public void AddWatcher(string source, string log, int id)
{
if (source == log && log == null)
{
throw new ArgumentNullException("Either source or log must be set!");
}
// if legeacy
if (System.Environment.OSVersion.Version.Major < 6)
{
string queryString = "Select * from __InstanceCreationEvent Where TargetInstance ISA 'Win32_NTLogEvent'";
if (source != null)
queryString += " AND TargetInstance.Sourcename = '" + source + "'";
if (log != null)
queryString += " AND TargetInstance.LogFile = '" + log + "'";
queryString += " AND (TargetInstance.EventCode = " + id + ")";
ManagementEventWatcher managementWatcher = new ManagementEventWatcher(new EventQuery(queryString));
managementWatcher.Start();
managementWatcher.EventArrived += EventRecordWritten;
managementWatchers.Add(managementWatcher);
}
else
{
string queryString = "<QueryList><Query Id='0' Path='" + log + "'><Select Path='" + log + "'>*[System[Provider[@Name='" + source + "']]] and *[System[EventID=" + id + "]]</Select></Query></QueryList>";
EventLogQuery query = new EventLogQuery(log, PathType.LogName, queryString);
EventLogWatcher eventWatcher = new EventLogWatcher(query);
eventWatcher.EventRecordWritten += EventRecordWritten;
eventWatcher.Enabled = true;
eventWatchers.Add(eventWatcher);
}
}
/// <summary>
/// Initializes a new instance of the <see cref="Program"/> class.
/// </summary>
public Program()
{
try
{
// Your query goes below; "KeyPath" is the key in the registry that you
// want to monitor for changes. Make sure you escape the \ character.
WqlEventQuery query = new WqlEventQuery(
"SELECT * FROM RegistryValueChangeEvent WHERE " +
"Hive = 'HKEY_LOCAL_MACHINE'" +
@"AND KeyPath = 'SOFTWARE\\Microsoft\\.NETFramework' AND ValueName='InstallRoot'");
ManagementEventWatcher watcher = new ManagementEventWatcher(query);
Console.WriteLine("Waiting for an event...");
// Set up the delegate that will handle the change event.
watcher.EventArrived += new EventArrivedEventHandler(HandleEvent);
// Start listening for events.
watcher.Start();
// Do something while waiting for events. In your application,
// this would just be continuing business as usual.
System.Threading.Thread.Sleep(100000000);
// Stop listening for events.
watcher.Stop();
}
catch (ManagementException managementException)
{
Console.WriteLine("An error occurred: " + managementException.Message);
}
}
private static void StartMonitoringProcessTermination()
{
ManagementEventWatcher stopWatcher = new ManagementEventWatcher("SELECT * FROM Win32_ProcessStopTrace");
stopWatcher.EventArrived += new EventArrivedEventHandler(stopWatcher_EventArrived);
stopWatcher.Stopped += new StoppedEventHandler(stopWatcher_Stopped);
stopWatcher.Disposed += new EventHandler(stopWatcher_Disposed);
stopWatcher.Start();
}
private static void checkUsbRemove()
{
ManagementEventWatcher watcher = new ManagementEventWatcher();
WqlEventQuery query = new WqlEventQuery("SELECT * FROM Win32_VolumeChangeEvent WHERE EventType = 3");
watcher.EventArrived += new EventArrivedEventHandler(watcher_RemoveArrived);
watcher.Query = query;
watcher.Start();
}
private ManagementEventWatcher CreateProcessStoppedEventWatcher()
{
var stopQuery = new EventQuery("SELECT * FROM __InstanceDeletionEvent WITHIN 1 WHERE TargetInstance ISA \"Win32_Process\"");
var watcher = new ManagementEventWatcher(stopQuery);
watcher.EventArrived += ProcessStoppedEventWatcher_OnEventArrived;
watcher.Start();
return(watcher);
}
public SerialPortWatcher()
{
_taskScheduler = TaskScheduler.FromCurrentSynchronizationContext();
ComPorts = new ObservableCollection <string>(SerialPort.GetPortNames().OrderBy(s => s));
WqlEventQuery query = new WqlEventQuery("SELECT * FROM Win32_DeviceChangeEvent");
_watcher = new ManagementEventWatcher(query);
_watcher.EventArrived += (sender, eventArgs) => CheckForNewPorts(eventArgs);
_watcher.Start();
}
public WmiProcessWatcher()
{
// Populate bindings.
