public iosSyslogger()
        {
            InitializeComponent();

            var watcher = new ManagementEventWatcher();

            //Allow data copy here
            mnu = new ContextMenuStrip();
            ToolStripMenuItem mnuCopy = new ToolStripMenuItem("Copy");
            mnu.Items.AddRange(new ToolStripItem[] { mnuCopy });

            mnuCopy.Click += new EventHandler(copyMnu_Click);

            this.loglevelCheckBox.SelectedIndexChanged += new System.EventHandler(this.checkbox_SelectedIndexChanged);
            this.processlistname.SelectedIndexChanged += new System.EventHandler(this.checkbox_SelectedIndexChanged);

            //Button Click Handler
            this.highlightBtn.Click += new System.EventHandler(this.highlightBtn_Click);
            this.clearSearchBtn.Click += new System.EventHandler(this.clearSearchBtn_Click);
            this.fixScroll.Click += new System.EventHandler(this.fixScroll_Click);
            this.searchBtn.Click += new System.EventHandler(this.searchBtn_Click);
            this.savedatagrid.Click += new System.EventHandler(this.saveBtn_Click);
            this.load.Click += new System.EventHandler(this.loadBtn_click);
            this.clearData.Click += new System.EventHandler(this.clearDataBtn_Click);
        }

        static void AddRemoveUSBHandler()
        {
            WqlEventQuery q;

            try
            {
                q = new WqlEventQuery();
                q.EventClassName = "__InstanceDeletionEvent";
                q.WithinInterval = pollInterval;
                //q.Condition = "TargetInstance ISA 'Win32_USBControllerdevice'";
                q.Condition = "TargetInstance ISA 'Win32_PnPEntity'";
                //w = new ManagementEventWatcher(scope, q);
                w = new ManagementEventWatcher(q);
                w.EventArrived += USBRemoved;

                w.Start();
            }
            catch (Exception e)
            {
                Console.WriteLine(e.Message);
                if (w != null)
                {
                    w.Stop();
                }
            }
        }

        public static void Run()
        {
            // Create event query to be notified within 1 second of
            // a new process being created
            WqlEventQuery query =
                new WqlEventQuery("__InstanceCreationEvent",
                new TimeSpan(0, 0, 1),
                "TargetInstance isa \"Win32_Process\"");

            // Initialize an event watcher and subscribe to events
            // that match this query
            ManagementEventWatcher watcher =
                new ManagementEventWatcher(query);
            // times out watcher.WaitForNextEvent in 5 seconds
            watcher.Options.Timeout = new TimeSpan(0, 0, 5);

            // Block until the next event occurs
            // Note: this can be done in a loop if waiting for
            //        more than one occurrence
            Console.WriteLine(
              "Open an application (notepad.exe) to trigger an event.");
            ManagementBaseObject e = watcher.WaitForNextEvent();
            log.Debug(e.GetText(TextFormat.Mof ));
            ManagementBaseObject target = (ManagementBaseObject)e["TargetInstance"];
            Object targetName = target["Name"];
            Object targetPath = target["ExecutablePath"];
            //Display information from the event
            log.Info(
                "Process {0} has been created, path is: " + targetName + ", " + targetPath);

            //Cancel the subscription
            watcher.Stop();
        }

		public DriveService()
		{
			// Bind to local machine
			var options = new ConnectionOptions { EnablePrivileges = true };
			var scope = new ManagementScope(@"root\CIMV2", options);

			try
			{
				var query = new WqlEventQuery
				{
					EventClassName = "__InstanceModificationEvent",
					WithinInterval = TimeSpan.FromSeconds(1),
					Condition = @"TargetInstance ISA 'Win32_LogicalDisk' and TargetInstance.DriveType = 5" // DriveType - 5: CDROM
				};

				this.watcher = new ManagementEventWatcher(scope, query);

