Question

可能重复：
Track started applications in Windows

我想在C＃中创建一个程序或服务，监视用户何时启动某个应用程序，如excel或access。使用System.Diagnostics.Process，我可以获得正在运行的进程，但我希望在用户启动应用程序时监视该事件。我们想创建一些使用历史。

Answer 1

您可以使用WMI执行此操作：

private ManagementEventWatcher WatchForProcessStart(string processName)
{
    string queryString =
        "SELECT TargetInstance" +
        "  FROM __InstanceCreationEvent " +
        "WITHIN  10 " +
        " WHERE TargetInstance ISA 'Win32_Process' " +
        "   AND TargetInstance.Name = '" + processName + "'";

    // The dot in the scope means use the current machine
    string scope = @"\\.\root\CIMV2";

    // Create a watcher and listen for events
    ManagementEventWatcher watcher = new ManagementEventWatcher(scope, queryString);
    watcher.EventArrived += ProcessStarted;
    watcher.Start();
    return watcher;
}

private void ProcessStarted(object sender, EventArrivedEventArgs e)
{
    ManagementBaseObject targetInstance = (ManagementBaseObject)e.NewEvent.Properties["TargetInstance"].Value;
    string processName = targetInstance.Properties["Name"].Value.ToString();
    Console.WriteLine(String.Format("{0} process started", processName));
}

它会监视10个最新进程的数组，并在更改时调用事件

Answer 2

我使用WqlEventQuery对象做了一个小例子来检查是否有进程的新实例。然后检查名称并按照您的意愿进行操作。如果您想改进我的查询 - 请随时查看相应的syntax description。

private static void lookForExcel()
{
    WqlEventQuery query = new WqlEventQuery("__InstanceCreationEvent", new TimeSpan(0, 0, 1), "TargetInstance isa \"Win32_Process\"");
    ManagementEventWatcher watcher = new ManagementEventWatcher(query);
    watcher.EventArrived += new EventArrivedEventHandler(watcher_EventArrived);
    watcher.Start();
    Console.ReadLine();
    watcher.Stop();
}

static void watcher_EventArrived(object sender, EventArrivedEventArgs e)
{
    string instanceName = ((ManagementBaseObject)e.NewEvent["TargetInstance"])["Name"].ToString();
    if (instanceName.ToLower()=="excel.exe")
    {
        Debug.WriteLine("Excel has been started ...");    
    }            
}

Answer 3

最简单的方法是定期检查正在运行的进程，并与之前的列表进行比较。

但是，您可以获得有关流程启动的通知。文档：

http://msdn.microsoft.com/en-us/library/windows/desktop/aa393013(v=vs.85).aspx

您还可以在安全事件日志中启用“详细跟踪”，然后将显示系统上启动和结束的每个进程。那可能太过分了。

如何监控用户在c＃中启动Excel等Windows应用程序的时间

3 个答案: