检测Windows进程使用C＃启动和退出事件而不使用WMI

Question

Using WMI's ManagementEventWatcher/EventArrivedEventHandler will result in creating another thread which I'm trying to avoid. WMI also is knowing for its delay.
So my question is : how can I detect Windows process creation/termination with C# without WMI ? is there a way to do this from unmanaged code ?

Answer 1

You can use Event Tracing for Windows (ETW). Specifically, you want to look at subclasses of the Process class in the kernel event tracer .

I haven't ever used this from managed code, but this blog post looks useful.

And I don't know if this creates extra threads in your process.

In summary, you don't need WMI to monitor process events. You can use ETW instead but I don't know if it exactly meets your requirements.

Answer 2

To the best of my knowledge, the only supported way to subscribe to process create/destroy events is through WMI. I think you are rejecting the option of polling, in which case it is either WMI, or bust.