"keywords\":[\"CIM\",\"eventsubscriber\",\"PowerShell\"],\"articleSection\":[\"PowerShell\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/powershell\\\/6974\\\/watching-the-watcher-with-powershell\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/powershell\\\/6974\\\/watching-the-watcher-with-powershell\\\/\",\"url\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/powershell\\\/6974\\\/watching-the-watcher-with-powershell\\\/\",\"name\":\"Watching the Watcher with PowerShell &#8226; The Lonely Administrator\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/powershell\\\/6974\\\/watching-the-watcher-with-powershell\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/powershell\\\/6974\\\/watching-the-watcher-with-powershell\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/11\\\/ostrich-thumb_thumb.jpg\",\"datePublished\":\"2019-11-14T19:34:25+00:00\",\"dateModified\":\"2019-11-14T19:34:32+00:00\",\"description\":\"Learn how I added another event subscription, this one CIM based, to monitor my PowerShell daily backup system.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/powershell\\\/6974\\\/watching-the-watcher-with-powershell\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/powershell\\\/6974\\\/watching-the-watcher-with-powershell\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/powershell\\\/6974\\\/watching-the-watcher-with-powershell\\\/#primaryimage\",\"url\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/11\\\/ostrich-thumb_thumb.jpg\",\"contentUrl\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/11\\\/ostrich-thumb_thumb.jpg\",\"width\":104,\"height\":154},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/powershell\\\/6974\\\/watching-the-watcher-with-powershell\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"PowerShell\",\"item\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/category\\\/powershell\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Watching the Watcher with PowerShell\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/\",\"name\":\"The Lonely Administrator\",\"description\":\"Practical Advice for the Automating IT Pro\",\"publisher\":{\"@id\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/#\\\/schema\\\/person\\\/d0258030b41f07fd745f4078bdf5b6c9\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/jdhitsolutions.com\\\/blog\\\/#\\\/schema\\\/person\\\/d0258030b41f07fd745f4078bdf5b6c9\",\"name\":\"Jeffery Hicks\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/832ae5d438fdcfc1420d720cd1991307927de8a0b12f2342e81c30f773e21098?s=96&d=wavatar&r=pg\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/832ae5d438fdcfc1420d720cd1991307927de8a0b12f2342e81c30f773e21098?s=96&d=wavatar&r=pg\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/832ae5d438fdcfc1420d720cd1991307927de8a0b12f2342e81c30f773e21098?s=96&d=wavatar&r=pg\",\"caption\":\"Jeffery Hicks\"},\"logo\":{\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/832ae5d438fdcfc1420d720cd1991307927de8a0b12f2342e81c30f773e21098?s=96&d=wavatar&r=pg\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Watching the Watcher with PowerShell &#8226; The Lonely Administrator","description":"Learn how I added another event subscription, this one CIM based, to monitor my PowerShell daily backup system.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/jdhitsolutions.com\/blog\/powershell\/6974\/watching-the-watcher-with-powershell\/","og_locale":"en_US","og_type":"article","og_title":"Watching the Watcher with PowerShell &#8226; The Lonely Administrator","og_description":"Learn how I added another event subscription, this one CIM based, to monitor my PowerShell daily backup system.","og_url":"https:\/\/jdhitsolutions.com\/blog\/powershell\/6974\/watching-the-watcher-with-powershell\/","og_site_name":"The Lonely Administrator","article_published_time":"2019-11-14T19:34:25+00:00","article_modified_time":"2019-11-14T19:34:32+00:00","og_image":[{"url":"https:\/\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2019\/11\/ostrich-thumb_thumb.jpg","type":"","width":"","height":""}],"author":"Jeffery Hicks","twitter_card":"summary_large_image","twitter_creator":"@JeffHicks","twitter_site":"@JeffHicks","twitter_misc":{"Written by":"Jeffery Hicks","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/jdhitsolutions.com\/blog\/powershell\/6974\/watching-the-watcher-with-powershell\/#article","isPartOf":{"@id":"https:\/\/jdhitsolutions.com\/blog\/powershell\/6974\/watching-the-watcher-with-powershell\/"},"author":{"name":"Jeffery Hicks","@id":"https:\/\/jdhitsolutions.com\/blog\/#\/schema\/person\/d0258030b41f07fd745f4078bdf5b6c9"},"headline":"Watching the Watcher with