C# WMI中进程创建事件后读取附加信息的延迟

我正在尝试创建一个应用程序，它可以监视进程的创建/终止，并记录它执行的时间和它最终被记录到mysql数据库中的频率。我面临的问题是，我正在使用Win32_ProcessStartTrace和Win32_ProcessStopTrace进行监视。创建进程后，将使用Win32_进程查询其命令行对于那些快速退出的进程，进程创建和命令行查询之间似乎存在“滞后”，因此我无法获取命令行

---

有什么方法可以做到这一点吗？

此代码监视新进程的启动并打印所使用的命令行：

using System;
using System.Management;

namespace ConsoleApplication1
{
    class Program
    {
        static void Main(string[] args)
        {
            new Test().Run();
            Console.ReadLine();
        }
    }

    internal class Test
    {
        public void Run()
        {
            ProcessWatcher procWatcher = new ProcessWatcher();
            procWatcher.Start();
        }

        private class ProcessWatcher : ManagementEventWatcher
        {
            private const string wql = 
                   @"SELECT * FROM __InstanceCreationEvent WITHIN 1
                     WHERE TargetInstance ISA 'Win32_Process'";

            public ProcessWatcher()
            {
                this.Query.QueryLanguage = "WQL";
                this.Query.QueryString = wql;
                this.EventArrived += newProcessStarted;
            }

            private void newProcessStarted(object sender, 
                                           EventArrivedEventArgs e)
            {
                var process = e.NewEvent["TargetInstance"] 
                              as ManagementBaseObject;

                if (process != null)
                {
                    var cmdLine = process.Properties["CommandLine"].Value;
                    Console.WriteLine(cmdLine);
                }
            }
        }
    }
}

---

此代码监视新进程的启动并打印所使用的命令行：

using System;
using System.Management;

namespace ConsoleApplication1
{
    class Program
    {
        static void Main(string[] args)
        {
            new Test().Run();
            Console.ReadLine();
        }
    }

    internal class Test
    {
        public void Run()
        {
            ProcessWatcher procWatcher = new ProcessWatcher();
            procWatcher.Start();
        }

        private class ProcessWatcher : ManagementEventWatcher
        {
            private const string wql = 
                   @"SELECT * FROM __InstanceCreationEvent WITHIN 1
                     WHERE TargetInstance ISA 'Win32_Process'";

            public ProcessWatcher()
            {
                this.Query.QueryLanguage = "WQL";
                this.Query.QueryString = wql;
                this.EventArrived += newProcessStarted;
            }

            private void newProcessStarted(object sender, 
                                           EventArrivedEventArgs e)
            {
                var process = e.NewEvent["TargetInstance"] 
                              as ManagementBaseObject;

                if (process != null)
                {
                    var cmdLine = process.Properties["CommandLine"].Value;
                    Console.WriteLine(cmdLine);
                }
            }
        }
    }
}

---

您是否使用WMI事件使用者？实际上我是WMI新手，所以在.Net中我使用ManagementEventWatcher并生成事件。您是否使用WMI事件使用者？实际上我是WMI新手，所以在.Net中我使用ManagementEventWatcher并生成事件。谢谢！我将尝试以下方法：）我刚刚更新了它-我有一个错误的查询，它应该查找u InstanceCreationEvent..我正要发布它。。。我使用了_InstanceCreationEvent；）Powershell oneliner--

Register WmiEvent-query“SELECT*FROM_uuinstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA'Win32_Process'”-SourceIdentifier“GetLaunchArgs”-Action{Write Host$Event.SourceEventArgs.NewEvent.TargetInstance.CommandLine}

注意，它将错过短期进程。谢谢！我将尝试以下方法：）我刚刚更新了它-我有一个错误的查询，它应该查找u InstanceCreationEvent..我正要发布它。。。我使用了_InstanceCreationEvent；）Powershell oneliner--

Register WmiEvent-query“SELECT*FROM uu InstanceCreationEvent in 1 WHERE TargetInstance ISA'Win32_Process'”-SourceIdentifier“GetLaunchArgs”-Action{Write Host$Event.SourceEventArgs.NewEvent.TargetInstance.CommandLine}

注意，它将错过短期进程。