Windows WMI - Win32_ProcessStartTrace 和 __InstanceCreationEvent 之间有什么区别（和顺序）？

Question

Just getting started with WMI, and I am trying to understand what is the difference between Win32_ProcessStartTrace and __InstanceCreationEvent . They both are available when a new process starts, however which one is first ?

I have tested several examples provided by Microsoft and I cannot see any major difference like performance issues, besides the fact that one provides some useful=l information and the other does not. (or does it?)

From the documentantion for Win32_ProcessStartTrace and __InstanceCreationEvent we can see quite a difference, as the Win32_ provides more details like ProcessID whilst __Instance does not.

If one wants to monitor process creation effectively (asynchronously) which one of these 2 should be used ?

Getting information about the process is a must, at least the ProcessID.

A good explanation is much appreciated, I`m sure others are interested as well.

Answer 1

_InstanceCreationEvent有一个TargetInstance字段，对于新进程，它是一个Win32_Process对象，它具有Win32_ProcessStartTrace提供的大多数相同字段（以及更多）。