WMI event processor useage vs WMI query

Question

I want to be able to detect a change in the list of installed programs on a pc using wmi. I have 2 options 1- run a wmi query every X seconds and compare to a saved file containing the list. 2 - start a Wmi event that polls every X seconds.

Which uses less processing power give that I would like X to be 60 seconds?

Answer 1

The performance difference between the two will be fairly negligible.

Answer 2

As it's a 'versus' : create a 'Task Schedule' triggering on "event:NewApp"

WMI for peek any changes is so heavy processing. "EventLogs + Scheduling a Task "are really relevant. ( if enabled )