Question

我有两个ManagementEventWatcher在侦听以下查询：

SELECT * FROM Win32_ProcessStartTrace

...和...

SELECT * FROM Win32_ProcessStopTrace

    private ManagementEventWatcher processStartEvent = new ManagementEventWatcher("SELECT * FROM Win32_ProcessStartTrace");
    private ManagementEventWatcher processStopEvent = new ManagementEventWatcher("SELECT * FROM Win32_ProcessStopTrace");

    // ctor
    public ProcessWatch()
    {
        processStartEvent.EventArrived += new EventArrivedEventHandler(processStartEvent_EventArrived);
        processStartEvent.Start();
        processStopEvent.EventArrived += new EventArrivedEventHandler(processStopEvent_EventArrived);
        processStopEvent.Start();
    }

    private void processStartEvent_EventArrived(object sender, EventArrivedEventArgs e)
    {
        DebugInfo(e, false);
    }

    private void processStopEvent_EventArrived(object sender, EventArrivedEventArgs e)
    {
        DebugInfo(e, true);
    }

    private void DebugInfo(EventArrivedEventArgs e, bool fStopped)
    {
        string processName = e.NewEvent.Properties["ProcessName"].Value.ToString();
        string processID = Convert.ToInt32(e.NewEvent.Properties["ProcessID"].Value).ToString();

        Console.WriteLine($"Process {(fStopped ? "stopped" : "started")}. Name: " + processName + " | ID: " + processID);
    }

DebugInfo调试打开的每个进程。

有时这被称为对：https://i.gyazo.com/0c51587ae58e9a3f930f0afa60f6f4c5.mp4

但是有时有时会同时调用“开始”和“停止”。而且我不知道为什么会这样（进程在启动时结束）。

您可以观看此视频以了解发生了什么：https://youtu.be/zl_g8TNSOBg

我丢失了某些东西，或者一切都正确，而我只关注更稳定的过程？

检查是否已启动或停止ManagementBaseObject（意外的ManagementEventWatcher行为）

0 个答案: