How to know which service fire this __InstanceModificationEvent event?

Question

I have simple codes to track service state. But in my code, i can just know service started or stopped. I want to know which service started or stopped.

Here is my code samples. This is main function:

public void TrackService()
        {
            string queryRunning = "SELECT * FROM __InstanceModificationEvent WITHIN 1 WHERE TargetInstance ISA \"Win32_Service\" AND TargetInstance.State=\"Running\"";
            ManagementEventWatcher watcher = null;
            watcher = new ManagementEventWatcher(queryRunning);
            watcher.EventArrived += new EventArrivedEventHandler(ServiceStart);
            watcher.Start();
        }

This is event func.

private void ServiceStart(object sender, EventArrivedEventArgs e)
    {
        string msg = "Services has started.";
        Console.WriteLine(msg);
    }

score 1 · Accepted Answer · answered Dec 05 '12 at 12:10

I found it in here while searching it.

private void ServiceStart(object sender, EventArrivedEventArgs e)
        {
            string msg = ((ManagementBaseObject)e.NewEvent["TargetInstance"])["DisplayName"];
        }

This is what i want. (ManagementBaseObject)e.NewEvent["TargetInstance"]).

How to know which service fire this __InstanceModificationEvent event?

1 Answers1