1、 What is? WMI event

Took a look at Microsoft MSDN Yes WMI Interpretation of events , But I didn't understand much , But I probably understand .WMI An event is an event triggered when an action is performed within the system , such as ： open ( Or turn off ) A process 、 Print 、 Insert USB testing 、 Open a file .

2、WMI Event query

SELECT * FROM __InstanceCreationEvent WITHIN 0.001 WHERE TargetInstance ISA \"Win32_PrintJob\"

This one looks like SQL A query statement of a statement is a query WMI The event , Let's analyze this sentence .

__InstanceCreationEvent This object is translated into Chinese ： Instance creation event , That is, the events of adding or creating classes are queried from this object , For example, we create a process or a file . We can not only query and create events , increase 、 Delete 、 These types of events can be queried , Changes are ：__InstanceModificationEvent, Delete is ：__InstanceDeletionEvent. The query doesn't seem to have .

within 0.001, This parameter refers to the polling time of the query , How often to query this event , The unit is seconds , The polling time here is 1 millisecond

TargetInstance, Name of the target instance ;ISA, Namely is a Abbreviation , Connected is what the target instance is

Win32_PrintJob, Name of the target instance , The example here is windows Print job of the system .

The whole query means ： every other 1 Milliseconds to query windows New print job in the system

If we want to query the name of a specific instance , For example, we need to query what process the system creates , The query statement should be like this ：

Select * From __InstanceCreationEvent WITHIN 60 Where TargetInstance ISA 'Win32_Process' and TargetInstance.Name = 'notepad.exe'

3、 Code implementation

Reference assembly ：System.Management

ManagementEventWatcher createPrintJobWatcher = new ManagementEventWatcher();

// Create event query to be notified within 1 milli second of a change in a service
WqlEventQuery createPrintJobQuery = new WqlEventQuery("SELECT * FROM __InstanceCreationEvent WITHIN 0.001 WHERE TargetInstance ISA \"Win32_PrintJob\"");



createPrintJobWatcher.Query = createPrintJobQuery;
// times out watcher.WaitForNextEvent in 20 seconds
createPrintJobWatcher.Options.Timeout = new TimeSpan(0, 0, 20);
//set the print event handler
createPrintJobWatcher.EventArrived += new EventArrivedEventHandler(createPrintJobListener);

createPrintJobWatcher.Start();

Event handler after listening to the event  

static void createPrintJobListener(object sender, EventArrivedEventArgs e)
        {

            SelectQuery query = new SelectQuery("Win32_PrintJob");
            using (ManagementObjectSearcher searcher = new ManagementObjectSearcher(query))
            using (ManagementObjectCollection printJobs = searcher.Get())
                foreach (ManagementObject printJob in printJobs)
                {

                    foreach (var item in printJob.Properties)
                    {
                        Console.WriteLine($" The attribute name :{item.Name}, Property value ：{item.Value}");
                    }
                    Console.WriteLine("c1:", printJob);
                    Console.WriteLine("ID: {0}", printJob.GetPropertyValue("JobId").ToString());
                    Console.WriteLine("name: {0}", printJob.GetPropertyValue("name").ToString());
                    Console.WriteLine("status: {0}", printJob.GetPropertyValue("status").ToString());
                    if (printJob.GetPropertyValue("JobStatus") != null)
                    {
                        Console.WriteLine("JobStatus: {0}", printJob.GetPropertyValue("JobStatus").ToString());
                    }
                    else
                    {
                        Console.WriteLine("JobStatus: NULLLLLL");
                    }

                    Console.WriteLine("PC: {0}", printJob.GetPropertyValue("HostPrintQueue").ToString());
                    Console.WriteLine("TOTOAL PAGES: {0}", printJob.GetPropertyValue("TotalPages").ToString());
                }
        }

The last attached MSDN The address of ：WMI event | Microsoft Docs