Capturing processes

[SLE]

Hi there,

I am writing a service which monitors processes on the local machine.
Currently I have implemented a System.Manageme nt.ManagementEv entWatcher
which raises events for processes being launched:

New WqlEventQuery(" SELECT * FROM __InstanceCreat ionEvent WITHIN 0.1
WHERE TargetInstance ISA 'Win32_Process' ")

So far so good but I need additional information (e.g. window title)
which I'm getting via the System.Diagnost ics.Process:

p = Process.GetProc essById(pid)

....

windowTitle = p.MainWindowTit le
Problems occur when a lot of (concurrent) processes are launched in a
*short* period of time:

1) There is no WMI event for some processes (some events seem to be sunk)
2) When the WMI event comes in, the process might already been
terminated so the subsequent GetProcessById( ) fails.

Question:

Can I avoid WMI for having an event-driven model? Is there a *fast*,
event-driven way to detect processes being started/stopped?
--
SLE

[Ken Tucker [MVP]]

Hi,

Windows hooks
http://msdn.microsoft.com/msdnmag/is...0/CuttingEdge/
Ken
--------------------------
"SLE" <in**@NOSPAM.da taworx.be> wrote in message
news:uS******** ******@TK2MSFTN GP12.phx.gbl...
Hi there,

I am writing a service which monitors processes on the local machine.
Currently I have implemented a System.Manageme nt.ManagementEv entWatcher
which raises events for processes being launched:

New WqlEventQuery(" SELECT * FROM __InstanceCreat ionEvent WITHIN 0.1
WHERE TargetInstance ISA 'Win32_Process' ")

So far so good but I need additional information (e.g. window title)
which I'm getting via the System.Diagnost ics.Process:

p = Process.GetProc essById(pid)

....

windowTitle = p.MainWindowTit le
Problems occur when a lot of (concurrent) processes are launched in a
*short* period of time:

1) There is no WMI event for some processes (some events seem to be sunk)
2) When the WMI event comes in, the process might already been
terminated so the subsequent GetProcessById( ) fails.

Question:

Can I avoid WMI for having an event-driven model? Is there a *fast*,
event-driven way to detect processes being started/stopped?
--
SLE

[SLE]

Ken Tucker [MVP] wrote:

Hi,

Windows hooks
http://msdn.microsoft.com/msdnmag/is...0/CuttingEdge/
Ken
--------------------------
"SLE" <in**@NOSPAM.da taworx.be> wrote in message
news:uS******** ******@TK2MSFTN GP12.phx.gbl...
Hi there,

I am writing a service which monitors processes on the local machine.
Currently I have implemented a System.Manageme nt.ManagementEv entWatcher
which raises events for processes being launched:

New WqlEventQuery(" SELECT * FROM __InstanceCreat ionEvent WITHIN 0.1
WHERE TargetInstance ISA 'Win32_Process' ")

So far so good but I need additional information (e.g. window title)
which I'm getting via the System.Diagnost ics.Process:

p = Process.GetProc essById(pid)

...

windowTitle = p.MainWindowTit le
Problems occur when a lot of (concurrent) processes are launched in a
*short* period of time:

1) There is no WMI event for some processes (some events seem to be sunk)
2) When the WMI event comes in, the process might already been
terminated so the subsequent GetProcessById( ) fails.

Question:

Can I avoid WMI for having an event-driven model? Is there a *fast*,
event-driven way to detect processes being started/stopped?

Ken,

Thanks but looking into hooks as an alternative for WMI, I already ran
into that article. It describes local hooks; I would need a system wide
hook.

Problem is that implementing such system wide hooks (aka global hooks)
with "pure" .NET is no sinecure if not impossible.
--
SLE