Question

if i use the absolute default setup for a WMI asynchronic query:

mgtEvWatcher = new ManagementEventWatcher("SELECT * FROM __InstanceOperationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'"); 
mgtEvWatcher.EventArrived += new EventArrivedEventHandler(mgtEvWatcher_EventArrived); 

is this enough to get a WMI asynchronic query going on? i want to capture the event of process creation.
there are no errors, no exceptions, but whenever i open an application (Tried with cmd->calc and some more i can’t remember) nothing happens

Answer 1

Are you calling the ManagementEventWatcher.Start Method? to subscribe to the event

Also if you want to monitor the creation of a process you must use the __InstanceCreationEvent wmi class instead.

try this code

mgtEvWatcher = new ManagementEventWatcher("SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'"); 
mgtEvWatcher.EventArrived += new EventArrivedEventHandler(mgtEvWatcher_EventArrived); 
mgtEvWatcher.Start();