C#使用WMI对进程和可移动磁盘的监控

注意：代码运行需引用System.Management.dll并且加入using System.Management;命名空间。

//注意：引用System.Management.dll 和 using System.Management;
static void Main(string[] args)
{
    //创建WQL事件查询，用于实例创建
    var qCreate = new WqlEventQuery("__InstanceCreationEvent",
        TimeSpan.FromSeconds(1),  //WHTHIN = 1
        "TargetInstance ISA 'Win32_Process'");
    //创建WQL事件查询，用于实例删除
    var qDelete = new WqlEventQuery("__InstanceDeletionEvent",
        TimeSpan.FromSeconds(1),  //WHTHIN = 1
        "TargetInstance ISA 'Win32_Process'");

    //创建事件查询的侦听器（ManagementEventWatcher）
    var wCreate = new ManagementEventWatcher(qCreate);
    var wDelete = new ManagementEventWatcher(qDelete);

    //事件注册代码
    wCreate.EventArrived += (sender, e) =>
    {
        Console.WriteLine("运行：{0}", GetInfo(e.NewEvent));
    };
    wDelete.EventArrived += (sender, e) =>
    {
         Console.WriteLine("关闭：{0}", GetInfo(e.NewEvent));
    };

    //异步开始侦听
    wCreate.Start();
    wDelete.Start();

    Console.WriteLine("按任意键停止监控");
    Console.ReadKey(true);
}

//输出事件对应的ManagementBaseObject（本例中的Win32_Process实例）的信息
static string GetInfo(ManagementBaseObject mobj)
{
    var instance = (ManagementBaseObject)mobj["TargetInstance"];
    return string.Format("{0} - {1}", instance["Name"], DateTime.Now);
}

//注意：引用System.Management.dll 和 using System.Management;
static void Main(string[] args)
{
    //创建WQL事件查询，用于实例创建
    //加入条件判断 TargetInstance.DriveType = 2
    //代表判断Win32_LogicalDisk.DriveType属性，2则代表可移动磁盘
    var qCreate = new WqlEventQuery("__InstanceCreationEvent",
        TimeSpan.FromSeconds(1),
        "TargetInstance ISA 'Win32_LogicalDisk' AND TargetInstance.DriveType = 2");
    //创建WQL事件查询，用于实例删除
    var qDelete = new WqlEventQuery("__InstanceDeletionEvent",
        TimeSpan.FromSeconds(1),
        "TargetInstance ISA 'Win32_LogicalDisk' AND TargetInstance.DriveType = 2");

    //创建事件查询的侦听器（ManagementEventWatcher）
    var wCreate = new ManagementEventWatcher(qCreate);
    var wDelete = new ManagementEventWatcher(qDelete);

    //事件注册代码
    wCreate.EventArrived += (sender, e) =>
    {
        Console.WriteLine("接入可移动磁盘：{0}", GetInfo(e.NewEvent));
    };
    wDelete.EventArrived += (sender, e) =>
    {
        Console.WriteLine("拔出可移动磁盘：{0}", GetInfo(e.NewEvent));
    };

    //异步开始侦听
    wCreate.Start();
    wDelete.Start();

    Console.WriteLine("按任意键停止监控");
    Console.ReadKey(true);
}

//输出事件对应的ManagementBaseObject（本例中的Win32_LogicalDisk实例）的信息
static string GetInfo(ManagementBaseObject mobj)
{
    var instance = (ManagementBaseObject)mobj["TargetInstance"];
    return string.Format("{0} - {1}", instance["Name"], DateTime.Now);
}