-
Oct 8th, 2010, 02:46 AM
#1
Simple ManagementEventWatcher for process start-stop detaction
It's a simple WMI usage for detecting the state of a process.
You can take this example and extend it at all WMI event queries if you like
First add a reference to system.management and a textbox
then:
Code:
Imports System.Management
Public Class Form1
Inherits System.Windows.Forms.Form
Dim WithEvents startWatch As New ManagementEventWatcher(New WqlEventQuery("SELECT * FROM Win32_ProcessStartTrace"))
Dim WithEvents stopWatch As New ManagementEventWatcher(New WqlEventQuery("SELECT * FROM Win32_ProcessStopTrace"))
Private Sub Form1_Load(ByVal sender As Object, ByVal e As System.EventArgs) Handles MyBase.Load
AddHandler startWatch.EventArrived, AddressOf startWatch_EventArrived
AddHandler stopWatch.EventArrived, AddressOf stopWatch_EventArrived
''''''This can be implemented so you can get a remote PC processes. I'm commenting this and you can test it whenever you like:
' Dim opt As ObjectGetOptions
'opt = New ObjectGetOptions(Nothing, TimeSpan.MaxValue, True)
' Dim manClass As New ManagementClass("\\testPCyouneed\root\cimv2", "Win32_Service", opt)
' manClass.Scope.Options.EnablePrivileges = True
' manClass.Scope.Options.Impersonation = ImpersonationLevel.Impersonate
' manClass.Scope.Options.Username = "adminusername"
' manClass.Scope.Options.Password = "adminpassword"
' manClass.Scope.Options.Authority = "ntlmdomain:yourdomain"
'startWatch.Scope = manClass.Scope
' stopWatch.Scope = manClass.Scope
startWatch.Start()
stopWatch.Start()
end sub
Public Sub startWatch_EventArrived(ByVal sender As Object, ByVal e As EventArrivedEventArgs)
' TextBox1.text = "Process started: " & e.NewEvent.Properties("ProcessName").Value
SetControlText(TextBox1, "Process started: " & e.NewEvent.Properties("ProcessName").Value)
End Sub
Private Sub stopWatch_EventArrived(ByVal sender As Object, ByVal e As System.Management.EventArrivedEventArgs)
' TextBox1.text = "Process stopped: " & e.NewEvent.Properties("ProcessName").Value
SetControlText(TextBox1, "Process stopped: " & e.NewEvent.Properties("ProcessName").Value)
End Sub
Private Sub Form1_Closing(ByVal sender As Object, ByVal e As System.ComponentModel.CancelEventArgs) Handles MyBase.Closing
startWatch.Stop()
stopWatch.Stop()
End Sub
Private Delegate Sub SetControlTextInvoker(ByVal ctl As Control, ByVal text As String)
Private Sub SetControlText(ByVal ctl As Control, ByVal text As String)
If ctl.InvokeRequired Then
ctl.Invoke(New SetControlTextInvoker(AddressOf SetControlText), _
ctl, _
text)
Else
ctl.Text = text
End If
End Sub
End Class
Last edited by sapator; Feb 21st, 2018 at 07:51 AM.
ἄνδρα μοι ἔννεπε, μοῦσα, πολύτροπον, ὃς μάλα πολλὰ
πλάγχθη, ἐπεὶ Τροίης ἱερὸν πτολίεθρον ἔπερσεν·
-
Feb 28th, 2011, 01:21 PM
#2
Addicted Member
Re: Simple ManagementEventWatcher for process start-stop detaction
This works on XP and server2003, but it fails on Windows 7. It works if you run an administrator, is there a work around?
I know I can just get a timer and getprocess every so often, but its a bit CPU intensive each time the timer ticks...
-
Feb 28th, 2011, 08:21 PM
#3
Re: Simple ManagementEventWatcher for process start-stop detaction
I don't know, maybe if you use impersonation but i have other things going so i can't test(also no win7 here).If you find something that works you are welcome to post it here.
ἄνδρα μοι ἔννεπε, μοῦσα, πολύτροπον, ὃς μάλα πολλὰ
πλάγχθη, ἐπεὶ Τροίης ἱερὸν πτολίεθρον ἔπερσεν·
-
May 19th, 2017, 03:41 AM
#4
Re: Simple ManagementEventWatcher for process start-stop detaction
I have modified the initial post so now i believe it will work, as it had a problem with Cross-thread operation on Win7 and above.
Only took 7 years
Last edited by sapator; May 19th, 2017 at 03:58 AM.
ἄνδρα μοι ἔννεπε, μοῦσα, πολύτροπον, ὃς μάλα πολλὰ
πλάγχθη, ἐπεὶ Τροίης ἱερὸν πτολίεθρον ἔπερσεν·
-
May 19th, 2017, 07:29 AM
#5
Fanatic Member
Re: Simple ManagementEventWatcher for process start-stop detaction
I did get it to work, but it took a bit of extra work. Initially it gave me two errors.
1) in lines 5 & 6, ManagementEventWatcher is not defined
2) in lines 17 & 22, EventArrivedEventArgs is not defined.
The problem was I needed to add a reference (which is what the instructions said -
I just misinterpreted them). I needed to go into Add References, and then click on Assemblies / Framework to find the System.Management reference.
The next problem is that it must run with admin rights. Although it worked great as written, running with admin rights is a show stopper for my app.
In any case, nice job!
Last edited by John_SC; May 19th, 2017 at 07:50 AM.
-
May 19th, 2017, 07:58 AM
#6
Re: Simple ManagementEventWatcher for process start-stop detaction
Yep.
Haven looked for admin rights but, as I've said to the 2010 post, maybe something can be done with impersonation but I haven't tried.
ἄνδρα μοι ἔννεπε, μοῦσα, πολύτροπον, ὃς μάλα πολλὰ
πλάγχθη, ἐπεὶ Τροίης ἱερὸν πτολίεθρον ἔπερσεν·
-
Feb 21st, 2018, 07:47 AM
#7
Re: Simple ManagementEventWatcher for process start-stop detaction
OK. I'm making an addition here, I will add an extra on how you can use this as a main console and check the process of other computers by using credentials.
I have tested this on my win7 PC and I am getting the processes of a remote machine in the domain that is a 2012R2 Server.
This works 100% for me. See additions on the first post.
Last edited by sapator; Feb 21st, 2018 at 08:45 AM.
ἄνδρα μοι ἔννεπε, μοῦσα, πολύτροπον, ὃς μάλα πολλὰ
πλάγχθη, ἐπεὶ Τροίης ἱερὸν πτολίεθρον ἔπερσεν·
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
Click Here to Expand Forum to Full Width
|