Monitor -> New -> Scripting -> Timed Script Two State Monitor

Parameters
[ProcessName.exe] [WorkingSetLimit(MB)]

State Expression
For Unhealthy Expression Property[@Name='State'] Equals Good
For Healthy Expresion Property[@Name='State'] Equals Bad

Alert Description
$Data/Context/Property[@Name='Message']$

----------------------------------------------------------------------------------------------

 'Parameter [ProcessName.exe] [WorkingSetLimit(MB)]

    Dim oAPI, oBag
    Set oAPI = CreateObject("MOM.ScriptAPI")
    Set oBag = oAPI.CreatePropertyBag()

    Set oArgs  = WScript.Arguments
    strTaskName = oArgs(0)
    strWorkingSet = oArgs(1)

    Set oArgs = nothing
    Set shellobj = WScript.CreateObject("WScript.Shell")
    State = "Good"

    Const wbemFlagReturnImmediately = &h10
    Const wbemFlagForwardOnly = &h20

    strComputer = "."

    Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\CIMV2")
    Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_Process where name ='" & strTaskName & "'", "WQL", wbemFlagReturnImmediately + wbemFlagForwardOnly)

    For Each objItem In colItems
    if clng(objItem.WorkingSetSize/(1024*1024)) > clng(strWorkingSet) then

    strMsg = objItem.Name & "(이)가 WorkingSet 임계치(" & strWorkingSet & "MB)를 초과합니다. " & objItem.Name & "의 현재 WorkingSet은 " & clng(objItem.WorkingSetSize/(1024*1024)) & "MB 입니다."
    State = "Bad"
    end if
    Next

    Set shellobj = nothing

    Call oBag.AddValue("State",State)
    Call oBag.AddValue("Message",strMsg)
    Call oAPI.Return(oBag)

strFolder = "C:\TEMP"
strExtensionUp = "TXT"
strExtensionLo = "txt"
DateDiffer = -30

Set dateTime = CreateObject("WbemScripting.SWbemDateTime")

Dim strFileName(), strFileCre(), Differ(), DelList()
strComputer = "."

Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colItems = objWMIService.ExecQuery("Select * from Win32_OperatingSystem")

For Each objItem in colItems
dateTime.Value = objItem.LocalDateTime
strToday = dateTime.GetVarDate
Next

Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colFileList = objWMIService.ExecQuery _
    ("ASSOCIATORS OF {Win32_Directory.Name='" & strFolder & "'} Where " _
        & "ResultClass = CIM_DataFile")

ReDim Preserve strFileName(colFileList.count), strFileCre(colFileList.count), Differ(colFileList.count), DelList(colFileList.count)

n = 0
d = 0
For Each objFile In colFileList
If objFile.Extension = strExtensionUp or objFile.Extension = strExtensionLo Then
strFileName(n) = objFile.Name
dateTime.Value = objFile.CreationDate
strFileCre(n) = dateTime.GetVarDate
Differ(n) = DateDiff ("D", strToday, strFileCre(n))
If Differ(n) < DateDiffer Then
DelList(d) = strFileName(n)
d = d + 1
End If
n = n + 1
End If
Next

strMessage = DateDiffer & "일 보다 오래된 다음 백업 파일들을 삭제합니다." & vbCrLf & vbCrLf
For i = 0 to d
strMessage = strMessage & DelList(i) & vbCrLf
Next

If d = 0 Then WScript.Quit

set objWSHShell = Wscript.CreateObject("Wscript.Shell")
WriteEvent = objWSHShell.LogEvent(4, strMessage, strComputer)

For i = 0 to d-1
strFilePath = DelList(i)
reFile = Replace(strFilePath,"\","\\")
set objFile = GetObject("winmgmts:\\"& strComputer & "\root\cimv2:CIM_Datafile.Name='" & reFile & "'")
objFile.Delete
Next

strMessage = ""

set shellobj=WScript.CreateObject("WScript.Shell")

Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objTextFile = objFSO.OpenTextFile (".\RUNNETSTAT.BAT", 8, True)

objTextFile.WriteLine("netstat -an | findstr " & Chr(34) & "168.126.63.1:53" & Chr(34) & " | findstr " & Chr(34) & "EST" & Chr(34))
objTextFile.Close
set objTextFile = nothing

set execObj=shellobj.Exec(".\RUNNETSTAT.BAT")
OutData=execObj.StdOut.ReadAll()
val=execObj.StdOut.Line - 3

Set aFile = objFSO.GetFile(".\RUNNETSTAT.BAT")
aFile.Delete
Set aFile = nothing

If val = 0 Then
strMsg = MsgBox("Port Error!!",16,"Caution")
End If

set OutData = nothing
set execObj = nothing
set shellobj = nothing

GetVolumeGUID.vbs


strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colItems = objWMIService.ExecQuery("Select * from Win32_Volume")

For Each objItem In colItems
    WScript.Echo "Automount: " & objItem.Automount
    WScript.Echo "Block Size: " & objItem.BlockSize
    WScript.Echo "Capacity: " & objItem.Capacity
    WScript.Echo "Caption: " & objItem.Caption
    WScript.Echo "Compressed: " & objItem.Compressed
    WScript.Echo "Device ID: " & objItem.DeviceID
    WScript.Echo "Dirty Bit Set: " & objItem.DirtyBitSet
    WScript.Echo "Drive Letter: " & objItem.DriveLetter
    WScript.Echo "Drive Type: " & objItem.DriveType
    WScript.Echo "File System: " & objItem.FileSystem
    WScript.Echo "Free Space: " & objItem.FreeSpace
    WScript.Echo "Indexing Enabled: " & objItem.IndexingEnabled
    WScript.Echo "Label: " & objItem.Label
    WScript.Echo "Maximum File Name Length: " & objItem.MaximumFileNameLength
    WScript.Echo "Name: " & objItem.Name
    WScript.Echo "Quotas Enabled: " & objItem.QuotasEnabled
    WScript.Echo "Quotas Incomplete: " & objItem.QuotasIncomplete
    WScript.Echo "Quotas Rebuilding: " & objItem.QuotasRebuilding
    WScript.Echo "Serial Number: " & objItem.SerialNumber
    WScript.Echo "Supports Disk Quotas: " & objItem.SupportsDiskQuotas
    WScript.Echo "Supports File-Based Compression: " & _
        objItem.SupportsFileBasedCompression
    WScript.Echo
Next

getProcessNUM.vbs
arguement => Process1.exe,Process2.exe,Process3.exe......

Object : Process
Counter : NumberOfProcess
Instance : $Data/Property[@Name='ProcessName']$
Value : $Data/Property[@Name='PerfValue']$

--------------------------------------------------------------------------------------------------

strProcess = Split(oArgs.Item(0), ",")
For Each sProcess In strProcess
getProcessNUM(sProcess)
Next
oAPI.ReturnItems

Sub getProcessNUM(ProcessName)
Set cProcessResult = GetObject("winmgmts://./root/cimv2").ExecQuery("SELECT * FROM Win32_Process WHERE name = '" & ProcessName & "'")
perfValue= 0.0
perfValue= cdbl(cProcessResult.count)
Set propertyBag = oAPI.CreatePropertyBag()
propertyBag.AddValue "ProcessName", ProcessName
propertyBag.AddValue "PerfValue", PerfValue
oAPI.AddItem(propertyBag)
Call oAPI.Return(propertyBag)
Set cProcessResult = Nothing
End Sub

Rule > New > Probe based > Script(performance)

Object, Counter, Instance 적당한 값
Value: $Data/Property[@Name='Used Memory']$

-----------------------------------------------------------------------------------------------

UsedMemory.vbs


Dim oAPI, oBag
Set oAPI = CreateObject("MOM.ScriptAPI")
Set oBag = oAPI.CreatePropertyBag()

strComputer = "."
Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set strFreeMemory = objWMIService.ExecQuery ("Select * from Win32_OperatingSystem")
For Each Free In strFreeMemory
valFreeMemory = Free.FreePhysicalMemory / 1024
Next
Set strFreeMemory = Nothing

Set strTotalMemory = objWMIService.ExecQuery ("Select * from Win32_ComputerSystem")
For Each Total In strTotalMemory
valTotalMemory = Total.TotalPhysicalMemory / 1048576
Next
Set strTotalMemory = Nothing

val = valTotalMemory - valFreeMemory

Call oBag.AddValue("Used Memory",val)
Call oAPI.Return(oBag)

Checking Registry Key Access Rights
const KEY_QUERY_VALUE = &H0001
const KEY_SET_VALUE = &H0002
const KEY_CREATE_SUB_KEY = &H0004
const DELETE = &H00010000
const HKEY_LOCAL_MACHINE = &H80000002

strComputer = "."
Set StdOut = WScript.StdOut
Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &_
strComputer & "\root\default:StdRegProv")

strKeyPath = "SYSTEM\CurrentControlSet"

oReg.CheckAccess HKEY_LOCAL_MACHINE, strKeyPath, KEY_QUERY_VALUE, _
bHasAccessRight
If bHasAccessRight = True Then
StdOut.WriteLine "Have Query Value Access Rights on Key"
Else
StdOut.WriteLine "Do Not Have Query Value Access Rights on Key"
End If

oReg.CheckAccess HKEY_LOCAL_MACHINE, strKeyPath, KEY_SET_VALUE, _
bHasAccessRight
If bHasAccessRight = True Then
StdOut.WriteLine "Have Set Value Access Rights on Key"
Else
StdOut.WriteLine "Do Not Have Set Value Access Rights on Key"
End If

oReg.CheckAccess HKEY_LOCAL_MACHINE, strKeyPath, KEY_CREATE_SUB_KEY, _
bHasAccessRight
If bHasAccessRight = True Then
StdOut.WriteLine "Have Create SubKey Access Rights on Key"
Else
StdOut.WriteLine "Do Not Have Create SubKey Access Rights on Key"
End If

oReg.CheckAccess HKEY_LOCAL_MACHINE, strKeyPath, DELETE, bHasAccessRight
If bHasAccessRight = True Then
StdOut.WriteLine "Have Delete Access Rights on Key"
Else
StdOut.WriteLine "Do Not Have Delete Access Rights on Key"
End If

---------------------------------------------------------------------------------------------------------------

Reading a Binary Registry Value
const HKEY_LOCAL_MACHINE = &H80000002
strComputer = "."
Set StdOut = WScript.StdOut
Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &_
strComputer & "\root\default:StdRegProv")

strKeyPath = "SOFTWARE\Microsoft\Windows NT\CurrentVersion"
strValueName = "LicenseInfo"

oReg.GetBinaryValue HKEY_LOCAL_MACHINE,strKeyPath,_
strValueName,strValue
For i = lBound(strValue) to uBound(strValue)
 StdOut.WriteLine  strValue(i)
Next

---------------------------------------------------------------------------------------------------------------

Reading an Expanded String Value
const HKEY_LOCAL_MACHINE = &H80000002
strComputer = "."
Set StdOut = WScript.StdOut
Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &_
strComputer & "\root\default:StdRegProv")

strKeyPath = "SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon"
strValueName = "UIHost"
oReg.GetExpandedStringValue HKEY_LOCAL_MACHINE,strKeyPath,_
strValueName,strValue

StdOut.WriteLine  "The Windows logon UI host is: " & strValue

---------------------------------------------------------------------------------------------------------------

