Monitoring the Events (Watch*)
WatchFile: "file_path"
WatchFileDelete: "file_path"
The word WatchFile: is triggered when the specified file appears (is
created) or when its contents is modified.
If the specified file exists at the moment of nnCron startup, the task will
be started if the file has been changed since the moment when nnCron was unloaded
from memory.
The word WatchFileDelete: is triggered when the specified file is deleted (renamed, moved).
Examples:
WatchFile: "c:\flags\urgent.sem" WatchFile: "c:\xxx\test.flg" WatchFileDelete: "c:\flags\del.sem" WatchFileDelete: "c:\xxx\xxx.flg"
Words WatchFile:/WatchFileDelete: can also work with filename masks, but with one limitation: they looks for the first file in the specified directory that matches a mask, and tests just this one file for modification. In other words, if a directory contains more than one file matching a specified mask, WatchFile:/WatchFileDelete: may ignore the fact of creation/modification/deletion of another file matching this mask.
Example:
#( test_watchfile
WatchFile: "c:\xxx\*.sem"
Action:
MSG: "flag detected"
)#
WatchDir: "dir_path" [flag] [modifiers]
Flag (optional):
WatchSubtree
Modifiers (optional):
WATCH-CHANGE-ATTRIBUTES notify of changes to the attributes
WATCH-CHANGE-DIR-NAME notify of changes to the directory name
WATCH-CHANGE-FILE-NAME notify of changes to the file names within directory
WATCH-CHANGE-LAST-WRITE notify of changes to the last modification date (is triggered when new file is created, or existant file is changed, but in not triggered when a file is deleted)
WATCH-CHANGE-SECURITY notify of changes to the access rights
WATCH-CHANGE-SIZE notify of changes to the size
This word is triggered by changes in a specified directory. The modifiers listed above allow a user to specify very precisely which parameters should be watched for changes.
Flag WatchSubtree instructs nnCron to monitor not only a specified directory, but all of its subdirectories as well.
Examples:
\ monitoring all the changes in 'c:\xxx' WatchDir: "c:\xxx" \ monitoring changes of access rights in 'c:\xxx' WatchDir: "c:\xxx" WATCH-CHANGE-SECURITY \ monitoring changes of size of 'c:\xxx' \ and all its subdirectories WatchDir: "c:\xxx" WatchSubtree WATCH-CHANGE-SIZE \ monitoring changes of file names, directory names \ and attributes in 'c:\xxx' WatchDir: "c:\xxx" WATCH-CHANGE-FILE-NAME WATCH-CHANGE-DIR-NAME WATCH-CHANGE-ATTRIBUTES \ monitoring changes of file names, directory names \ and attributes in 'c:\xxx' and all its subdirectories WatchDir: "c:\xxx" WatchSubtree WATCH-CHANGE-FILE-NAME WATCH-CHANGE-DIR-NAME WATCH-CHANGE-ATTRIBUTES
Directory, that does not exists can also be specified as an argument for a word WatchDir:. In this case WatchDir: enters a loop, waiting for specified directory to be created and triggers when directory becomes available. Self-fetching variable MonitorDirTimeout sets the time (in ms) between every loop iteration. The default MonitorDirTimeout value is 60000 ms (60 seconds).
These words are triggered, respectively, by connecting to and disconnecting from your ISP. WatchConnect is also triggered on nnCron startup if an active remote connection exists at that moment.
These words only work in WinNT/2000/XP.
WatchClipboard: "text_pattern"
This word is triggered if the contents of Windows clipboard matches the specified mask.
In text_pattern, you can use either a usual mask (containing characters * and ?) or regular expressions inside of forward slashes: /<regexp>/.
Examples:
\ will be triggered by any changes in the clipboard contents WatchClipboard: "*" \ will be triggered if a name of any executable file \ (e.g. 'nncron.exe') is copied to the clipboard WatchClipboard: "*.exe*" \ will be triggered if a text containing some number \ is copied to the clipboard WatchClipboard: "/.*\d+.*/"
WatchWinCreate: "win_pattern"
WatchWinActivate: "win_pattern"
WatchWinDestroy: "win_pattern"
These words are triggered when a window whose title matches the specified pattern is created (opened), activated or closed, respectively.
Example:
#( test_watchwin
\ the task would be executed
\ if a window of Notepad is opened,
\ or if a window of Opera browser is
\ or if a window of Internet Explorer is closed
WatchWinCreate: "*Notepad"
WatchWinActivate: "Opera*"
WatchWinDestroy: "*Internet Explorer"
Action:
\ ... performing some useful actions
)#
See also Note.
WatchWindow: "win_pattern"
This word is triggered whenever a window appears whose title matches a specified pattern and/or when when a window's title is changed to another one matching this pattern.
