c# - Win32_ProcessStartTrace 查询中的截断 ProcessName

Question

我正在使用此代码来监视进程:

var startWatch = new ManagementEventWatcher(
    "SELECT * FROM Win32_ProcessStartTrace");
startWatch.EventArrived += startWatch_EventArrived;
startWatch.Start();

var stopWatch = new ManagementEventWatcher(
    "SELECT * FROM Win32_ProcessStopTrace");
stopWatch.EventArrived += stopWatch_EventArrived;
stopWatch.Start();

问题是 - ProcessName 属性在两个回调中都被截断为 14 个字符。

var name = e.NewEvent.Properties["ProcessName"].Value.ToString();

两个进程(监视和监视)都是 x64 .NET 控制台应用程序。

任何人都知道可能是什么原因？

Answer 1

使用 __InstanceCreationEvent/__InstanceDeletionEvent反而

例子

var startWatch = new ManagementEventWatcher(
    "SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'");
startWatch.EventArrived += startWatch_EventArrived;
startWatch.Start();

var stopWatch = new ManagementEventWatcher(
    "SELECT * FROM __InstanceDeletionEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'");
stopWatch.EventArrived += stopWatch_EventArrived;
stopWatch.Start();

事件示例

// e.NewEvent now have only 3 properties, we should focus on TargetInstance property
var targetInstance = (ManagementBaseObject) e.NewEvent["TargetInstance"];
// TargetInstance has more than 40 properties, some properties can be null
var name = targetInstance["Name"]?.ToString();

在 .NET Core 3.1 上测试 System.Management NuGet 包。

前

// Win32_ProcessStartTrace
"League of Legends.exe"
// Win32_ProcessStopTrace
"League of Le" // How can this happen??? Like how???

后

// __InstanceCreationEvent
"League of Legends.exe"
// __InstanceDeletionEvent
"League of Legends.exe"