c# – 注册流程开始时间的最佳方法是什么？

有关如何将WMI用于流程创建事件的小示例,请参阅下面的代码：

static void Main(string[] args)
{
  using (ManagementEventWatcher eventWatcher =
            new ManagementEventWatcher(@"SELECT * FROM 
   __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'"))
  {
    // Subscribe for process creation notification.
    eventWatcher.EventArrived += ProcessStarted_EventArrived; 
    eventWatcher.Start();
    Console.In.ReadLine();
    eventWatcher.EventArrived -= ProcessStarted_EventArrived;
    eventWatcher.Stop();
  }
}


static void ProcessStarted_EventArrived(object sender,EventArrivedEventArgs e)
{
  ManagementBaSEObject obj = e.NewEvent["TargetInstance"] as ManagementBaSEObject;

  // The Win32_Process class also contains a CreationDate property.
  Console.Out.WriteLine("ProcessName: {0} " + obj.Properties["Name"].Value);
}

开始编辑：

我进一步研究了使用WMI进行流程创建检测,并且使用Win32_ProcessStartTrace类有一个(更多)资源友好解决方案(但需要管理权限)(有关详细信息,请参阅TECHNET)：

using (ManagementEventWatcher eventWatcher =
          new ManagementEventWatcher(@"SELECT * FROM Win32_ProcessStartTrace"))
{
  // Subscribe for process creation notification.
  eventWatcher.EventArrived += ProcessStarted_EventArrived;
  eventWatcher.Start();
  Console.Out.WriteLine("started");
  Console.In.ReadLine();
  eventWatcher.EventArrived -= ProcessStarted_EventArrived;
  eventWatcher.Stop();
}

static void ProcessStarted_EventArrived(object sender,EventArrivedEventArgs e)
{               
  Console.Out.WriteLine("ProcessName: {0} " 
          + e.NewEvent.Properties["ProcessName"].Value);     
}

在此解决方案中,您不必设置轮询间隔.

结束编辑

开始编辑2：

您可以使用Win32_ProcessStopTrace类来监视进程停止事件.要结合进程启动和进程停止事件,请使用Win32_ProcessTrace类.在事件处理程序中使用ClassPath proberty来区分启动/停止事件：

using (ManagementEventWatcher eventWatcher =
       new ManagementEventWatcher(@"SELECT * FROM Win32_ProcessTrace"))
{          
  eventWatcher.EventArrived += Process_EventArrived;
  eventWatcher.Start();
  Console.Out.WriteLine("started");
  Console.In.ReadLine();
  eventWatcher.EventArrived -= Process_EventArrived;
  eventWatcher.Stop();
}

static void Process_EventArrived(object sender,EventArrivedEventArgs e)
{
  Console.Out.WriteLine(e.NewEvent.ClassPath); // Use class path to distinguish
                                               // between start/stop process events.
  Console.Out.WriteLine("ProcessName: {0} " 
      + e.NewEvent.Properties["ProcessName"].Value);     
}

结束编辑2