Process Monitor

[DumbAndDumber]

Hey
So I got this idea to write a very small application for a school project that raises a balloon from the system tray everytime a new process is getting launched or an existing process quits.

With my current code, I am getting the list of processes using a timer.

This list needs to be compared with the previous list and detect differences (if this is possible, or should I use a different concept)? I have no clue how to do this.

I currently have:
-A ListView (ListView1), with the View property to "Details"
-A Timer (at a 5000ms interval), with the following code:

        Dim processList() As Process
        processList = Process.GetProcesses()
        For Each proc As Process In processList
            Dim Item As New ListViewItem
            Item.Text = proc.Id.ToString
            Item.SubItems.Add(proc.ProcessName.ToString)
            Item.SubItems.Add(proc.Responding.ToString)
            ListView1.Items.Add(Item)
        Next

Anyone can help me out with the comparison part?

tl;dr: Need some help with a piece of code to notify the user if a new process started or an existing process quit.

[stanav]

Use WMI for this. A quick Google for "wmi process events" returned this as the top hit:
http://weblogs.asp.net/whaggard/arch...11/438006.aspx

It's in C#, but can be converted to vb.net using online conversion tools. Or if you search enough, you should be able to find a vb.net version of it.

[DumbAndDumber]

Use WMI for this. A quick Google for "wmi process events" returned this as the top hit:
http://weblogs.asp.net/whaggard/arch...11/438006.aspx

It's in C#, but can be converted to vb.net using online conversion tools. Or if you search enough, you should be able to find a vb.net version of it.

well, this is the output:

Imports System
Imports System.ComponentModel
Imports System.Collections
Imports System.Globalization
Imports System.Management
 
Namespace WMI.Win32
    Public delegate void ProcessEventHandler(Win32_Process proc)
    Public Class ProcessWatcher
     Inherits ManagementEventWatcher
        ' Process Events
        Public event ProcessEventHandler ProcessCreated
        Public event ProcessEventHandler ProcessDeleted
        Public event ProcessEventHandler ProcessModified
 
        ' WMI WQL process query strings
        Shared ReadOnly String WMI_OPER_EVENT_QUERY = "SELECT Property FROM() As *
        End Property
__InstanceOperationEvent WITHIN 1 WHERE TargetInstance ISA "Win32_Process"c"
        static readonly String WMI_OPER_EVENT_QUERY_WITH_PROC =
            WMI_OPER_EVENT_QUERY + " and TargetInstance.Name = '{0}'"
 
        Public  Sub New()
            Init(String.Empty)
        End Sub
        Public  Sub New(ByVal processName As String)
            Init(processName)
        End Sub
        Private  Sub Init(ByVal processName As String)
            Me.Query.QueryLanguage = "WQL"
            If String.IsNullOrEmpty(processName) Then
                Me.Query.QueryString = WMI_OPER_EVENT_QUERY
            Else 
                Me.Query.QueryString =
                    String.Format(WMI_OPER_EVENT_QUERY_WITH_PROC, processName)
            End If
 
            Me.EventArrived += New EventArrivedEventHandler(watcher_EventArrived)
        End Sub
        Private  Sub watcher_EventArrived(ByVal sender As Object, ByVal e As EventArrivedEventArgs)
            Dim eventType As String =  e.NewEvent.ClassPath.ClassName 
            Win32_Process proc = New 
                Win32_Process(e.NewEvent("TargetInstance") as ManagementBaseObject)
 
            Select Case eventType
                Case "__InstanceCreationEvent"
                    If Not ProcessCreated Is Nothing Then
                         Dim break As ProcessCreated(proc)
                    End If
                Case "__InstanceDeletionEvent"
                    If Not ProcessDeleted Is Nothing Then
                         Dim break As ProcessDeleted(proc)
                    End If
                Case "__InstanceModificationEvent"
                    If Not ProcessModified Is Nothing Then
                         Dim break As ProcessModified(proc)
                    End If
            End Select
        End Sub
    End Class
 
    ' Auto-Generated running: mgmtclassgen Win32_Process /n root\cimv2 /o WMI.Win32
    ' Renaming the class from Process to Win32_Process
    Public Class Win32_Process
         ...
    End Class
End Namespace
 
' Sample Usage
Dim procWatcher As ProcessWatcher =  New ProcessWatcher("notepad.exe") 
procWatcher.ProcessCreated += New ProcessEventHandler(procWatcher_ProcessCreated)
procWatcher.ProcessDeleted += New ProcessEventHandler(procWatcher_ProcessDeleted)
procWatcher.ProcessModified += New ProcessEventHandler(procWatcher_ProcessModified)
procWatcher.Start()
 
' Do Work
 
procWatcher.Stop()

which obviously isn't going to work

[stanav]

It obviously doesn't work because you did not follow the instructions in that article. Did you run mgmtclassgen.exe to generate the Process class and then rename it to Win32_Process? That is the comment near the end of that code which reads:

' Auto-Generated running: mgmtclassgen Win32_Process /n root\cimv2 /o WMI.Win32
' Renaming the class from Process to Win32_Process
Public Class Win32_Process
         ...
End Class

All you did was just copy the partial code shown in the article and converted it into VB.Net without even checking to see if the code is complete.

[DumbAndDumber]

It obviously doesn't work because you did not follow the instructions in that article. Did you run mgmtclassgen.exe to generate the Process class and then rename it to Win32_Process? That is the comment near the end of that code which reads:

' Auto-Generated running: mgmtclassgen Win32_Process /n root\cimv2 /o WMI.Win32
' Renaming the class from Process to Win32_Process
Public Class Win32_Process
         ...
End Class

All you did was just copy the partial code shown in the article and converted it into VB.Net without even checking to see if the code is complete.

I ran the mgmtclassgen tool from the command-line and the Run-box but it gives an error (file not found).

I'm pretty new to (Visual Basic) .NET, so I don't understand everything.

What should I do?

[stanav]

I ran the mgmtclassgen tool from the command-line and the Run-box but it gives an error (file not found).

I'm pretty new to (Visual Basic) .NET, so I don't understand everything.

What should I do?

You should be able to run the command from VS's command prompt (not Windows' cmd.exe one).

Anyway, here is the whole thing that I've converted to VB.Net for you. Download the attached WMIWin32.vb file below. I haven't actually tested it but if the original C# code works then there is no reason the VB.Net version of it doesn't.

[gxry]

I've downloaded it, how to use that code?
could you please explain?
thanks