. Net (C #): Use WMI Event Query to monitor processes and removable disks

Directory

• Process start or end monitoring
• Monitoring of removable disk insertion or deletion

 

 

 

Returned directory

Process start or end monitoring

 

 

Code:

// Note: Reference System. Management. dll and using system. Management;

Static void main (string [] ARGs)

{

// Create a wql Event Query for instance Creation

VaR qcreate = new wqleventquery ("_ instancecreationevent ",

Timespan. fromseconds (1), // whthin = 1

"Targetinstance ISA 'win32 _ process '");

// Create a wql Event Query for deleting an instance

VaR qdelete = new wqleventquery ("_ instancedeletionevent ",

Timespan. fromseconds (1), // whthin = 1

"Targetinstance ISA 'win32 _ process '");

 

// Create a listener for Event Query (managementeventwatcher)

VaR wcreate = new managementeventwatcher (qcreate );

VaR wdelete = new managementeventwatcher (qdelete );

 

// Event registration code

Wcreate. eventarrived + = (sender, e) =>

{

Console. writeline ("Run: {0}", getinfo (E. newevent ));

};

Wdelete. eventarrived + = (sender, e) =>

{

Console. writeline ("close: {0}", getinfo (E. newevent ));

};

 

// Start listening Asynchronously

Wcreate. Start ();

Wdelete. Start ();

 

Console. writeline ("Stop monitoring by any key ");

Console. readkey (true );

}

 

// Output information of managementbaseobject corresponding to the event (win32_process instance in this example)

Static string getinfo (managementbaseobject mobj)

{

VaR instance = (managementbaseobject) mobj ["targetinstance"];

Return string. Format ("{0}-{1}", instance ["name"], datetime. Now );

}

 

 

 

Returned directory

Monitoring of removable disk insertion or deletion

 

Code:

// Note: Reference System. Management. dll and using system. Management;

Static void main (string [] ARGs)

{

// Create a wql Event Query for instance Creation

// Add a condition to determine targetinstance. drivetype = 2

// Identifies the win32_logicaldisk.drivetype attribute, and 2 indicates a removable disk.

VaR qcreate = new wqleventquery ("_ instancecreationevent ",

Timespan. fromseconds (1 ),

"Targetinstance ISA 'win32 _ logicaldisk' and targetinstance. drivetype = 2 ");

// Create a wql Event Query for deleting an instance

VaR qdelete = new wqleventquery ("_ instancedeletionevent ",

Timespan. fromseconds (1 ),

"Targetinstance ISA 'win32 _ logicaldisk' and targetinstance. drivetype = 2 ");

 

// Create a listener for Event Query (managementeventwatcher)

VaR wcreate = new managementeventwatcher (qcreate );

VaR wdelete = new managementeventwatcher (qdelete );

 

// Event registration code

Wcreate. eventarrived + = (sender, e) =>

{

Console. writeline ("Access to removable disk: {0}", getinfo (E. newevent ));

};

Wdelete. eventarrived + = (sender, e) =>

{

Console. writeline ("detach a removable disk: {0}", getinfo (E. newevent ));

};

 

// Start listening Asynchronously

Wcreate. Start ();

Wdelete. Start ();

 

Console. writeline ("Stop monitoring by any key ");

Console. readkey (true );

}

 

// Output information of the managementbaseobject corresponding to the event (win32_logicaldisk instance in this example)

Static string getinfo (managementbaseobject mobj)

{

VaR instance = (managementbaseobject) mobj ["targetinstance"];

Return string. Format ("{0}-{1}", instance ["name"], datetime. Now );

}