C＃在新进程启动时引发事件 [英] C# Raise an event when a new process starts

问题描述

嘿，有什么方法可以在不使用ManagementEventWatcher且不使用Process.GetProcesses（）的情况下启动新进程时引发事件？
ManagementEventWatcher的问题在于用户需要具有很高的精确度。
谢谢!!!

Hey there, Is there a way to raise event when a new process is started without using the ManagementEventWatcher, and without using the Process.GetProcesses()? The problem with ManagementEventWatcher is that the user needs to have high premmisions. Thank you!!!

推荐答案

不同于外部事件 Win32_ProcessStartTrace 您当前正在使用的 __ InstanceCreationEvent 和 __ InstanceDeletionEvent WMI内部事件不需要管理员权限。

Unlike the extrinsic event Win32_ProcessStartTrace that you are currently using, the __InstanceCreationEvent and __InstanceDeletionEvent WMI intrinsic events do not require administrator rights.

以下是一个示例查询，可用于跟踪流程开始：

Here's a sample query you can use to track process starts:

SELECT TargetInstance 
  FROM __InstanceCreationEvent WITHIN 1 
 WHERE TargetInstance ISA 'Win32_Process' 
   AND TargetInstance.Name LIKE '<your process name.exe>'

更多信息：使用WMI处理信息和通知

由于这些是固有事件，因此WMI最终通过轮询来模仿事件行为，并且只会定期（在这里，每1秒钟）检查一次新事件。将 WITHIN 的持续时间减少到几分之一秒，可以使您更快地响应，但会消耗CPU使用率。

Because these are intrinsic events, WMI ultimately mimics event behaviour by means of polling, and will check for new events only periodically (here, every 1 second). Decreasing the WITHIN duration to fractions of seconds will give you faster response at the expense of CPU usage.

这篇关于C＃在新进程启动时引发事件的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！