Example:
#( test_watchwindow
WatchWindow: "*white*"
Action:
\ ... performing some useful actions
)#
Let's analyze this task. We have set a window title pattern (*white*) to watch for. Now, if there appears a window with a title containing substring "white", or if its title is changed in such a way that the new title contains substring "white", word WatchWindow: will be triggered. For example, WatchWindow: will be triggered if there appears a window titled 'white.txt - Notepad'. WatchWindow: will be also triggered if the title is changed into 'black_and_white.txt - Notepad' (for the new title contains 'white'). If the title is changed to 'black.txt - Notepad', WatchWindow: won't be triggered, for the new title does not contain the substring we are watching for.
It follows, then, that if a window title is changed and the new title does not contain the specified substring, WatchWindow: won't be triggered. If the original title is restored (the one containing this substring), WatchWindow: will be triggered again.
See also Note.
WatchDrive: <drv_letter>
WatchDriveRemove: <drv_letter>
These words are working with different removable data storage devices (removable hard disk drives, USB drives, CD/DVD-ROM drives etc).
The word WatchDrive: is triggered when removable device is connected to your PC (at the moment when specified disk drive letter appears in My Computer folder) or when specified CD/DVD-ROM drive tray is closed.
The word WatchDriveRemove: is triggered when removable device is disconnected from your PC (at the moment when specified disk drive letter disappears from My Computer folder) or when disk is removed from the specified CD/DVD-ROM drive. WatchDriveRemove: is triggered also when closing empty CD/DVD-ROM drive tray, because the system reports, that there is no disk in specified drive.
Use the specified disk drive letter as an argument to the words WatchDrive:/WatchDriveRemove:. If you want to work with all the inserted/removed drives, you can use * mask as well. After WatchDrive:/WatchDriveRemove: words have been used the variable %DRIVE-LETTER% is filled with a letter of currently inserted/removed drive.
Examples:
#( test_watchdrive
WatchDrive: "E"
Action:
START-APP: explorer.exe d:\backup
)#
#( test_watchdriveremove
WatchDriveRemve: "E"
Action:
POWEROFF
)#
#( test_watchdrivemask
WatchDrive: "*"
Action:
S" G" DRIVE-LETTER COMPARE 0=
IF
MSG: "drive G inserted"
ELSE
S" H" DRIVE-LETTER COMPARE 0=
IF
MSG: "drive H inserted"
ELSE
MSG: "unexpected drive (%DRIVE-LETTER%) inserted"
THEN
THEN
)#
Note, please: in order for these words to work properly with CD/DVD-ROM drives, option Autorun must be set to on. In Windows NT/2000/XP this option is toggled on/off in the registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom.
See also: CD-TRAY-EJECT: <drv_letter>, CD-TRAY-CLOSE: <drv_letter>, IS-CD-PRESENT: <drv_letter>
This word is triggered when new entries in WinNT/2000/XP event logs were found. See Working with Event Logs chapter for details.
WatchProc: "proc_pattern"
WatchProcStop: "proc_pattern"
These words are triggered, respectively, by starting or stopping the process specified in the argument. Please note that word WatchProc: (unlike WatchProcStop:) cannot take process identifier (PID) as its argument.
Example:
#( test_proc
\ the task will be started both when the process "wget.exe" is started
\ and when it is ended "wget.exe"
WatchProc: "wget.exe"
WatchProcStop: "wget.exe"
Action:
\ ... performing some useful actions
)#
After words WatchProc:/WatchProcStop: have been used, variable %WATCH-PROC-ID% will contain a string with process identifier (PID).
Example:
#( test_watchprocstop
WatchProc: notepad.exe
Action:
MSG: "PID = %WATCH-PROC-ID%"
)#
WatchRegistryKey: "key_path" [flag] [modifiers]
Flag (optional):
WatchSubtree
Modifiers (optional):
REG-CHANGE-ATTRIBUTES notify of changes to the attributes of the key, such as the security descriptor information.
REG-CHANGE-NAME notify of changes to the key name
REG-CHANGE-LAST-SET notify of changes to the key last modification date
REG-CHANGE-SECURITY notify of changes to the key access rights
This word is triggered by changes in a specified Registry key. The modifiers listed above allow a user to specify very precisely which parameters should be watched for changes.
Flag WatchSubtree instructs nnCron to monitor not only a specified Registry key, but all of its subkeys as well.
Examples:
\ monitoring all the changes of the key WatchRegistryKey: "HKEY_LOCAL_MACHINE\SOFTWARE\test" \ monitoring changes of access rights WatchRegistryKey: "HKEY_LOCAL_MACHINE\SOFTWARE\test" REG-CHANGE-SECURITY \ monitoring changes of the key name and changes of the names \ of all the subkeys WatchRegistryKey: "HKEY_LOCAL_MACHINE\SOFTWARE\test" WatchSubtree REG-CHANGE-NAME \ monitoring changes of the key name and changes of access rights WatchRegistryKey: "HKEY_LOCAL_MACHINE\SOFTWARE\test" REG-CHANGE-NAME REG-CHANGE-SECURITY
WatchLogoff: "username_pattern"
WatchLogon: "username_pattern"
These words are triggered, respectively, when a user tries to log off (end his session) or log on the local computer. They take as their arguments masks of user names.
