如何監控，當用戶在C＃中啓動Excel等Windows應用程序

Question

可能重複：
Track started applications in Windows

我喜歡營造一種程序或C＃服務，監視，當用戶推出一些像Excel或Access一樣的應用程序。使用System.Diagnostics.Process，我可以獲取正在運行的進程，但我想在用戶啓動應用程序時監視事件。我們想創建一些使用歷史記錄。

Answer 1

我使用WqlEventQuery對象來檢查是否有做了一個小例子調用事件過程的新實例。之後檢查名稱並按照你的意願去做。如果你想改善我的查詢 - 請隨時查看syntax description。

private static void lookForExcel() 
{ 
    WqlEventQuery query = new WqlEventQuery("__InstanceCreationEvent", new TimeSpan(0, 0, 1), "TargetInstance isa \"Win32_Process\""); 
    ManagementEventWatcher watcher = new ManagementEventWatcher(query); 
    watcher.EventArrived += new EventArrivedEventHandler(watcher_EventArrived); 
    watcher.Start(); 
    Console.ReadLine(); 
    watcher.Stop(); 
} 

static void watcher_EventArrived(object sender, EventArrivedEventArgs e) 
{ 
    string instanceName = ((ManagementBaseObject)e.NewEvent["TargetInstance"])["Name"].ToString(); 
    if (instanceName.ToLower()=="excel.exe") 
    { 
     Debug.WriteLine("Excel has been started ...");  
    }    
} 

Answer 2

最簡單的方法是定期檢查哪些進程正在運行，並與之前的列表進行比較。

但是，您可以獲得有關流程啓動的通知。文檔瀏覽：

• http://msdn.microsoft.com/en-us/library/windows/desktop/aa393013(v=vs.85).aspx

你也可以打開安全事件日誌，然後它會顯示每個進程「詳細跟蹤」開始，在系統上結束。雖然這可能太多了。

Answer 3

可以使用WMI做到這一點：

private ManagementEventWatcher WatchForProcessStart(string processName) 
{ 
    string queryString = 
     "SELECT TargetInstance" + 
     " FROM __InstanceCreationEvent " + 
     "WITHIN 10 " + 
     " WHERE TargetInstance ISA 'Win32_Process' " + 
     " AND TargetInstance.Name = '" + processName + "'"; 

    // The dot in the scope means use the current machine 
    string scope = @"\\.\root\CIMV2"; 

    // Create a watcher and listen for events 
    ManagementEventWatcher watcher = new ManagementEventWatcher(scope, queryString); 
    watcher.EventArrived += ProcessStarted; 
    watcher.Start(); 
    return watcher; 
} 

private void ProcessStarted(object sender, EventArrivedEventArgs e) 
{ 
    ManagementBaseObject targetInstance = (ManagementBaseObject)e.NewEvent.Properties["TargetInstance"].Value; 
    string processName = targetInstance.Properties["Name"].Value.ToString(); 
    Console.WriteLine(String.Format("{0} process started", processName)); 
} 

這手錶10個最新工藝的陣列，當它改變