_startWatcher = new ManagementEventWatcher(new WqlEventQuery("SELECT * FROM Win32_ProcessStartTrace"));
_stopWatcher = new ManagementEventWatcher(new WqlEventQuery("SELECT * FROM Win32_ProcessStopTrace"));
_startWatcher.EventArrived += ApplicationLaunched;
_stopWatcher.EventArrived += ApplicationExited;
_startWatcher.Start();
_stopWatcher.Start();
}
private static void ProcessStarted(object o, EventArrivedEventArgs e)
{
if (e.NewEvent.Properties["ProcessName"].Value.ToString() == "iRacingSim64DX11.exe")
{
Log.WriteEntry("iRacing Started");
ProcessStartWatcher.Stop();
ProcessStopWatcher.Start();
}
}
public void Start()
{
try
{
_watcher.Start();
_thread = new System.Threading.Thread(Listen);
_thread.Start();
}
catch { }
}
private DateTime lastChange; // Indicates last volume mount event to reduce the amount of bag volume discoveries
private VolumeMountManager()
{
// Register eventhandler for changes to logical volumes
var watcher = new ManagementEventWatcher();
var query = new WqlEventQuery("SELECT * FROM Win32_DeviceChangeEvent WHERE EventType = 2");
watcher.EventArrived += new EventArrivedEventHandler(OnLogicalVolumesChanges);
watcher.Query = query;
watcher.Start();
}
public MPCProcWatcher()
{
m_mpcWatcher = new ManagementEventWatcher();
m_mpcWatcher.Query = new WqlEventQuery("__InstanceOperationEvent", TimeSpan.FromSeconds(1),
@"TargetInstance ISA 'Win32_Process' AND ( TargetInstance.Name = 'mpc-hc.exe' OR TargetInstance.Name = 'mpc-hc64.exe')");
m_mpcWatcher.Scope = m_wScope;
m_mpcWatcher.EventArrived += new EventArrivedEventHandler(m_mpcWatcher_EventArrived);
m_mpcWatcher.Start();
}
private void WaitForUsb()
{
var watcher = new ManagementEventWatcher();
var query = new WqlEventQuery("SELECT * FROM Win32_VolumeChangeEvent WHERE EventType = 2");
//watcher.EventArrived += new EventArrivedEventHandler(blah);
watcher.EventArrived += WatcherOnEventArrived;
watcher.Query = query;
watcher.Start();
}
public WmiBrightnessController()
{
GetBrightness();
ManagementScope scope = new ManagementScope("root\\WMI");
EventQuery q = new EventQuery("Select * From WmiMonitorBrightnessEvent");
_eventWatcher = new ManagementEventWatcher(scope, q);
_eventWatcher.EventArrived += _eventWatcher_EventArrived;
_eventWatcher.Start();
}
private static void RunManagementEventWatcherForWindowsServices()
{
EventQuery eventQuery = new EventQuery();
eventQuery.QueryString = "SELECT * FROM __InstanceModificationEvent within 2 WHERE targetinstance isa 'Win32_Service'";
ManagementEventWatcher demoWatcher = new ManagementEventWatcher(eventQuery);
demoWatcher.EventArrived += ServiceStatusChanged;
demoWatcher.Start();
}
void createEventWatcher()
{
WqlEventQuery insertQuery = new WqlEventQuery("SELECT * FROM __InstanceOperationEvent WITHIN 2 WHERE " +
"TargetInstance ISA 'Win32_PnPEntity'");
ManagementEventWatcher insertWatcher = new ManagementEventWatcher(insertQuery);
insertWatcher.EventArrived += new EventArrivedEventHandler(OnPnPDeviceOperation);
insertWatcher.Start();
}
//distributes Event-Watchers
public void watchOut()
{
startWatch = new ManagementEventWatcher(new WqlEventQuery("SELECT * FROM Win32_ProcessStartTrace"));
startWatch.EventArrived += new EventArrivedEventHandler(main.startWatch_EventArrived);
startWatch.Start();
ManagementEventWatcher stopWatch = new ManagementEventWatcher(new WqlEventQuery("SELECT * FROM Win32_ProcessStopTrace"));
stopWatch.EventArrived += new EventArrivedEventHandler(main.stopWatch_EventArrived);
stopWatch.Start();
}
/// <summary>
/// Отслеживаем подключение накопителей
/// </summary>
void USBInsert()
{
ManagementEventWatcher watcherRemove = new ManagementEventWatcher();
WqlEventQuery query = new WqlEventQuery("SELECT * FROM __InstanceCreationEvent WITHIN 2 WHERE TargetInstance ISA 'Win32_USBHub'");
watcherRemove.EventArrived += new EventArrivedEventHandler(DeviceUpToDate);
watcherRemove.Query = query;
watcherRemove.Start();
watcherRemove.WaitForNextEvent();
}
private void StartWatchDeleteProcess()
{
WqlEventQuery query = new WqlEventQuery("__InstanceDeletionEvent",
new TimeSpan(0, 0, 1),
"TargetInstance isa \"Win32_Process\"");
watch_del = new ManagementEventWatcher(query);
watch_del.EventArrived += new EventArrivedEventHandler(HandleProcessDeleteEvent);
watch_del.Start();
}
public ProcessWatch(bool fDebug = false)
{
Debug = fDebug;
isUnityTriggered = Process.GetProcessesByName("UnityCrashHandler64").Length > 0;
