C#使用WMI实现监听进程的启动和关闭

using System.Management;
 
public class Program
{
    public static void Main(string[] args)
    {
        //创建WQL事件查询，监视进程开启
        var qCreate = new WqlEventQuery("__InstanceCreationEvent", TimeSpan.FromSeconds(1), "TargetInstance ISA 'Win32_Process'");
        //创建WQL事件查询，监视进程关闭
        var qDelete = new WqlEventQuery("__InstanceDeletionEvent", TimeSpan.FromSeconds(1), "TargetInstance ISA 'Win32_Process'");
 
        // 指定名称的查询语句
        // "TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'Notepad.exe'"
 
        //创建事件查询的侦听器(ManagementEventWatcher)
        var wCreate = new ManagementEventWatcher(qCreate);
        var wDelete = new ManagementEventWatcher(qDelete);
 
        // 注册启动事件
        wCreate.EventArrived += (sender, e) =>
        {
            Console.WriteLine("开启进程：{0}", GetInfo(e.NewEvent));
        };
        // 注册关闭事件
        wDelete.EventArrived += (sender, e) =>
        {
            Console.WriteLine("关闭进程：{0}", GetInfo(e.NewEvent));
        };
 
        //开始异步侦听
        wCreate.Start();
        wDelete.Start();
         
        Console.ReadLine();
    }
 
    /// <summary>
    /// 输出事件对应的ManagementBaseObject（本例中的Win32_Process实例）的信息
    /// </summary>
    private static string GetInfo(ManagementBaseObject obj)
    {
        var instance = (ManagementBaseObject)obj["TargetInstance"];
        return string.Format("{0} - {1} - {2}", instance["Name"], instance["ProcessId"], DateTime.Now);
    }
 
}