Imports System
Imports System.ComponentModel
Imports System.Collections
Imports System.Globalization
Imports System.Management
Namespace WMI.Win32
Public delegate void ProcessEventHandler(Win32_Process proc)
Public Class ProcessWatcher
Inherits ManagementEventWatcher
' Process Events
Public event ProcessEventHandler ProcessCreated
Public event ProcessEventHandler ProcessDeleted
Public event ProcessEventHandler ProcessModified
' WMI WQL process query strings
Shared ReadOnly String WMI_OPER_EVENT_QUERY = "SELECT Property FROM() As *
End Property
__InstanceOperationEvent WITHIN 1 WHERE TargetInstance ISA "Win32_Process"c"
static readonly String WMI_OPER_EVENT_QUERY_WITH_PROC =
WMI_OPER_EVENT_QUERY + " and TargetInstance.Name = '{0}'"
Public Sub New()
Init(String.Empty)
End Sub
Public Sub New(ByVal processName As String)
Init(processName)
End Sub
Private Sub Init(ByVal processName As String)
Me.Query.QueryLanguage = "WQL"
If String.IsNullOrEmpty(processName) Then
Me.Query.QueryString = WMI_OPER_EVENT_QUERY
Else
Me.Query.QueryString =
String.Format(WMI_OPER_EVENT_QUERY_WITH_PROC, processName)
End If
Me.EventArrived += New EventArrivedEventHandler(watcher_EventArrived)
End Sub
Private Sub watcher_EventArrived(ByVal sender As Object, ByVal e As EventArrivedEventArgs)
Dim eventType As String = e.NewEvent.ClassPath.ClassName
Win32_Process proc = New
Win32_Process(e.NewEvent("TargetInstance") as ManagementBaseObject)
Select Case eventType
Case "__InstanceCreationEvent"
If Not ProcessCreated Is Nothing Then
Dim break As ProcessCreated(proc)
End If
Case "__InstanceDeletionEvent"
If Not ProcessDeleted Is Nothing Then
Dim break As ProcessDeleted(proc)
End If
Case "__InstanceModificationEvent"
If Not ProcessModified Is Nothing Then
Dim break As ProcessModified(proc)
End If
End Select
End Sub
End Class
' Auto-Generated running: mgmtclassgen Win32_Process /n root\cimv2 /o WMI.Win32
' Renaming the class from Process to Win32_Process
Public Class Win32_Process
...
End Class
End Namespace
' Sample Usage
Dim procWatcher As ProcessWatcher = New ProcessWatcher("notepad.exe")
procWatcher.ProcessCreated += New ProcessEventHandler(procWatcher_ProcessCreated)
procWatcher.ProcessDeleted += New ProcessEventHandler(procWatcher_ProcessDeleted)
procWatcher.ProcessModified += New ProcessEventHandler(procWatcher_ProcessModified)
procWatcher.Start()
' Do Work
procWatcher.Stop()