Examples:
WatchLogon: "vkondakov" \ will be triggered when either user Admin or user Administrator log on the system WatchLogon: "Admi*" \ will be triggered when any user ends his session WatchLogoff: "*"
These words are triggered when computer is shutting down (WatchShutdown) or switching to Hibernate or Standby modes (WatchSuspend). It should be noted that nnCron has no means to stop or suspend the process of shutting the system down or switching it to Hibernate mode when this process is already started, so that if a long task is started on such an event, it may be interrupted before it is complete. Event specifiers WatchShutdown and WatchSuspend were created in order to be used in shorter tasks, e.g. setting up a timer (for example, setting a period of time after which the computer should wake up) or creating a flag file.
If you want to have a choice to intercept the shutdown process, watch the moment, when operating system is querying applications before shutting the computer down (WatchQueryShutdown).
See also WatchQueryShutdown, WatchQuerySuspend, WatchLogoff:
This word is triggered when operating system is querying applications before shutting the computer down. You can use WatchQueryShutdown for example when you want to have a choice to intercept the computer shutdown process.
See also INTERCEPT-SHUTDOWN, CONTINUE-SHUTDOWN.
This word is triggered when applications are queried before switching to Hibernate or Standby modes.
This word is triggered when the system sends a message that the batteries are low.
These words are triggered when the system returns to normal energy consuming after being in Hibernate or Standby modes.
The word WatchResume is triggered, when the system returns to normal mode forced by some user activity (mouse moving or pressing of any key) - for example, after resuming from StandBy mode and when user activity is detected after resuming from Hibernate mode.
WatchResumeAuto is triggered, when the system returns to normal working mode after being in Hibernate or Standby modes regardless of presence or lack of user activity.
Examples:
#( test_watchresume \ will be triggered after resuming from StandBy \ and when user activity will be first detected \ after resuming from Hibernate WatchResume Action: BEEP: 50 500 PAUSE: 100 BEEP: 50 500 )# #( test_watchresumeauto \ will be triggered after resuming from StandBy \ and after resuming from Hibernate WatchResumeAuto Action: BEEP: 50 500 PAUSE: 100 BEEP: 50 500 )# #( test_watchresumecombined \ will be triggered once after resuming from StandBy \ and twice after resuming from Hibernate (right after \ resuming and when user activity will be first detected) WatchResume WatchResumeAuto Action: BEEP: 50 500 PAUSE: 100 BEEP: 50 500 )#
This word is triggered by pressing a specified "hotkey" (keyboard
shortcut), consisting of one or more keys pressed together. It may be advisable
to create hotkeys by combining such keys as CTRL, SHIFT, ALT
or WIN with one of the alphanumerical keys. If a shortcut consists
of two or more keys, they are considered to be pressed simultaneously. The order
of keys and case of alphabetical keys does not matter (^@w è @W^
are the same thing).
A detailed description of symbolic designations of various keys can be found
here.
Examples:
WatchHotKey: "$9" \ 'WIN + 9' WatchHotKey: "^@f" \ 'CTRL + ALT + F' WatchHotKey: "@+z" \ 'ALT + SHIFT + Z' WatchHotKey: "^+w" \ 'CTRL + SHIFT + W' WatchHotKey: "w^+" \ 'CTRL + SHIFT + W'
Virtual key codes can be used as an argument to WatchHotKey: as well. Use WinSpy to find a virtual key code of a specified key. Place the virtual key code inside the curly braces.
Examples:
WatchHotKey: "{0x74}" \ 'F5'
WatchHotKey: "^@{0x7B}" \ 'CTRL + ALT + F12'
WatchHotKey: "^+{0x47}" \ 'CTRL + SHIFT + G'
Attention, please: you can't use virtual key codes, when specifying modifiers-keys (CTRL, SHIFT, ALT, WIN).
WTSWatchConnect
WTSWatchDisconnect
WTSWatchLock
WTSWatchLogoff
WTSWatchLogon
WTSWatchRemoteConnect
WTSWatchRemoteDisconnect
WTSWatchUnlock
A special set of watch-words to work with Windows Terminal Services (WTS). These words are triggered when the respective event happens. Here is a brief description of these events:
WTS_CONSOLE_CONNECT A session was connected to the console session. WTS_CONSOLE_DISCONNECT A session was disconnected from the console session. WTS_REMOTE_CONNECT A session was connected to the remote session. WTS_REMOTE_DISCONNECT A session was disconnected from the remote session. WTS_SESSION_LOGON A user has logged on to the session. WTS_SESSION_LOGOFF A user has logged off the session. WTS_SESSION_LOCK A session has been locked. WTS_SESSION_UNLOCK A session has been unlocked
After WTSWatch* words have been used, variable WATCH-SESSIONID will contain a SessionID number.
Note: Words of WatchWin*: group ignore console windows. This limitation is imposed by the operating system. At the same time, word WIN-EXIST: can work correctly with both with normal and console windows. Therefore, you can attempt to monitor console windows with the help periodical use of WIN-EXIST:.
See also: