Simple ManagementEventWatcher for process start-stop detaction

[sapator]

It's a simple WMI usage for detecting the state of a process.
You can take this example and extend it at all WMI event queries if you like
First add a reference to system.management and a textbox
then:

Imports System.Management
Public Class Form1
    Inherits System.Windows.Forms.Form

 Dim WithEvents startWatch As New ManagementEventWatcher(New WqlEventQuery("SELECT * FROM Win32_ProcessStartTrace"))
    Dim WithEvents stopWatch As New ManagementEventWatcher(New WqlEventQuery("SELECT * FROM Win32_ProcessStopTrace"))
    Private Sub Form1_Load(ByVal sender As Object, ByVal e As System.EventArgs) Handles MyBase.Load
      
        AddHandler startWatch.EventArrived, AddressOf startWatch_EventArrived
     
        AddHandler stopWatch.EventArrived, AddressOf stopWatch_EventArrived

''''''This can be implemented so you can get a remote PC processes. I'm commenting this and you can test it whenever you like:

       ' Dim opt As ObjectGetOptions
        'opt = New ObjectGetOptions(Nothing, TimeSpan.MaxValue, True)
       ' Dim manClass As New ManagementClass("\\testPCyouneed\root\cimv2", "Win32_Service", opt)
       ' manClass.Scope.Options.EnablePrivileges = True
       ' manClass.Scope.Options.Impersonation = ImpersonationLevel.Impersonate
       ' manClass.Scope.Options.Username = "adminusername"
       ' manClass.Scope.Options.Password = "adminpassword"
       ' manClass.Scope.Options.Authority = "ntlmdomain:yourdomain"

        'startWatch.Scope = manClass.Scope
       ' stopWatch.Scope = manClass.Scope

 


        startWatch.Start()        
        stopWatch.Start()       
end sub 

       Public Sub startWatch_EventArrived(ByVal sender As Object, ByVal e As EventArrivedEventArgs)
      '  TextBox1.text = "Process started: " & e.NewEvent.Properties("ProcessName").Value      
 SetControlText(TextBox1, "Process started: " & e.NewEvent.Properties("ProcessName").Value) 
    End Sub

    Private Sub stopWatch_EventArrived(ByVal sender As Object, ByVal e As System.Management.EventArrivedEventArgs)
      '  TextBox1.text = "Process stopped: " & e.NewEvent.Properties("ProcessName").Value      
SetControlText(TextBox1, "Process stopped: " & e.NewEvent.Properties("ProcessName").Value)
    End Sub

    Private Sub Form1_Closing(ByVal sender As Object, ByVal e As System.ComponentModel.CancelEventArgs) Handles MyBase.Closing
        startWatch.Stop()
        stopWatch.Stop()
    End Sub

  Private Delegate Sub SetControlTextInvoker(ByVal ctl As Control, ByVal text As String)

    Private Sub SetControlText(ByVal ctl As Control, ByVal text As String)
        If ctl.InvokeRequired Then
            ctl.Invoke(New SetControlTextInvoker(AddressOf SetControlText), _
                       ctl, _
                       text)
        Else
            ctl.Text = text
        End If
    End Sub
End Class

[7777]

This works on XP and server2003, but it fails on Windows 7. It works if you run an administrator, is there a work around?
I know I can just get a timer and getprocess every so often, but its a bit CPU intensive each time the timer ticks...

[sapator]

I don't know, maybe if you use impersonation but i have other things going so i can't test(also no win7 here).If you find something that works you are welcome to post it here.

[sapator]

I have modified the initial post so now i believe it will work, as it had a problem with Cross-thread operation on Win7 and above.
Only took 7 years

[John_SC]

I did get it to work, but it took a bit of extra work. Initially it gave me two errors.
1) in lines 5 & 6, ManagementEventWatcher is not defined
2) in lines 17 & 22, EventArrivedEventArgs is not defined.

The problem was I needed to add a reference (which is what the instructions said -
I just misinterpreted them). I needed to go into Add References, and then click on Assemblies / Framework to find the System.Management reference.

The next problem is that it must run with admin rights. Although it worked great as written, running with admin rights is a show stopper for my app.

In any case, nice job!

[sapator]

Yep.
Haven looked for admin rights but, as I've said to the 2010 post, maybe something can be done with impersonation but I haven't tried.

[sapator]

OK. I'm making an addition here, I will add an extra on how you can use this as a main console and check the process of other computers by using credentials.
I have tested this on my win7 PC and I am getting the processes of a remote machine in the domain that is a 2012R2 Server.
This works 100% for me. See additions on the first post.