DAMAR said:
Hello
Is it possible to know when a particular process started?
For example: I have such situation: I need to know when a notepad.exe is
started - i need to get an event of starting this process.
Can anyone help me?
On XP and higher you can use the WMI kerneltrace provider through
System.Management.
Something like this will do....
using System.Management;
public class MyClass
{
// set-up asynch. event watcher
public void Run()
{
ManagementEventWatcher w = null;
ManagementOperationObserver observer = new ManagementOperationObserver();
WqlEventQuery q = new WqlEventQuery();
q.EventClassName = "Win32_ProcessStartTrace";
q.Condition = "ProcessName='Notepad.exe'"; // wait for notepad.exe
process start event
w = new ManagementEventWatcher( q);
w.EventArrived += new
EventArrivedEventHandler(this.ProcStartEventArrived);
w.Start();
}
private void ProcStartEventArrived(object sender, EventArrivedEventArgs e)
{
//Get the Event object and display all properties
foreach(PropertyData pd in e.NewEvent.Properties) {
Console.WriteLine("{0},{1}",pd.Name, pd.Value);
}
}
}
class WMIEvent {
[MTAThread]
public static void Main() {
MyClass evnt = new MyClass();
evnt.Run();
Console.ReadLine(); // block thread for demo purposes
....
}
Willy.
