Answered by:
How to detect lunch or closing process ?

Question
-
I try to detect the launch and closing process on my machine, in real time. I have already made a working prototype based on a timer which maintains a list of active processes, but this is relatively slow and not very optimized.
I looked for a hook to do so but I have found nothing conclusive.
Would you have an idea? Advice? A track where I could look?
Thanks.
Answers
-
You can do it with the WMI Win32_ProcessTrace classes. Start a new Console application, Project + Add Reference, select System.Management.
using System;
using System.Management;
class Process {
public static void Main() {
ManagementEventWatcher startWatch = new ManagementEventWatcher(
new WqlEventQuery("SELECT * FROM Win32_ProcessStartTrace"));
startWatch.EventArrived += new EventArrivedEventHandler(startWatch_EventArrived);
startWatch.Start();
ManagementEventWatcher stopWatch = new ManagementEventWatcher(
new WqlEventQuery("SELECT * FROM Win32_ProcessStopTrace"));
stopWatch.EventArrived += new EventArrivedEventHandler(stopWatch_EventArrived);
stopWatch.Start();
Console.WriteLine("Press ENTER to exit");
Console.ReadLine();
startWatch.Stop();
stopWatch.Stop();
}
static void stopWatch_EventArrived(object sender, EventArrivedEventArgs e) {
Console.WriteLine("Process stopped: {0}", e.NewEvent.Properties["ProcessName"].Value);
}
static void startWatch_EventArrived(object sender, EventArrivedEventArgs e) {
Console.WriteLine("Process started: {0}", e.NewEvent.Properties["ProcessName"].Value);
}
}
Hans Passant.- Marked as answer by ThitoO Sunday, May 10, 2009 1:27 PM
All replies
-
You can do it with the WMI Win32_ProcessTrace classes. Start a new Console application, Project + Add Reference, select System.Management.
using System;
using System.Management;
class Process {
public static void Main() {
ManagementEventWatcher startWatch = new ManagementEventWatcher(
new WqlEventQuery("SELECT * FROM Win32_ProcessStartTrace"));
startWatch.EventArrived += new EventArrivedEventHandler(startWatch_EventArrived);
startWatch.Start();
ManagementEventWatcher stopWatch = new ManagementEventWatcher(
new WqlEventQuery("SELECT * FROM Win32_ProcessStopTrace"));
stopWatch.EventArrived += new EventArrivedEventHandler(stopWatch_EventArrived);
stopWatch.Start();
Console.WriteLine("Press ENTER to exit");
Console.ReadLine();
startWatch.Stop();
stopWatch.Stop();
}
static void stopWatch_EventArrived(object sender, EventArrivedEventArgs e) {
Console.WriteLine("Process stopped: {0}", e.NewEvent.Properties["ProcessName"].Value);
}
static void startWatch_EventArrived(object sender, EventArrivedEventArgs e) {
Console.WriteLine("Process started: {0}", e.NewEvent.Properties["ProcessName"].Value);
}
}
Hans Passant.- Marked as answer by ThitoO Sunday, May 10, 2009 1:27 PM
-
-
-
I am using the WMI classes to detect launch/exit of a process and it works well. However this requires my app to run in an elevated mode. I cannot do that and need to support the app running without admin privileges as well.
The only other solution I can think of is polling every some interval on Process.GetProcesses and Process.HasExited to detect this.
Are there any other solutions?
Thanks,
Purvi