Capturing processes

[SLE]

Hi there,

I am writing a service which monitors processes on the local machine.
Currently I have implemented a System.Management.ManagementEventWatcher
which raises events for processes being launched:

New WqlEventQuery("SELECT * FROM __InstanceCreationEvent WITHIN 0.1
WHERE TargetInstance ISA 'Win32_Process'")

So far so good but I need additional information (e.g. window title)
which I'm getting via the System.Diagnostics.Process:

p = Process.GetProcessById(pid)

....

windowTitle = p.MainWindowTitle


Problems occur when a lot of (concurrent) processes are launched in a
*short* period of time:

1) There is no WMI event for some processes (some events seem to be sunk)
2) When the WMI event comes in, the process might already been
terminated so the subsequent GetProcessById() fails.

Question:

Can I avoid WMI for having an event-driven model? Is there a *fast*,
event-driven way to detect processes being started/stopped?

 

[Ken Tucker [MVP]]

Hi,

Windows hooks
http://msdn.microsoft.com/msdnmag/issues/02/10/CuttingEdge/


Ken
--------------------------
Hi there,

I am writing a service which monitors processes on the local machine.
Currently I have implemented a System.Management.ManagementEventWatcher
which raises events for processes being launched:

New WqlEventQuery("SELECT * FROM __InstanceCreationEvent WITHIN 0.1
WHERE TargetInstance ISA 'Win32_Process'")

So far so good but I need additional information (e.g. window title)
which I'm getting via the System.Diagnostics.Process:

p = Process.GetProcessById(pid)

....

windowTitle = p.MainWindowTitle


Problems occur when a lot of (concurrent) processes are launched in a
*short* period of time:

1) There is no WMI event for some processes (some events seem to be sunk)
2) When the WMI event comes in, the process might already been
terminated so the subsequent GetProcessById() fails.

Question:

Can I avoid WMI for having an event-driven model? Is there a *fast*,
event-driven way to detect processes being started/stopped?

 

[SLE]

Hi,

Windows hooks
http://msdn.microsoft.com/msdnmag/issues/02/10/CuttingEdge/


Ken
--------------------------
Hi there,

I am writing a service which monitors processes on the local machine.
Currently I have implemented a System.Management.ManagementEventWatcher
which raises events for processes being launched:

New WqlEventQuery("SELECT * FROM __InstanceCreationEvent WITHIN 0.1
WHERE TargetInstance ISA 'Win32_Process'")

So far so good but I need additional information (e.g. window title)
which I'm getting via the System.Diagnostics.Process:

p = Process.GetProcessById(pid)

...

windowTitle = p.MainWindowTitle


Problems occur when a lot of (concurrent) processes are launched in a
*short* period of time:

1) There is no WMI event for some processes (some events seem to be sunk)
2) When the WMI event comes in, the process might already been
terminated so the subsequent GetProcessById() fails.

Question:

Can I avoid WMI for having an event-driven model? Is there a *fast*,
event-driven way to detect processes being started/stopped?

Ken,

Thanks but looking into hooks as an alternative for WMI, I already ran
into that article. It describes local hooks; I would need a system wide
hook.

Problem is that implementing such system wide hooks (aka global hooks)
with "pure" .NET is no sinecure if not impossible.