传动监测使用WMI [英] Monitoring Drives with WMI

问题描述

我要监控硬盘的本地PC。我感兴趣的两个事件：当驱动器连接（USB驱动器，CD-ROM，网络驱动器等）和断开。我写了使用ManagementOperationObserver概念的快速证明，这部分工作。现在（用下面的代码），我得到的所有排序事件。我想只能得到事件时，驱动器连接和断开。是否有WQL查询指定这个办法？

谢谢！

 私人无效button2_Click（对象发件人，EventArgs五）
 {
T =新主题（新ParameterizedThreadStart（O => 
 {
 WqlEventQuery q; 
 ManagementOperationObserver观察者=新ManagementOperationObserver（）; 
 
管理范围范围=新的管理范围（root\\CIMV2）; 
 scope.Options.EnablePrivileges = TRUE; 
 
Q =新WqlEventQuery（）; 
 q.EventClassName =__InstanceOperationEvent; 
 q.WithinInterval =新时间跨度（0，0，3）; 
 q.Condition = @TargetInstance ISA'的Win32_LogicalDisk'; $ b $带宽=新ManagementEventWatcher（范围，q）; 
 
 w.EventArrived + =新EventArrivedEventHandler（w_EventArrived）; 
 w.Start（）; 
 }））; 
 
 t.Start（）; 
} 
 
无效w_EventArrived（对象发件人，EventArrivedEventArgs E）
 {
 //获取事件对象，并显示其属性（全部）
的foreach（在e.NewEvent.Properties PropertyData PD）
 {
 ManagementBaseObject MBO = NULL; 
如果（（MBO = pd.Value为ManagementBaseObject）！= NULL）
 {
 this.listBox1.BeginInvoke（新动作（（）=> listBox1.Items.Add（ - -------------属性------------------）））; 
的foreach（在mbo.Properties PropertyData道具）
 this.listBox1.BeginInvoke（新动作< PropertyData>（P => listBox1.Items.Add（p.Name + - + p.Value ）），支撑）; 
} 
} 
} 
  

解决方案

您快到了。到一个驱动器连接到一台机器被删除驱动器区分，您需要检查是否 e.NewEvent 是的_InstanceCreationEvent 或的 的_InstanceDeletionEvent 分别。沿着这些路线的内容：

  ManagementBaseObject baseObject =（ManagementBaseObject）e.NewEvent; 
 
如果（baseObject.ClassPath.ClassName.Equals（__ InstanceCreationEvent））
 Console.WriteLine（A驱动器已连接）; 
，否则如果（baseObject.ClassPath.ClassName.Equals（__ InstanceDeletionEvent））
 Console.WriteLine（A驱动器被删除）; 
  

此外，您也可以通过 TargetInstance 属性

  ManagementBaseObject逻辑磁盘= 
（ManagementBaseObject）e.NewEvent [TargetInstance]; 
 
 Console.WriteLine（驱动器类型{0}，
 logicalDisk.Properties [的DriveType]值。）; 
  




I am trying to monitor drives a local PC. I am interested in two events: when the drive is connected (USB drive, CD-ROM, Network Drive, etc.) and disconnected. I wrote a quick proof of concept using the ManagementOperationObserver and it partially works. Right now (with the code below), I am getting all sort of events. I would like to get only events when a drive is connected and disconnected. Is there a way to specify this in the Wql Query?

Thanks!

    private void button2_Click(object sender, EventArgs e)
    {
        t = new Thread(new ParameterizedThreadStart(o =>
        {
            WqlEventQuery q;
            ManagementOperationObserver observer = new ManagementOperationObserver();

            ManagementScope scope = new ManagementScope("root\\CIMV2");
            scope.Options.EnablePrivileges = true;

            q = new WqlEventQuery();
            q.EventClassName = "__InstanceOperationEvent";
            q.WithinInterval = new TimeSpan(0, 0, 3);
            q.Condition = @"TargetInstance ISA 'Win32_LogicalDisk' ";
            w = new ManagementEventWatcher(scope, q);

            w.EventArrived += new EventArrivedEventHandler(w_EventArrived);
            w.Start();
        }));

        t.Start();
    }

    void w_EventArrived(object sender, EventArrivedEventArgs e)
    {
        //Get the Event object and display its properties (all)
        foreach (PropertyData pd in e.NewEvent.Properties)
        {
            ManagementBaseObject mbo = null;
            if ((mbo = pd.Value as ManagementBaseObject) != null)
            {
                this.listBox1.BeginInvoke(new Action(() => listBox1.Items.Add("--------------Properties------------------")));
                foreach (PropertyData prop in mbo.Properties)
                    this.listBox1.BeginInvoke(new Action<PropertyData>(p => listBox1.Items.Add(p.Name + " - " + p.Value)), prop);
            }
        }
    }

解决方案

You're almost there. To distinguish between a drive being connected to a machine and a drive being removed, you need to check whether e.NewEvent is an instance of _InstanceCreationEvent or _InstanceDeletionEvent respectively. Something along these lines:

ManagementBaseObject baseObject = (ManagementBaseObject) e.NewEvent;

if (baseObject.ClassPath.ClassName.Equals("__InstanceCreationEvent"))
    Console.WriteLine("A drive was connected");
else if (baseObject.ClassPath.ClassName.Equals("__InstanceDeletionEvent"))
    Console.WriteLine("A drive was removed");

Furthermore, you can also get the Win32_LogicalDisk instance via the TargetInstance property.

ManagementBaseObject logicalDisk = 
               (ManagementBaseObject) e.NewEvent["TargetInstance"];

Console.WriteLine("Drive type is {0}", 
                  logicalDisk.Properties["DriveType"].Value);

这篇关于传动监测使用WMI的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！