Untitled

The best way to register process start time?
static void Main(string[] args)
{
  using (ManagementEventWatcher eventWatcher =
            new ManagementEventWatcher(@"SELECT * FROM
   __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'"))
  {
    // Subscribe for process creation notification.
    eventWatcher.EventArrived += ProcessStarted_EventArrived;
    eventWatcher.Start();
    Console.In.ReadLine();
    eventWatcher.EventArrived -= ProcessStarted_EventArrived;
    eventWatcher.Stop();
  }
}


static void ProcessStarted_EventArrived(object sender, EventArrivedEventArgs e)
{
  ManagementBaseObject obj = e.NewEvent["TargetInstance"] as ManagementBaseObject;

  // The Win32_Process class also contains a CreationDate property.
  Console.Out.WriteLine("ProcessName: {0} " + obj.Properties["Name"].Value);
}

using (ManagementEventWatcher eventWatcher =
          new ManagementEventWatcher(@"SELECT * FROM Win32_ProcessStartTrace"))
{
  // Subscribe for process creation notification.
  eventWatcher.EventArrived += ProcessStarted_EventArrived;
  eventWatcher.Start();
  Console.Out.WriteLine("started");
  Console.In.ReadLine();
  eventWatcher.EventArrived -= ProcessStarted_EventArrived;
  eventWatcher.Stop();
}

static void ProcessStarted_EventArrived(object sender, EventArrivedEventArgs e)
{
  Console.Out.WriteLine("ProcessName: {0} "
          + e.NewEvent.Properties["ProcessName"].Value);
}

using (ManagementEventWatcher eventWatcher =
       new ManagementEventWatcher(@"SELECT * FROM Win32_ProcessTrace"))
{
  eventWatcher.EventArrived += Process_EventArrived;
  eventWatcher.Start();
  Console.Out.WriteLine("started");
  Console.In.ReadLine();
  eventWatcher.EventArrived -= Process_EventArrived;
  eventWatcher.Stop();
}

static void Process_EventArrived(object sender, EventArrivedEventArgs e)
{
  Console.Out.WriteLine(e.NewEvent.ClassPath); // Use class path to distinguish
                                               // between start/stop process events.
  Console.Out.WriteLine("ProcessName: {0} "
      + e.NewEvent.Properties["ProcessName"].Value);
}