PowerShell","datePublished":"2019-11-14T19:34:25+00:00","dateModified":"2019-11-14T19:34:32+00:00","mainEntityOfPage":{"@id":"https:\/\/jdhitsolutions.com\/blog\/powershell\/6974\/watching-the-watcher-with-powershell\/"},"wordCount":771,"commentCount":0,"publisher":{"@id":"https:\/\/jdhitsolutions.com\/blog\/#\/schema\/person\/d0258030b41f07fd745f4078bdf5b6c9"},"image":{"@id":"https:\/\/jdhitsolutions.com\/blog\/powershell\/6974\/watching-the-watcher-with-powershell\/#primaryimage"},"thumbnailUrl":"https:\/\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2019\/11\/ostrich-thumb_thumb.jpg","keywords":["CIM","eventsubscriber","PowerShell"],"articleSection":["PowerShell"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/jdhitsolutions.com\/blog\/powershell\/6974\/watching-the-watcher-with-powershell\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/jdhitsolutions.com\/blog\/powershell\/6974\/watching-the-watcher-with-powershell\/","url":"https:\/\/jdhitsolutions.com\/blog\/powershell\/6974\/watching-the-watcher-with-powershell\/","name":"Watching the Watcher with PowerShell &#8226; The Lonely Administrator","isPartOf":{"@id":"https:\/\/jdhitsolutions.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/jdhitsolutions.com\/blog\/powershell\/6974\/watching-the-watcher-with-powershell\/#primaryimage"},"image":{"@id":"https:\/\/jdhitsolutions.com\/blog\/powershell\/6974\/watching-the-watcher-with-powershell\/#primaryimage"},"thumbnailUrl":"https:\/\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2019\/11\/ostrich-thumb_thumb.jpg","datePublished":"2019-11-14T19:34:25+00:00","dateModified":"2019-11-14T19:34:32+00:00","description":"Learn how I added another event subscription, this one CIM based, to monitor my PowerShell daily backup system.","breadcrumb":{"@id":"https:\/\/jdhitsolutions.com\/blog\/powershell\/6974\/watching-the-watcher-with-powershell\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/jdhitsolutions.com\/blog\/powershell\/6974\/watching-the-watcher-with-powershell\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jdhitsolutions.com\/blog\/powershell\/6974\/watching-the-watcher-with-powershell\/#primaryimage","url":"https:\/\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2019\/11\/ostrich-thumb_thumb.jpg","contentUrl":"https:\/\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2019\/11\/ostrich-thumb_thumb.jpg","width":104,"height":154},{"@type":"BreadcrumbList","@id":"https:\/\/jdhitsolutions.com\/blog\/powershell\/6974\/watching-the-watcher-with-powershell\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"PowerShell","item":"https:\/\/jdhitsolutions.com\/blog\/category\/powershell\/"},{"@type":"ListItem","position":2,"name":"Watching the Watcher with PowerShell"}]},{"@type":"WebSite","@id":"https:\/\/jdhitsolutions.com\/blog\/#website","url":"https:\/\/jdhitsolutions.com\/blog\/","name":"The Lonely Administrator","description":"Practical Advice for the Automating IT Pro","publisher":{"@id":"https:\/\/jdhitsolutions.com\/blog\/#\/schema\/person\/d0258030b41f07fd745f4078bdf5b6c9"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/jdhitsolutions.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/jdhitsolutions.com\/blog\/#\/schema\/person\/d0258030b41f07fd745f4078bdf5b6c9","name":"Jeffery Hicks","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/832ae5d438fdcfc1420d720cd1991307927de8a0b12f2342e81c30f773e21098?s=96&d=wavatar&r=pg","url":"https:\/\/secure.gravatar.com\/avatar\/832ae5d438fdcfc1420d720cd1991307927de8a0b12f2342e81c30f773e21098?s=96&d=wavatar&r=pg","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/832ae5d438fdcfc1420d720cd1991307927de8a0b12f2342e81c30f773e21098?s=96&d=wavatar&r=pg","caption":"Jeffery Hicks"},"logo":{"@id":"https:\/\/secure.gravatar.com\/avatar\/832ae5d438fdcfc1420d720cd1991307927de8a0b12f2342e81c30f773e21098?s=96&d=wavatar&r=pg"}}]}},"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_likes_enabled":true,"jetpack-related-posts":[{"id":6910,"url":"https:\/\/jdhitsolutions.com\/blog\/powershell\/6910\/creating-a-powershell-backup-system-part-2\/","url_meta":{"origin":6974,"position":0},"title":"Creating a PowerShell Backup System Part 2","author":"Jeffery Hicks","date":"November 8, 2019","format":false,"excerpt":"Yesterday I began a series of articles documenting my PowerShell based backup system. The core of my system is using the System.IO.FileSystemWatcher as a means to track daily file changes so I know what to backup. However there are some challenges. I need to watch several folders, I need to\u2026","rel":"","context":"In &quot;PowerShell&quot;","block_context":{"text":"PowerShell","link":"https:\/\/jdhitsolutions.com\/blog\/category\/powershell\/"},"img":{"alt_text":"Checking pending files","src":"https:\/\/i0.wp.com\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2019\/11\/image_thumb-5.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2019\/11\/image_thumb-5.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2019\/11\/image_thumb-5.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2019\/11\/image_thumb-5.