註冊過程開始時間的最佳方法是什麼？

Question

我正在寫一個程序，必須註冊啓動一個進程的時間，如記事本。 我認爲可以創建一個每秒鐘檢查所有進程的Timer。但我認爲這會減慢用戶的電腦。有沒有更好的方法來做到這一點？

Answer 1

最初爲所有正在運行的進程確定創建時間。然後 使用WMI註冊進程創建事件。

請參閱下面的代碼如何使用WMI進程創建活動的一個小例子：

static void Main(string[] args) 
{ 
    using (ManagementEventWatcher eventWatcher = 
      new ManagementEventWatcher(@"SELECT * FROM 
    __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'")) 
    { 
    // Subscribe for process creation notification. 
    eventWatcher.EventArrived += ProcessStarted_EventArrived; 
    eventWatcher.Start(); 
    Console.In.ReadLine(); 
    eventWatcher.EventArrived -= ProcessStarted_EventArrived; 
    eventWatcher.Stop(); 
    } 
} 


static void ProcessStarted_EventArrived(object sender, EventArrivedEventArgs e) 
{ 
    ManagementBaseObject obj = e.NewEvent["TargetInstance"] as ManagementBaseObject; 

    // The Win32_Process class also contains a CreationDate property. 
    Console.Out.WriteLine("ProcessName: {0} " + obj.Properties["Name"].Value); 
} 

BEGIN編輯：

我進一步調查過程中創造的檢測與WMI和有是（更多）使用Win32_ProcessStartTrace類（請參閱TECHNET獲取更多信息）資源友好解決方案（但需要管理權限）：

using (ManagementEventWatcher eventWatcher = 
      new ManagementEventWatcher(@"SELECT * FROM Win32_ProcessStartTrace")) 
{ 
    // Subscribe for process creation notification. 
    eventWatcher.EventArrived += ProcessStarted_EventArrived; 
    eventWatcher.Start(); 
    Console.Out.WriteLine("started"); 
    Console.In.ReadLine(); 
    eventWatcher.EventArrived -= ProcessStarted_EventArrived; 
    eventWatcher.Stop(); 
} 

static void ProcessStarted_EventArrived(object sender, EventArrivedEventArgs e) 
{    
    Console.Out.WriteLine("ProcessName: {0} " 
      + e.NewEvent.Properties["ProcessName"].Value);  
} 

using (ManagementEventWatcher eventWatcher = 
      new ManagementEventWatcher(@"SELECT * FROM Win32_ProcessStartTrace")) 
{ 
    // Subscribe for process creation notification. 
    eventWatcher.EventArrived += ProcessStarted_EventArrived; 
    eventWatcher.Start(); 
    Console.Out.WriteLine("started"); 
    Console.In.ReadLine(); 
    eventWatcher.EventArrived -= ProcessStarted_EventArrived; 
    eventWatcher.Stop(); 
} 

static void ProcessStarted_EventArrived(object sender, EventArrivedEventArgs e) 
{    
    Console.Out.WriteLine("ProcessName: {0} " 
      + e.NewEvent.Properties["ProcessName"].Value);  
} 

在此解決方案中，您不必設置輪詢間隔。

編輯完

BEGIN編輯2：

您可以使用Win32_ProcessStopTrace類監測過程停止事件。要組合進程啓動和進程停止事件，請使用Win32_ProcessTrace類。在事件處理程序使用ClassPath proberty開始區分/停止事件：

using (ManagementEventWatcher eventWatcher = 
     new ManagementEventWatcher(@"SELECT * FROM Win32_ProcessTrace")) 
{   
    eventWatcher.EventArrived += Process_EventArrived; 
    eventWatcher.Start(); 
    Console.Out.WriteLine("started"); 
    Console.In.ReadLine(); 
    eventWatcher.EventArrived -= Process_EventArrived; 
    eventWatcher.Stop(); 
} 

static void Process_EventArrived(object sender, EventArrivedEventArgs e) 
{ 
    Console.Out.WriteLine(e.NewEvent.ClassPath); // Use class path to distinguish 
               // between start/stop process events. 
    Console.Out.WriteLine("ProcessName: {0} " 
     + e.NewEvent.Properties["ProcessName"].Value);  
} 

END EDIT 2

Answer 2

沒有必要監視任何東西。您只需要枚舉進程並從進程實例StartTime中獲取。