Reading a MultiString Value
const HKEY_LOCAL_MACHINE = &H80000002
strComputer = "."
Set StdOut = WScript.StdOut
Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &_
strComputer & "\root\default:StdRegProv")

strKeyPath = "SYSTEM\CurrentControlSet\Services\Eventlog\System"
strValueName = "Sources"

oReg.GetMultiStringValue HKEY_LOCAL_MACHINE,strKeyPath,_
strValueName,arrValues
For Each strValue In arrValues
 StdOut.WriteLine  strValue
Next

---------------------------------------------------------------------------------------------------------------

Reading String and DWORD Values
const HKEY_CURRENT_USER = &H80000001
const HKEY_LOCAL_MACHINE = &H80000002
strComputer = "."
Set StdOut = WScript.StdOut
Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &_
strComputer & "\root\default:StdRegProv")

strKeyPath = "Console"
strValueName = "HistoryBufferSize"
oReg.GetDWORDValue HKEY_CURRENT_USER,strKeyPath,strValueName,dwValue
StdOut.WriteLine "Current History Buffer Size: " & dwValue

strKeyPath = "SOFTWARE\Microsoft\Windows Script Host\Settings"
strValueName = "TrustPolicy"
oReg.GetStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strValue
StdOut.WriteLine "Current WSH Trust Policy Value: " & strValue

---------------------------------------------------------------------------------------------------------------

Creating Expanded String Values
const HKEY_LOCAL_MACHINE = &H80000002
strComputer = "."
Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &_
strComputer & "\root\default:StdRegProv")

strKeyPath = "SOFTWARE\Key Name"
strValueName = "Expanded String Value Name"

strValue = "%PATHEXT%"
oReg.SetExpandedStringValue _
HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strValue

---------------------------------------------------------------------------------------------------------------

Creating a Registry Key
const HKEY_LOCAL_MACHINE = &H80000002
strComputer = "."
Set StdOut = WScript.StdOut

Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &_
strComputer & "\root\default:StdRegProv")

strKeyPath = "SOFTWARE\Key Name"
oReg.CreateKey HKEY_LOCAL_MACHINE,strKeyPath

---------------------------------------------------------------------------------------------------------------

Creating String and DWORD Values
const HKEY_LOCAL_MACHINE = &H80000002
strComputer = "."
Set StdOut = WScript.StdOut
Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &_
strComputer & "\root\default:StdRegProv")

strKeyPath = "SOFTWARE\Key Name"
strValueName = "String Value Name"
strValue = "string value"

oReg.SetStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strValue

strValueName = "DWORD Value Name"
dwValue = 82

oReg.SetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,dwValue

---------------------------------------------------------------------------------------------------------------

Deleting Registry Values
const HKEY_LOCAL_MACHINE = &H80000002
strComputer = "."
Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &_
strComputer & "\root\default:StdRegProv")

strKeyPath = "SOFTWARE\Key Name"
strDWORDValueName = "DWORD Value Name"
strExpandedStringValueName = "Expanded String Value Name"
strMultiStringValueName = "Multi String Value Name"
strStringValueName = "String Value Name"

oReg.DeleteValue HKEY_LOCAL_MACHINE,strKeyPath,strDWORDValueName
oReg.DeleteValue HKEY_LOCAL_MACHINE,strKeyPath,strExpandedStringValueName
oReg.DeleteValue HKEY_LOCAL_MACHINE,strKeyPath,strMultiStringValueName
oReg.DeleteValue HKEY_LOCAL_MACHINE,strKeyPath,strStringValueName

---------------------------------------------------------------------------------------------------------------

Enumerating Registry Properties
On Error Resume Next
strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colItems = objWMIService.ExecQuery("Select * from Win32_Registry")
For Each objItem in colItems
Wscript.Echo "Current Size: " & objItem.CurrentSize
Wscript.Echo "Description: " & objItem.Description
Wscript.Echo "Install Date: " & objItem.InstallDate
Wscript.Echo "Maximum Size: " & objItem.MaximumSize
Wscript.Echo "Name: " & objItem.Name
Wscript.Echo "Proposed Size: " & objItem.ProposedSize
Next

---------------------------------------------------------------------------------------------------------------

Enumerating Registry Values and Types
const HKEY_LOCAL_MACHINE = &H80000002
const REG_SZ = 1
const REG_EXPAND_SZ = 2
const REG_BINARY = 3
const REG_DWORD = 4
const REG_MULTI_SZ = 7
 
strComputer = "."
Set StdOut = WScript.StdOut
Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &_
strComputer & "\root\default:StdRegProv")

strKeyPath = "SYSTEM\Key Name"

oReg.EnumValues HKEY_LOCAL_MACHINE, strKeyPath,_
arrValueNames, arrValueTypes

For i=0 To UBound(arrValueNames)
StdOut.WriteLine "Value Name: " & arrValueNames(i)
Select Case arrValueTypes(i)
 Case REG_SZ
  StdOut.WriteLine "Data Type: String"
  StdOut.WriteBlankLines(1)
 Case REG_EXPAND_SZ
  StdOut.WriteLine "Data Type: Expanded String"
  StdOut.WriteBlankLines(1)
 Case REG_BINARY
  StdOut.WriteLine "Data Type: Binary"
  StdOut.WriteBlankLines(1)
 Case REG_DWORD
  StdOut.WriteLine "Data Type: DWORD"
  StdOut.WriteBlankLines(1)
 Case REG_MULTI_SZ
  StdOut.WriteLine "Data Type: Multi String"
  StdOut.WriteBlankLines(1)
End Select
Next

Monitor -> New -> Scripting -> Timed Script Two State Monitor

Parameters
[Process1.exe] [Process2.exe] ....

State Expression
For Unhealthy Expression Property[@Name='State'] Equals Good
For Healthy Expresion Property[@Name='State'] Equals Bad

Alert Description
$Data/Context/Property[@Name='Message']$

---------------------------------------------------------------------------------------------------------------

ProcessRunCheck.vbs

Dim oAPI, oBag, oArgs, strProcess(), ProcessState()
strMessage = ""

Set oAPI = CreateObject("MOM.ScriptAPI")
Set oBag = oAPI.CreatePropertyBag()
Set oArgs = WScript.Arguments

ParamCount = oArgs.Count
State = 0

If ParamCount < 1 Then
Call oAPI.LogScriptEvent("ProcessRunCheck.vbs", 5009, 0, "Script aborted. Not enough parameters provided.")
WScript.Quit -1
End If

ReDim Preserve strProcess(ParamCount), ProcessState(ParamCount)

i = 0
Do While i <> ParamCount
strProcess(i) = oArgs(i)
i = i + 1
Loop

i = 0
Do While i <> ParamCount
strComputer = "."
Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set ProcessState(i) = objWMIService.ExecQuery ("Select * from Win32_Process Where Name = '" & strProcess(i) & "'")

If ProcessState(i).Count => 1 Then
Call oBag.Addvalue(strProcess(i),"Running(" & ProcessState(i).Count & "ea)")
strMessage = strMessage & strProcess(i) & ": " & "Running(" & ProcessState(i).Count & "ea)" & " | "
End If

If ProcessState(i).Count < 1 Then
Call oBag.Addvalue(strProcess(i),"Not running")
strMessage = strMessage & strProcess(i) & ": " & "Not running" & " | "
State = 1
End If

Set objWMIService = nothing
i = i + 1
Loop

If State = 0 Then
Call oBag.AddValue("State","Good")
Else
Call oBag.AddValue("State","Bad")
End If

Call oBag.AddValue("Message",strMessage)
Call oAPI.Return(oBag)

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set QFES = objWMIService.execQuery("Select * from Win32_QuickFixEngineering")

For each QFE in QFES
 Wscript.Echo QFE.HotFixID
Next