using System.Management;
 
public class Program
{
    public static void Main(string[] args)
    {
        //創(chuàng)建WQL事件查詢，監(jiān)視進(jìn)程開(kāi)啟
        var qCreate = new WqlEventQuery("__InstanceCreationEvent", TimeSpan.FromSeconds(1), "TargetInstance ISA 'Win32_Process'");
        //創(chuàng)建WQL事件查詢，監(jiān)視進(jìn)程關(guān)閉
        var qDelete = new WqlEventQuery("__InstanceDeletionEvent", TimeSpan.FromSeconds(1), "TargetInstance ISA 'Win32_Process'");
 
        // 指定名稱的查詢語(yǔ)句
        // "TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = 'Notepad.exe'"
 
        //創(chuàng)建事件查詢的偵聽(tīng)器(ManagementEventWatcher)
        var wCreate = new ManagementEventWatcher(qCreate);
        var wDelete = new ManagementEventWatcher(qDelete);
 
        // 注冊(cè)啟動(dòng)事件
        wCreate.EventArrived += (sender, e) =>
        {
            Console.WriteLine("開(kāi)啟進(jìn)程：{0}", GetInfo(e.NewEvent));
        };
        // 注冊(cè)關(guān)閉事件
        wDelete.EventArrived += (sender, e) =>
        {
            Console.WriteLine("關(guān)閉進(jìn)程：{0}", GetInfo(e.NewEvent));
        };
 
        //開(kāi)始異步偵聽(tīng)
        wCreate.Start();
        wDelete.Start();
         
        Console.ReadLine();
    }
 
    /// <summary>
    /// 輸出事件對(duì)應(yīng)的ManagementBaseObject（本例中的Win32_Process實(shí)例）的信息
    /// </summary>
    private static string GetInfo(ManagementBaseObject obj)
    {
        var instance = (ManagementBaseObject)obj["TargetInstance"];
        return string.Format("{0} - {1} - {2}", instance["Name"], instance["ProcessId"], DateTime.Now);
    }
 
}