				// register async. event handler
				this.watcher.EventArrived += this.HandleDiscEvent;
				this.watcher.Start();
			}
			catch (Exception e)
			{
				System.Diagnostics.Debug.WriteLine(e.Message);
			}
		}

        public void Start(PagesPrinted callback)
        {
            Printed += callback;

            try
            {

                ManagementScope scope;

                if (!ComputerName.Equals("localhost", StringComparison.OrdinalIgnoreCase))
                {
                    var conn = new ConnectionOptions();
                    conn.Username = "";
                    conn.Password = "";
                    conn.Authority = "ntlmdomain:DOMAIN";
                    scope = new ManagementScope(String.Format("\\\\{0}\\root\\CIMV2", ComputerName), conn);
                }
                else
                {
                    scope = new ManagementScope(String.Format("\\\\{0}\\root\\CIMV2", ComputerName), null);
                }
                scope.Connect();

                _watcher = new ManagementEventWatcher(scope, new EventQuery(WmiQuery));
                _watcher.EventArrived += new EventArrivedEventHandler(this.WmiEventHandler);
                _watcher.Start();

            }
            catch (Exception e)
            {
                Console.WriteLine("Exception {0} Trace {1}", e.Message, e.StackTrace);
            }
        }

 public ProcessObserver()
 {
     watcher = new ManagementEventWatcher();
         watcher.Query = new WqlEventQuery("__InstanceCreationEvent", new TimeSpan(0, 0, 1), "TargetInstance isa \"Win32_Process\""); ;
         watcher.EventArrived += new EventArrivedEventHandler(OnProcessStarted);
         watcher.Start();
 }

        private void Init()
        {
            battlefieldIsRunning = false;
            ShowStatus();

            // Hook up to the Application Started events
            startWatch = new ManagementEventWatcher(new WqlEventQuery("SELECT * FROM Win32_ProcessStartTrace"));
            startWatch.EventArrived += new EventArrivedEventHandler(startWatch_EventArrived);
            try
            {
                startWatch.Start();
            }
            catch (Exception)
            {
                MessageBox.Show("Can't start the Process-Monitor! Are you running as admin?");
                return;
            }

            // Hoop up to the Application closed events
            stopWatch = new ManagementEventWatcher(new WqlEventQuery("SELECT * FROM Win32_ProcessStopTrace"));
            stopWatch.EventArrived += new EventArrivedEventHandler(stopWatch_EventArrived);            
            try
            {
                stopWatch.Start();
            }
            catch (Exception)
            {
                MessageBox.Show("Can't start the Process-Monitor! Are you running as admin?");
            }
        }

        public Boolean AddUSBEventWatcher(EventArrivedEventHandler usbInsertHandler, EventArrivedEventHandler usbRemoveHandler, TimeSpan withinInterval)
        {
            try
            {
                ManagementScope Scope = new ManagementScope("root\\CIMV2");
                Scope.Options.EnablePrivileges = true;

                if (usbInsertHandler != null)
                {
                    WqlEventQuery InsertQuery = new WqlEventQuery("__InstanceCreationEvent", withinInterval, "TargetInstance isa 'Win32_USBControllerDevice'");
                    insertWatcher = new ManagementEventWatcher(Scope, InsertQuery);
                    insertWatcher.EventArrived += usbInsertHandler;
                    insertWatcher.Start();
                }

                if (usbRemoveHandler != null)
                {
                    WqlEventQuery RemoveQuery = new WqlEventQuery("__InstanceDeletionEvent", withinInterval, "TargetInstance isa 'Win32_USBControllerDevice'");
                    removeWatcher = new ManagementEventWatcher(Scope, RemoveQuery);
                    removeWatcher.EventArrived += usbRemoveHandler;
                    removeWatcher.Start();
                }
                return true;
            }
            catch (Exception)
            {
                RemoveUSBEventWatcher();
                return false;
            }
        }

        public ProcessWatcher(TaskScheduler scheduler, params string[] processNames)
        {
            Scheduler = scheduler;

            foreach (var pname in processNames) {
                var invariant = Path.GetFileNameWithoutExtension(pname).ToLowerInvariant();
                ProcessNames.Add(invariant);

                foreach (var process in Process.GetProcessesByName(invariant)) {
                    RunningProcessIds.Add(process.Id);
                    NewProcesses.Enqueue(process);
                }
            }

            try {
                var query = new WqlEventQuery(@"SELECT * FROM Win32_ProcessStartTrace");
                Watcher = new ManagementEventWatcher(query);
                Watcher.Options.BlockSize = 1;
                Watcher.EventArrived += new EventArrivedEventHandler(OnEventArrived);
                Watcher.Start();
                WatcherEnabled = true;
            } catch {
                Watcher = null;
                WatcherEnabled = false;

                TimerTask = Scheduler.Start(InitTimer(), TaskExecutionPolicy.RunAsBackgroundTask);
            }
        }

        static PathUtility()
        {
            var combinedPath = Path.Combine("a", "b");
            DefaultDirectorySeparator = combinedPath.Substring(1, combinedPath.Length - 2);

            //Insert
            WqlEventQuery q_creation = new WqlEventQuery();
            q_creation.EventClassName = "__InstanceCreationEvent";
            q_creation.WithinInterval = new TimeSpan(0, 0, 2);    //How often do you want to check it? 2Sec.
            q_creation.Condition = @"TargetInstance ISA 'Win32_DiskDriveToDiskPartition'";
            _mweCreation = new ManagementEventWatcher(q_creation);
            _mweCreation.EventArrived += UsbStorageInserted;
            _mweCreation.Start(); // Start listen for events

            //Remove
            WqlEventQuery q_deletion = new WqlEventQuery();
            q_deletion.EventClassName = "__InstanceDeletionEvent";
            q_deletion.WithinInterval = new TimeSpan(0, 0, 2);    //How often do you want to check it? 2Sec.
            q_deletion.Condition = @"TargetInstance ISA 'Win32_DiskDriveToDiskPartition'  ";
            _mweDeletion = new ManagementEventWatcher(q_deletion);
            _mweDeletion.EventArrived += UsbStorageRemoved;
            _mweDeletion.Start(); // Start listen for events

            Storage = _knownStorage;
            UpdateStorage();
        }

        static void Main(string[] args)
        {
            var scope = new ManagementScope();
            scope.Path.NamespacePath = WmiConstants.Namespace;

            var createdWatcher = new ManagementEventWatcher(scope, new WqlEventQuery(WmiConstants.TaskCreatedQuery));
            var changedWatcher = new ManagementEventWatcher(scope, new WqlEventQuery(WmiConstants.TaskChangedQuery));
            var removedWatcher = new ManagementEventWatcher(scope, new WqlEventQuery(WmiConstants.TaskRemovedQuery));

            createdWatcher.EventArrived += ObjectCreated_EventArrived;
            changedWatcher.EventArrived += ObjectChanged_EventArrived;
            removedWatcher.EventArrived += ObjectRemoved_EventArrived;

            try
            {
                createdWatcher.Start();
                changedWatcher.Start();
                removedWatcher.Start();

                Console.WriteLine("Press Any Key to Exit");
                Console.WriteLine();
                Console.Read();
            }
            finally
            {
                if (createdWatcher != null)
                    createdWatcher.Stop();

                if (changedWatcher != null)
                    changedWatcher.Stop();

                if (removedWatcher != null)
                    removedWatcher.Stop();
            }
        }

        /// <summary>
        /// The start detection.
        /// </summary>
        /// <param name="action">
        /// The detection Action.
        /// </param>
        public void StartDetection(Action action)
        {
            ThreadPool.QueueUserWorkItem(
                delegate
                {
                    this.detectionAction = action;

                    var options = new ConnectionOptions { EnablePrivileges = true };
                    var scope = new ManagementScope(@"root\CIMV2", options);

                    try
                    {
                        var query = new WqlEventQuery
                        {
                            EventClassName = "__InstanceModificationEvent",
                            WithinInterval = TimeSpan.FromSeconds(1),
                            Condition = @"TargetInstance ISA 'Win32_LogicalDisk' and TargetInstance.DriveType = 5" // DriveType - 5: CDROM
                        };

                        this.watcher = new ManagementEventWatcher(scope, query);
                        this.watcher.EventArrived += this.WatcherEventArrived;
                        this.watcher.Start();
                    }
                    catch (Exception e)
                    {
                        Console.WriteLine(e.Message);
                    }
                });
        }

        public ChooseForm ()
        {
            InitializeComponent ();

            processView.ListViewItemSorter = new ProcessViewItemComparer ();
            usbDevView.ListViewItemSorter = new DeviceViewItemComparer ();

            processViewUpdater = new ProcessViewUpdater (processView);
            usbViewUpdater = new UsbViewUpdater (usbDevView);

            WqlEventQuery startQuery = new WqlEventQuery ();
            startQuery.EventClassName = "Win32_ProcessStartTrace";

            WqlEventQuery stopQuery = new WqlEventQuery ();
            stopQuery.EventClassName = "Win32_ProcessStopTrace";

            ManagementEventWatcher w = new ManagementEventWatcher (startQuery);
            w.EventArrived += new EventArrivedEventHandler (ProcessEventArrived);
            w.Start();
            processStartWatcher = w;

            w = new ManagementEventWatcher (stopQuery);
            w.EventArrived += new EventArrivedEventHandler (ProcessEventArrived);
            w.Start ();
            processStopWatcher = w;
        }

        void SendLogEntry(WmiTraceListener listener,
                          LogEntry logEntry)
        {
            ManagementScope scope = new ManagementScope(@"\\." + wmiPath);
            scope.Options.EnablePrivileges = true;

            StringBuilder sb = new StringBuilder("SELECT * FROM ");
            sb.Append("LogEntryV20");
            string query = sb.ToString();
            EventQuery eq = new EventQuery(query);

            using (ManagementEventWatcher watcher = new ManagementEventWatcher(scope, eq))
            {
                watcher.EventArrived += new EventArrivedEventHandler(watcher_EventArrived);
                watcher.Start();

                LogSource source = new LogSource("notfromconfig", SourceLevels.All);
                source.Listeners.Add(listener);
                source.TraceData(TraceEventType.Error, 1, logEntry);

                BlockUntilWMIEventArrives();

                watcher.Stop();
            }
        }

 private void AddInsertUSBHandler()
 {
     WqlEventQuery query;
     ManagementScope scope = new ManagementScope("root\\CIMV2");
     scope.Options.EnablePrivileges = true;
     insertUSBWatcher = null;
     try
     {
         query = new WqlEventQuery();
         query.EventClassName = "__InstanceCreationEvent";
         query.WithinInterval = new TimeSpan(0, 0, 3);
         query.Condition = "TargetInstance ISA 'Win32_USBControllerdevice'";
         insertUSBWatcher = new ManagementEventWatcher(scope, query);
         insertUSBWatcher.EventArrived += USBInserted;
         insertUSBWatcher.Start();
     }
     catch(Exception e)
     {
         if (insertUSBWatcher != null)
         {
             insertUSBWatcher.Stop();
         }
         throw e;
     }
 }

 /// <summary>
 /// USB 插入和拔出监测函数。
 /// 使用ManagementEventWacher来预定特定系统事件，通过WqlEventQuery设置查询对象和条件以及其他属性（比如查询的轮询间隔），
 /// 通过ManagementScope设置查询路径范围。
 /// </summary>
 public void USBRemoveWacher()
 {
     ManagementEventWatcher wacher = null;
     WqlEventQuery query = null;
     ManagementScope scope = null;
     try
     {
         scope = new ManagementScope("root\\CIMV2");                                //设置WMI路径
         query = new WqlEventQuery();                                               //设置查询的事件类名，条件，查询间隔，也可一次在构造函数中初始化
         query.EventClassName = "__InstanceDeletionEvent";
         query.Condition = @"TargetInstance ISA 'Win32_USBControllerdevice'";
         query.WithinInterval = new TimeSpan(1000);
         wacher = new ManagementEventWatcher(scope, query);
         wacher.EventArrived += new EventArrivedEventHandler(onUSBRemoved);
         wacher.Start();
     }
     catch (Exception ex)
     {
         MessageBox.Show(ex.Message);
     }
     this.Closed += (s, e) =>
       {
           wacher.Stop();
           wacher.Dispose();
       };
 }

