Question

我正在使用WMI监视Win XP计算机上的启动和停止进程

我的代码是这样的：

ManagementEventWatcher m_Create;
ManagementEventWatcher m_Delete;

private void SetMonitors()
{
    string queryStartTrace = "SELECT * FROM Win32_ProcessStartTrace";
    string queryStopTrace = "SELECT * FROM Win32_ProcessStopTrace";

    m_Create = new ManagementEventWatcher(queryStartTrace);
    m_Delete = new ManagementEventWatcher(queryStopTrace);

    m_Create.EventArrived += new EventArrivedEventHandler(this.OnCreationArrived_Event);
    m_Delete.EventArrived += new EventArrivedEventHandler(this.OnDeletionArrived_Event);
}

private void OnCreationArrived_Event(object sender, EventArrivedEventArgs e){...}

private void OnDeletionArrived_Event(object sender, EventArrivedEventArgs e){...}

一切正常。但突然停止工作，不知道为什么。只有在重新启动机器后，它才会恢复正常工作。

修改1 当@Alexandru帮助我时，我指派观察员停止并处理事件：

m_Create.Stopped += new StoppedEventHandler(watcherCreate_Stopped);
m_Create.Disposed += new EventHandler(watcherCreate_Disposed);

m_Delete.Stopped += new StoppedEventHandler(watcherDelete_Stopped);
m_Delete.Disposed += new EventHandler(watcherDelete_Disposed);

并添加了这些方法：

void watcherCreate_Stopped(object sender, StoppedEventArgs e)
{
    if (m_activeWatchers)
        m_watcherCreate.Start();
}

void watcherCreate_Disposed(object sender, EventArgs e)
{
    if (m_activeWatchers)
        m_watcherCreate.Start();
}

void watcherDelete_Disposed(object sender, EventArgs e)
{
    if (m_activeWatchers)
        m_watcherDelete.Start();
}

void watcherDelete_Stopped(object sender, StoppedEventArgs e)
{
    if (m_activeWatchers)
        m_watcherDelete.Start();
}

现在我正在处理一个有趣的问题，已停止的事件被触发 - ＆gt;然后有电话m_Create.Start()，m_Delete.Start()，然后停止事件被触发 - ＆gt; 依此类推直到完全配额......

编辑2 找到此链接ManagementEventWatcher stops raising EventArrived。没有任何有用的答案，但有一些提示 - 我的程序关闭时是否应取消注册WMI事件？

任何帮助？

Answer 1

试试这个：

using System;
using System.Collections.Generic;
using System.Linq;
using System.Management;
using System.Text;
using System.Threading.Tasks;

namespace EventWatcher
{
    class Program
    {
        static void Main(string[] args)
        {
            StartMonitoringProcessCreation();
            StartMonitoringProcessTermination();
            Console.ReadLine();
        }

        private static void StartMonitoringProcessCreation()
        {
            ManagementEventWatcher startWatcher = new ManagementEventWatcher("SELECT * FROM Win32_ProcessStartTrace");
            startWatcher.EventArrived += new EventArrivedEventHandler(startWatcher_EventArrived);
            startWatcher.Stopped += new StoppedEventHandler(startWatcher_Stopped);
            startWatcher.Disposed += new EventHandler(startWatcher_Disposed);
            startWatcher.Start();
        }

        private static void StartMonitoringProcessTermination()
        {
            ManagementEventWatcher stopWatcher = new ManagementEventWatcher("SELECT * FROM Win32_ProcessStopTrace");
            stopWatcher.EventArrived += new EventArrivedEventHandler(stopWatcher_EventArrived);
            stopWatcher.Stopped += new StoppedEventHandler(stopWatcher_Stopped);
            stopWatcher.Disposed += new EventHandler(stopWatcher_Disposed);
            stopWatcher.Start();
        }

        static void startWatcher_EventArrived(object sender, EventArrivedEventArgs e)
        {
            Console.WriteLine("Got creation event.");
        }

        static void startWatcher_Stopped(object sender, StoppedEventArgs e)
        {
            Console.WriteLine("The startWatcher has stopped. Disposing it.");
            ((ManagementEventWatcher)sender).Dispose();
        }

        static void startWatcher_Disposed(object sender, EventArgs e)
        {
            Console.WriteLine("The startWatcher has been disposed. Restarting it.");
            StartMonitoringProcessCreation();
        }

        static void stopWatcher_EventArrived(object sender, EventArrivedEventArgs e)
        {
            Console.WriteLine("Got termination event.");
        }

        static void stopWatcher_Stopped(object sender, StoppedEventArgs e)
        {
            Console.WriteLine("The stopWatcher has stopped. Disposing it.");
            ((ManagementEventWatcher)sender).Dispose();
        }

        static void stopWatcher_Disposed(object sender, EventArgs e)
        {
            Console.WriteLine("The stopWatcher has been disposed. Restarting it.");
            StartMonitoringProcessTermination();
        }
    }
}

修改：由于您已经告诉我的内容，您可能更容易做到这样的事情......

new Thread(() =>
{
    while (true)
    {
        Process[] list = Process.GetProcessesByName("yourProcessName");
        if (list.Length == 0)
            Console.WriteLine("Not running.");
        else
            Console.WriteLine("Running.");
        Thread.Sleep(1000);
    }
}).Start()

c＃：WMI停止触发事件

1 个答案: