Prerequisites

• Ensure that PowerShell ISE or a PowerShell terminal is opened with Administrator privileges.
• The system should have the necessary access permissions to monitor the specified folders and process.
• Modify the script to suit your environment by adjusting paths, process names, and other configurations as needed.

How to run the script

1. Open PowerShell ISE or PowerShell as Administrator:
• Right-click the PowerShell ISE or terminal icon and select “Run as Administrator”.
2. Copy and Paste the Script:
• Copy the entire script below into PowerShell ISE or your preferred editor.
3. Modify Variables (if needed):
• $logPath: Path to the directory where logs will be stored. Change this as required.
• $processName: The process name you want to monitor (without .exe).
• $foldersToMonitor: List of folders to monitor for file changes. You can add more folder paths as needed.
• $logSizeLimit: Size limit for log files (default is 1MB, adjust as needed).
• $maxRunTimeHours: The maximum number of hours the script will run for process monitoring.
4. Run the Script:
• Press the “Run” button or press F5 in PowerShell ISE to execute the script.
5. Stopping the Script:
• The script runs indefinitely, monitoring the process and folders until you manually stop it.
• To stop the script, press Ctrl+C in the PowerShell terminal.

Key features of the script

1. Process Monitoring:
• The script monitors a process (like cloudmeteringhost) for its activity, including CPU and memory usage.
• The log entry includes the process ID, CPU usage, and memory usage.
• If the process is not running, it logs that the process is not found.
• The script runs for a maximum of $maxRunTimeHours (2 hours by default), after which it stops.
2. Folder Monitoring:
• The script monitors specified folders for file creation, deletion, and modification events.
• It captures and logs the timestamp, file path, and type of file operation.
• Monitoring includes subdirectories as well.
3. Log File Handling:
• All log entries are saved in a log directory defined by $logPath.
• Log files are named based on the current date (ISO format yyyy-MM-dd).
• If a log file exceeds the size limit (1MB by default), it is rotated, and a new log file with a timestamp is created.
• At the start of each new day, a new log file is created.

Sample Use Cases

• System Admin: Monitor a critical system process and track if it crashes or stops working.
• File Monitoring: Keep track of any changes in sensitive directories for auditing purposes.
• Long-Running: Processes: Automatically stop monitoring after a certain period (e.g., 2 hours).

PowerShell Script

# Define the common log folder path

$logPath = "C:\Logs\CloudMeteringLog"  #<<<<<< Change path as needed >>>>>>



# Define the log file size limit in bytes (1MB = 1048576 bytes)

$logSizeLimit = 1048576  #<<<<<< 1 MB, adjust as required >>>>>>



# Define the process name to monitor

$processName = "cloudmeteringhost"  #<<<<<< Change process name (without .exe) >>>>>>



# Define the folder paths to monitor

$foldersToMonitor = @(

    "C:\ProgramData\SnowSoftware\Inventory\Agent\cloudmetering\logs",

    "C:\Program Files\Snow Software\Inventory\Agent"

)



# Maximum runtime for process monitoring in hours

$maxRunTimeHours = 2



# Function to create log folder if it doesn't exist

function Ensure-LogFolder {

    if (!(Test-Path -Path $logPath)) {

        New-Item -Path $logPath -ItemType Directory

        Write-Host "Log folder created: $logPath"

    }

}



# Function to rotate log files (by size or new day)

function RotateLogFile {

    $currentDate = Get-Date -Format "yyyy-MM-dd"

    $logFileName = "$currentDate-FileLog.txt"

    $logFilePath = Join-Path -Path $logPath -ChildPath $logFileName



    if ((Test-Path -Path $logFilePath) -and ((Get-Item $logFilePath).length -ge $logSizeLimit)) {

        $newLogFileName = (Get-Date -Format "yyyy-MM-ddTHH-mm-ss") + "-FileLog.txt"

        $newLogFilePath = Join-Path -Path $logPath -ChildPath $newLogFileName

        Rename-Item -Path $logFilePath -NewName $newLogFileName

        Write-Host "Log file rotated. New log file created: $newLogFilePath"

    }



    $currentDay = Get-Date -Format "yyyy-MM-dd"

    if ($currentDay -ne $global:previousDay) {

        $global:previousDay = $currentDay

        $newLogFileName = $currentDay + "-FileLog.txt"

        $newLogFilePath = Join-Path -Path $logPath -ChildPath $newLogFileName

        if (!(Test-Path -Path $newLogFilePath)) {

            New-Item -Path $newLogFilePath -ItemType File -Force

            Write-Host "New day started. Created new log file: $newLogFilePath"

        }

    }

}



# Function to log output to console and file

function LogOutput {

    param (

        [string]$logEntry

    )



    Write-Host $logEntry

    RotateLogFile



    $logFileName = (Get-Date -Format "yyyy-MM-dd") + "-FileLog.txt"

    $logFilePath = Join-Path -Path $logPath -ChildPath $logFileName



    Add-Content -Path $logFilePath -Value $logEntry

}



# Event: File created

$createdEventAction = {

    $folder = $Event.SourceEventArgs.FullPath

    $file = $Event.SourceEventArgs.Name

    $timestamp = Get-Date -Format "yyyy-MM-ddTHH:mm:ss"

    $logEntry = "$timestamp - New file created in ${folder}: ${file}"

    LogOutput -logEntry $logEntry

}



# Event: File deleted

$deletedEventAction = {

    $folder = $Event.SourceEventArgs.FullPath

    $file = $Event.SourceEventArgs.Name

    $timestamp = Get-Date -Format "yyyy-MM-ddTHH:mm:ss"

    $logEntry = "$timestamp - File deleted from ${folder}: ${file}"

    LogOutput -logEntry $logEntry

}



# Event: File modified

$modifiedEventAction = {

    $folder = $Event.SourceEventArgs.FullPath

    $file = $Event.SourceEventArgs.Name

    $timestamp = Get-Date -Format "yyyy-MM-ddTHH:mm:ss"

    $logEntry = "$timestamp - File modified in ${folder}: ${file}"

    LogOutput -logEntry $logEntry

}



# Function to start monitoring folders for file changes

function Start-MonitoringFolders {

    foreach ($folder in $foldersToMonitor) {

        $watcher = New-Object System.IO.FileSystemWatcher

        $watcher.Path = $folder

        $watcher.IncludeSubdirectories = $true

        $watcher.EnableRaisingEvents = $true



        Register-ObjectEvent -InputObject $watcher -EventName "Created" -Action $createdEventAction

        Register-ObjectEvent -InputObject $watcher -EventName "Deleted" -Action $deletedEventAction

        Register-ObjectEvent -InputObject $watcher -EventName "Changed" -Action $modifiedEventAction



        Write-Host "Started monitoring folder: $folder"

    }

}



# Function to monitor process activity

function Monitor-Process {

    $startTime = Get-Date



    while ($true) {

        RotateLogFile



        $timestamp = Get-Date -Format "yyyy-MM-ddTHH:mm:ss"

        $elapsedTime = (Get-Date) - $startTime

        $elapsedHours = $elapsedTime.TotalHours



        if ($elapsedHours -ge $maxRunTimeHours) {

            Write-Host "Script reached max runtime of $maxRunTimeHours hours. Exiting."

            break

        }



        $processInfo = Get-Process -Name $processName -ErrorAction SilentlyContinue |

            Select-Object Id, ProcessName, CPU, WorkingSet



        if ($processInfo) {

            $logEntry = "$timestamp - Id: $($processInfo.Id), Name: $($processInfo.ProcessName), CPU: $($processInfo.CPU), Memory: $($processInfo.WorkingSet)"

            LogOutput -logEntry $logEntry

        } else {

            $logEntry = "$timestamp - Process $processName is not running."

            LogOutput -logEntry $logEntry

        }



        Start-Sleep -Seconds 5

    }

}



# Main Function to Start All Monitoring

function Start-AllMonitoring {

    Ensure-LogFolder

    Start-MonitoringFolders

    Monitor-Process

}



# Initialize previous day variable

$global:previousDay = Get-Date -Format "yyyy-MM-dd"



# Start the combined monitoring script

Start-AllMonitoring
Write-Host "Logging to: $logPath. Press Ctrl+C to stop the script."