注意:代码运行需引用System.Management.dll并且加入using System.Management;命名空间。
//注意:引用System.Management.dll 和 using System.Management; static void Main(string[] args) { //创建WQL事件查询,用于实例创建 var qCreate = new WqlEventQuery("__InstanceCreationEvent", TimeSpan.FromSeconds(1), //WHTHIN = 1 "TargetInstance ISA 'Win32_Process'"); //创建WQL事件查询,用于实例删除 var qDelete = new WqlEventQuery("__InstanceDeletionEvent", TimeSpan.FromSeconds(1), //WHTHIN = 1 "TargetInstance ISA 'Win32_Process'"); //创建事件查询的侦听器(ManagementEventWatcher) var wCreate = new ManagementEventWatcher(qCreate); var wDelete = new ManagementEventWatcher(qDelete); //事件注册代码 wCreate.EventArrived += (sender, e) => { Console.WriteLine("运行:{0}", GetInfo(e.NewEvent)); }; wDelete.EventArrived += (sender, e) => { Console.WriteLine("关闭:{0}", GetInfo(e.NewEvent)); }; //异步开始侦听 wCreate.Start(); wDelete.Start(); Console.WriteLine("按任意键停止监控"); Console.ReadKey(true); } //输出事件对应的ManagementBaseObject(本例中的Win32_Process实例)的信息 static string GetInfo(ManagementBaseObject mobj) { var instance = (ManagementBaseObject)mobj["TargetInstance"]; return string.Format("{0} - {1}", instance["Name"], DateTime.Now); }
//注意:引用System.Management.dll 和 using System.Management; static void Main(string[] args) { //创建WQL事件查询,用于实例创建 //加入条件判断 TargetInstance.DriveType = 2 //代表判断Win32_LogicalDisk.DriveType属性,2则代表可移动磁盘 var qCreate = new WqlEventQuery("__InstanceCreationEvent", TimeSpan.FromSeconds(1), "TargetInstance ISA 'Win32_LogicalDisk' AND TargetInstance.DriveType = 2"); //创建WQL事件查询,用于实例删除 var qDelete = new WqlEventQuery("__InstanceDeletionEvent", TimeSpan.FromSeconds(1), "TargetInstance ISA 'Win32_LogicalDisk' AND TargetInstance.DriveType = 2"); //创建事件查询的侦听器(ManagementEventWatcher) var wCreate = new ManagementEventWatcher(qCreate); var wDelete = new ManagementEventWatcher(qDelete); //事件注册代码 wCreate.EventArrived += (sender, e) => { Console.WriteLine("接入可移动磁盘:{0}", GetInfo(e.NewEvent)); }; wDelete.EventArrived += (sender, e) => { Console.WriteLine("拔出可移动磁盘:{0}", GetInfo(e.NewEvent)); }; //异步开始侦听 wCreate.Start(); wDelete.Start(); Console.WriteLine("按任意键停止监控"); Console.ReadKey(true); } //输出事件对应的ManagementBaseObject(本例中的Win32_LogicalDisk实例)的信息 static string GetInfo(ManagementBaseObject mobj) { var instance = (ManagementBaseObject)mobj["TargetInstance"]; return string.Format("{0} - {1}", instance["Name"], DateTime.Now); }