 public UsbDeviceEvent()
 {
     this.creationEventWatcher = (ManagementEventWatcher)null;
     ManagementOperationObserver operationObserver = new ManagementOperationObserver();
     ManagementScope scope = new ManagementScope("root\\CIMV2");
     scope.Options.EnablePrivileges = true;
     try
     {
         WqlEventQuery wqlEventQuery = new WqlEventQuery();
         wqlEventQuery.EventClassName = "__InstanceCreationEvent";
         wqlEventQuery.WithinInterval = new TimeSpan(0, 0, 3);
         wqlEventQuery.Condition = "TargetInstance ISA 'Win32_USBControllerDevice'";
         Console.WriteLine(wqlEventQuery.QueryString);
         this.creationEventWatcher = new ManagementEventWatcher(scope, (EventQuery)wqlEventQuery);
         this.creationEventWatcher.EventArrived += new EventArrivedEventHandler(this.creationEventWatcher_EventArrived);
         this.creationEventWatcher.Start();
         wqlEventQuery.EventClassName = "__InstanceDeletionEvent";
         wqlEventQuery.WithinInterval = new TimeSpan(0, 0, 3);
         wqlEventQuery.Condition = "TargetInstance ISA 'Win32_USBControllerdevice'";
         Console.WriteLine(wqlEventQuery.QueryString);
         this.deletionEventWatcher = new ManagementEventWatcher(scope, (EventQuery)wqlEventQuery);
         this.deletionEventWatcher.EventArrived += new EventArrivedEventHandler(this.deletionEventWatcher_EventArrived);
         this.deletionEventWatcher.Start();
     }
     catch
     {
         this.Dispose();
     }
 }

        static void Main(string[] args)
        {
            ManagementEventWatcher w1;
            ManagementEventWatcher w2;
            ManagementEventWatcher w3;
            ManagementEventWatcher w4;

            WqlEventQuery q1 = new WqlEventQuery("select * from __instanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'win32_share' and TargetInstance.name = 'Pop-Music' ");
            w1 = new ManagementEventWatcher(q1);
            w1.EventArrived += new EventArrivedEventHandler(WriteStarted);

            WqlEventQuery q2 = new WqlEventQuery("select * from __instanceDeletionEvent WITHIN 1 WHERE TargetInstance ISA 'win32_share' and TargetInstance.name = 'Pop-Music' ");
            w2 = new ManagementEventWatcher(q2);
            w2.EventArrived += new EventArrivedEventHandler(WriteFinished);

            WqlEventQuery q3 = new WqlEventQuery("SELECT * FROM RegistryKeyChangeEvent WHERE Hive = 'HKEY_LOCAL_MACHINE'" + @" AND KeyPath = 'SOFTWARE\\LAB4'");
            w3 = new ManagementEventWatcher(q3);
            w3.EventArrived += new EventArrivedEventHandler(OnRegChanged);

            WqlEventQuery q4 = new WqlEventQuery("Select * From __InstanceOperationEvent Within 2 Where TargetInstance Isa 'CIM_DataFile' And TargetInstance.Drive='C:' And " + @"TargetInstance.Path='\\Lab4\\test\\'");
            w4 = new ManagementEventWatcher(q4);
            w4.EventArrived += new EventArrivedEventHandler(OnFolderChanged);

            w1.Start();
            w2.Start();
            w3.Start();
            w4.Start();

            System.Threading.Thread.Sleep(300000);
        }

        protected void StartWatching()
        {
            StopWatching(); // Just to make sure 

            DeleteWatcher = new ManagementEventWatcher
            {
                Query = new WqlEventQuery
                {
                    EventClassName = "__InstanceDeletionEvent",
                    Condition = "TargetInstance ISA 'Win32_PnPEntity'",
                    WithinInterval = new TimeSpan(0, 0, 1), //Todo: make the interval settable
                },
            };
            DeleteWatcher.EventArrived += PortsChanged;
            DeleteWatcher.Start();

            CreateWatcher = new ManagementEventWatcher
            {
                Query = new WqlEventQuery
                {
                    EventClassName = "__InstanceCreationEvent",
                    Condition = "TargetInstance ISA 'Win32_PnPEntity'",
                    WithinInterval = new TimeSpan(0, 0, 1), //Todo: make the interval settable
                },
            };
            CreateWatcher.EventArrived += PortsChanged;
            CreateWatcher.Start();
        }

 public void Start()
 {
     AddRunningProcesses();
     this.watcher = new ManagementEventWatcher(new WqlEventQuery("__InstanceCreationEvent", new TimeSpan(0, 0, 1), "TargetInstance isa \"Win32_Process\""));
     this.watcher.EventArrived += new EventArrivedEventHandler(ArrivedEventHandler);
     this.watcher.Start();
 }