//引入命名空间
using System;
using System.Management;

public class EventSample 
{
    public static void Main(string[] args) 
    {
        // Full query string specified to the constructor
        WqlEventQuery q = 
            new WqlEventQuery("SELECT * FROM Win32_ComputerShutdownEvent");
   
        // Only relevant event class name specified to the constructor   
        // Results in the same query as above.
        WqlEventQuery query =
            new WqlEventQuery("Win32_ComputerShutdownEvent ");

        Console.WriteLine(query.QueryString);
        return;
    }
}

//引入命名空间
using System;
using System.Management;

public class EventSample 
{
    public static void Main(string[] args) 
    {
        // Requests all instance creation events,
        // with a specified latency of
        // 10 seconds. The query created
        // is "SELECT * FROM __InstanceCreationEvent WITHIN 10"
        WqlEventQuery q = new WqlEventQuery("__InstanceCreationEvent",
            new TimeSpan(0,0,10));

        Console.WriteLine(q.QueryString);
        return;
    }
}

//引入命名空间
using System;
using System.Management;

public class EventSample 
{
    public static void Main(string[] args) 
    {
        // Requests notification of the creation
        // of Win32_Service instances with
        // a 10 second allowed latency.
        WqlEventQuery q = new WqlEventQuery("__InstanceCreationEvent", 
            new TimeSpan(0,0,10), 
            "TargetInstance isa 'Win32_Service'");

        Console.WriteLine(q.QueryString);
        return;
    }
}

//引入命名空间
using System;
using System.Management;

public class EventSample 
{
    public static void Main(string[] args) 
    {
        // Requests sending aggregated events
        // if the number of events exceeds 15.
        String[] props = {"TargetInstance.SourceName"};
        WqlEventQuery q = 
            new WqlEventQuery(
            "__InstanceCreationEvent", 
            System.TimeSpan.MaxValue,
            "TargetInstance isa 'Win32_NTLogEvent'", 
            new TimeSpan(0,10,0), 
            props, 
            "NumberOfEvents >15");

        Console.WriteLine(q.QueryString);
        return;
    }
}