processStartEvent.EventArrived += new EventArrivedEventHandler(processStartEvent_EventArrived);
processStartEvent.Start();
processStopEvent.EventArrived += new EventArrivedEventHandler(processStopEvent_EventArrived);
processStopEvent.Start();
}
/// <summary>Monitors starting and shutdown of the processes.</summary>
void InitWatcher()
{
startWatch = new ManagementEventWatcher(new WqlEventQuery("SELECT * FROM Win32_ProcessStartTrace"));
startWatch.EventArrived += StartWatch_EventArrived;
startWatch.Start();
stopWatch = new ManagementEventWatcher(new WqlEventQuery("SELECT * FROM Win32_ProcessStopTrace"));
stopWatch.EventArrived += StopWatch_EventArrived;
stopWatch.Start();
CheckProcessStatus();
}
public void StartWatchers(params string[] wqls)
{
foreach (string wql in wqls)
{
ManagementEventWatcher watcher = new ManagementEventWatcher(wql);
watcher.EventArrived += new EventArrivedEventHandler(watcher_EventArrived);
watcher.Start();
_watchers.Add(watcher);
}
}
public TaskMain()
{
InitializeComponent();
this.Load += new System.EventHandler(TaskMain_Load);
_processStartEvent.EventArrived += new EventArrivedEventHandler(ProcessStartEvent_EventArrived);
_processStartEvent.Start();
_processStopEvent.EventArrived += new EventArrivedEventHandler(ProcessStopEvent_EventArrived);
_processStopEvent.Start();
}
public void Start()
{
if (_removalEventWatcher == null || _insertionEventWatcher == null)
{
return;
}
_removalEventWatcher.Start();
_insertionEventWatcher.Start();
}
/// <summary>
/// Отслеживаем изъятие накопителей
/// </summary>
void USBRemove()
{
ManagementEventWatcher watcherInsert = new ManagementEventWatcher();
WqlEventQuery query = new WqlEventQuery("SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Win32_USBHub'");
watcherInsert.EventArrived += new EventArrivedEventHandler(DeviceDeletedEvent);
watcherInsert.Query = query;
watcherInsert.Start();
watcherInsert.WaitForNextEvent();
}
public void Test()
{
ManagementEventWatcher watcher = new ManagementEventWatcher();
WqlEventQuery query = new WqlEventQuery("SELECT * FROM Win32_VolumeChangeEvent WHERE EventType = 2");
watcher.EventArrived += new EventArrivedEventHandler(watcher_EventArrived);
watcher.Query = query;
watcher.Start();
watcher.WaitForNextEvent();
}
// Start listening
public void Start()
{
try {
watcher.Start();
} catch (Exception ex) {
log.Error("Could not start listening!", ex);
throw;
}
}
private void MonitorSerialPortChanges()
{
var serialportchangedstatus = new WqlEventQuery("SELECT * FROM __InstanceModificationEvent WHERE TargeInstance ISA 'CIM_LogicalDevice' AND TargetInstance.Name = 'COM1'");
ManagementEventWatcher serialstatuschange_Event = new ManagementEventWatcher(serialportchangedstatus);
serialstatuschange_Event.EventArrived += serialportstatuschanged_EventHandler;
serialstatuschange_Event.Start();
}
/// <summary>
/// Auto-detect Arduino device by VID and PID numbers.
/// </summary>
public ArduinoConnectionManager()
{
communication = Communication.getCommunicationManager();
_deviceChanged = new ManagementEventWatcher(new WqlEventQuery(
"SELECT * FROM Win32_DeviceChangeEvent WHERE EventType = 2 or EventType = 3"));
_deviceChanged.EventArrived += _deviceChanged_Event;
_deviceChanged.Start();
}
/// <summary>
/// Start monitoring thread.
/// </summary>
public void Start()
{
Connected = false;
if (IsDeviceConnected())
{
Debug.WriteLine("Device [" + DeviceName + "] connected.");
Connected = true;
}
watcher.Start();
}
private void StartVolumeWatcher()
{
volumeWatcher = new ManagementEventWatcher();
volumeWatcher.EventArrived += VolumeWatcher_EventArrived;
volumeWatcher.Stopped += VolumeWatcher_Stopped;
volumeWatcher.Query = volumeQuery;
volumeWatcher.Start();
}
public WMIProcessFinder()
{
processStartWatcher = new ManagementEventWatcher(new WqlEventQuery("SELECT * FROM Win32_ProcessStartTrace"));
processStartWatcher.EventArrived += ProcessStart_EventArrived;
processStartWatcher.Start();
processStopWatcher = new ManagementEventWatcher(new WqlEventQuery("SELECT * FROM Win32_ProcessStopTrace"));
processStopWatcher.EventArrived += ProcessStop_EventArrived;
processStopWatcher.Start();
}
private void SetupUsbDeviceWatcher()
{
_watcher = new ManagementEventWatcher();
var query = new WqlEventQuery(WQL_EVENT_QUERY);
_watcher.EventArrived += Watcher_EventArrived;
_watcher.Query = query;
_watcher.Start();
}