为什么 Win32_ProcessStopTrace-Events 到达，但 Win32_ProcessStartTrace 没有? [英] Why Win32_ProcessStopTrace-Events arrive, but Win32_ProcessStartTrace doesn't?

问题描述

考虑以下代码:

using (ManagementEventWatcher watcher = new ManagementEventWatcher("select * from Win32_ProcessStopTrace")) {
    watcher.EventArrived += (object sender, EventArrivedEventArgs e) => {
        Console.WriteLine("{0} stopped", (string)e.NewEvent["ProcessName"]);
    };

    watcher.Start();

    while (!Console.KeyAvailable)
        System.Threading.Thread.Sleep(50);

    watcher.Stop();
}

当我(以管理员身份)运行此代码时，它会在我关闭任何其他应用程序后立即通知我.

When I run this code (as admin), it notifies me as soon as I close any other application.

第一:当使用 Win32_ProcessStartTrace 而不是 Win32_ProcessStopTrace 时，我没有收到任何启动进程的通知.这是为什么?

First: When using Win32_ProcessStartTrace instead of Win32_ProcessStopTrace, I don't get any notification for starting processes. Why is that?

第二:如果有可能监控(每个)启动进程，我可以暂停它们，做其他事情然后继续执行吗?

Second: If there's a possibility to monitor (every) starting processes, can I suspend them, do other stuff and then continue their execution?

版本信息:

• Windows 8.1 x64 (v6.3 Build 9600)

• Windows 8.1 x64 (v6.3 Build 9600)

.NET Framework v4.0.30319(在目录)，4.6.00081(根据VS)

.NET Framework v4.0.30319 (in directory), 4.6.00081 (according to VS)

(不知道是不是需要特定的更新，所以你可以要求它们)

(I don't know whether specific updates are needed, so you could ask for them)

推荐答案

正如@HansPassant 指出的那样，此查询不适用于 Windows 8.1.这与安全更新 (KB3045999) 有关.在 已知问题 下，有一个指向 <一个 href="https://support.microsoft.com/en-us/kb/3094199" rel="nofollow" title="Microsoft Support">hotfix (KB3094199) 来解决这个问题.安装此修补程序并重新启动计算机后，查询终于成功了.

As @HansPassant pointed out, this query doesn't work for Windows 8.1. This is related to a security update (KB3045999). Under Known issues there's a link to a hotfix (KB3094199) to fix this problem. After installing this hotfix and rebooting my computer, the query finally worked.

这篇关于为什么 Win32_ProcessStopTrace-Events 到达，但 Win32_ProcessStartTrace 没有?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！