Hi

I'm trying to query information form the __MethodInvocationEvent class using the System::Management::ManagementEventWatcher class. I can query other __InstanceOperationEvent derived classes such as __InstanceCreationEvent, __InstanceDeletionEvent. Here the description says that the class is not implemented: https://msdn.microsoft.com/en-us/library/aa394583%28v=vs.85%29.aspx

Query used:

new EventQuery(String.Format("SELECT * FROM __MethodInvocationEvent " +
                "WITHIN 10 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name = '{1}'", processImage));

Can the class be used at all? Any help is appreciated.

"Not implemented" is pretty exact. 

Why do you think you need it?

I was curious what it does, looked like it could be used to get information about functions a process  is using. I want to keep track of what resources (files actually) a process is using without having to query NtSystemInformation all the time, so I started looking for process related events.

No.  It is a template used when a provider wants to event on a WMI method call.  I have never seen it used in any namespace but it appears that Hyper-V classes may use it.

To monitor process resource usage we normally use performance counters built into the process.

The system debugger can be used to trap on individual API calls.