I am using WMI to monitor few critical processes running in my server. I
subscribe to instance deletion event and check whether the process is my
processes and send a mail. But it happens that sometimes instancedeletion
event is called for all the processes in my system when they are still
running. After few mins or seconds the creationevent is called for all these
processes. I dont know why this happens. Could anyone tell me why it happens.
the code is as follows

string scope = @"\\.\root\CIMV2";
ManagementScope MgtScope = new ManagementScope(scope);
// create the wql query to subscribe to a process deletion
event
WqlEventQuery query =
new WqlEventQuery("__InstanceDeletionEvent",
new TimeSpan(0, 0, 10),
"TargetInstance isa \"Win32_Process\"");

// Initialize an event watcher and subscribe to events
// that match this query
//for deletion event
ManagementEventWatcher watcherDel =
new ManagementEventWatcher() ;
watcherDel.Query = query;
watcherDel.Scope = MgtScope;
watcherDel.EventArrived += new
EventArrivedEventHandler(DeletionArrived);
watcherDel.Start();

// for creation event
query = new WqlEventQuery("__InstanceCreationEvent",
new TimeSpan(0, 0, 10),
"TargetInstance isa \"Win32_Process\"");

ManagementEventWatcher watcherCre =
new ManagementEventWatcher();
watcherCre.Query = query;
watcherCre.Scope = MgtScope;
watcherCre.EventArrived += new
EventArrivedEventHandler(CreationArrived);
watcherCre.Start();
Console.ReadLine();
watcherDel.Stop();
watcherDel.Dispose();
watcherCre.Stop();
watcherCre.Dispose();

private void DeletionArrived(object sender, EventArrivedEventArgs e)
{
ManagementBaseObject eventArg =
(ManagementBaseObject)(e.NewEvent["TargetInstance"]);
string ProcessName = eventArg["Name"].ToString();
// check the name with my processes
}