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":2297,"url":"https:\/\/jdhitsolutions.com\/blog\/powershell\/2297\/sql-saturday-129-session-material\/","url_meta":{"origin":6974,"position":1},"title":"SQL Saturday 129 Session Material","author":"Jeffery Hicks","date":"May 14, 2012","format":false,"excerpt":"I spoke this past weekend at a SQL Saturday event in Rochester, NY. My first SQL Saturday event and it was a lot of fun. A great turnout and some very interested attendees. I did three PowerShell sessions on jobs, scheduled jobs\/tasks and an intro to workflows. The latter talk\u2026","rel":"","context":"In &quot;Conferences&quot;","block_context":{"text":"Conferences","link":"https:\/\/jdhitsolutions.com\/blog\/category\/conferences\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2011\/10\/talkbubble-150x150.png?resize=350%2C200","width":350,"height":200},"classes":[]},{"id":6905,"url":"https:\/\/jdhitsolutions.com\/blog\/powershell\/6905\/creating-a-powershell-backup-system\/","url_meta":{"origin":6974,"position":2},"title":"Creating a PowerShell Backup System","author":"Jeffery Hicks","date":"November 7, 2019","format":false,"excerpt":"If you follow me on Twitter, you know that I have a monthly tweet reminder about running and testing backups. I have to say that the concept of a backup is different today than it was when I started in IT. Now we have cheap disk storage and cloud services.\u2026","rel":"","context":"In &quot;PowerShell&quot;","block_context":{"text":"PowerShell","link":"https:\/\/jdhitsolutions.com\/blog\/category\/powershell\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2019\/11\/image_thumb-4.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2019\/11\/image_thumb-4.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2019\/11\/image_thumb-4.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2019\/11\/image_thumb-4.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":4471,"url":"https:\/\/jdhitsolutions.com\/blog\/powershell\/4471\/friday-fun-tickle-me-powershell\/","url_meta":{"origin":6974,"position":3},"title":"Friday Fun: Tickle Me PowerShell!","author":"Jeffery Hicks","date":"July 24, 2015","format":false,"excerpt":"I work at home for myself which means I have to act as my own assistant, reminding me of important events and tasks. And sometimes I need a little help. So why not use PowerShell? In the past I've used and written about using a background job to wait until\u2026","rel":"","context":"In &quot;Friday Fun&quot;","block_context":{"text":"Friday Fun","link":"https:\/\/jdhitsolutions.com\/blog\/category\/friday-fun\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1956,"url":"https:\/\/jdhitsolutions.com\/blog\/scripting\/1956\/using-start-job-as-a-scheduled-task\/","url_meta":{"origin":6974,"position":4},"title":"Using Start-Job as a Scheduled Task","author":"Jeffery Hicks","date":"January 5, 2012","format":false,"excerpt":"Here's a technique you might want to use for ad hoc troubleshooting or reporting. Even though it is possible to set up scheduled tasks to run PowerShell commands or scripts, it is cumbersome and time consuming. PowerShell v3 offers a great alternative, but I'll cover that another day. Suppose I\u2026","rel":"","context":"In &quot;PowerShell v2.0&quot;","block_context":{"text":"PowerShell v2.0","link":"https:\/\/jdhitsolutions.com\/blog\/category\/powershell-v2-0\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":4414,"url":"https:\/\/jdhitsolutions.com\/blog\/powershell\/4414\/converting-timespans-to-repetition-patterns\/","url_meta":{"origin":6974,"position":5},"title":"Converting Timespans to Repetition Patterns","author":"Jeffery Hicks","date":"May 26, 2015","format":false,"excerpt":"Over on Petri.com, I've recently published a followup article about creating daily or weekly scheduled PowerShell jobs that support a repetition interval. The short answer is to use the Scheduled Tasks cmdlets. In the Petri article I talk about needing to use a special string format for the timespan. It\u2026","rel":"","context":"In &quot;Petri IT Knowledgebase&quot;","block_context":{"text":"Petri IT Knowledgebase","link":"https:\/\/jdhitsolutions.com\/blog\/category\/petri-it-knowledgebase\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]}],"_links":{"self":[{"href":"https:\/\/jdhitsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/6974","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jdhitsolutions.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jdhitsolutions.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jdhitsolutions.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jdhitsolutions.com\/blog\/wp-json\/wp\/v2\/comments?post=6974"}],"version-history":[{"count":0,"href":"https:\/\/jdhitsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/6974\/revisions"}],"wp:attachment":[{"href":"https:\/\/jdhitsolutions.com\/blog\/wp-json\/wp\/v2\/media?parent=6974"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jdhitsolutions.com\/blog\/wp-json\/wp\/v2\/categories?post=6974"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jdhitsolutions.com\/blog\/wp-json\/wp\/v2\/tags?post=6974"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}