How to Monitor Process Creation and Deletion

Question

5.00/5 (1 vote)

See more:

Hi Experts

How to get the Application class name while Launching as well as closing an application. For example the class Name of "Windows Internet Explorer(IE)" is "IEFrame". While opening as well as closing IE, how I can notify that using C sharp. Please help me on this. Thanks in Advance..

Regards

Arun Kumar

Posted 22-Mar-11 1:14am

Arun India

Updated 23-Mar-11 7:44am

Sergey Alexandrovich Kryukov

v2

Add a Solution

Comments

Sergey Alexandrovich Kryukov 23-Mar-11 13:46pm

The question turned out very interesting but only after clarification. My 5.
The title was misleading, I decided to modify it.
--SA

3 solutions

Solution 2

"Application class name" is not an attribute of the application in general case. You cannot know what does not exist. Not even for .NET applications.

—SA

Posted 22-Mar-11 7:18am

Sergey Alexandrovich Kryukov

Comments

Arun India 23-Mar-11 0:47am

SAKryukov, Is there any method to Notify(in C sharp code) while launching and closing an application.

Sergey Alexandrovich Kryukov 23-Mar-11 1:02am

You mean, some other application? You can notify closing if you get the process handle (System.Diagnostic.Process) and wait for it in some thread. Frankly, I have no idea how to notify creation of the process...
So, I don't know a good solution.

Great question, in fact! I would vote my 5 :-).
Needs some research...

--SA

Sergey Alexandrovich Kryukov 23-Mar-11 1:08am

I found a partial answer. You can notify only when a top window is created/destroyed. As the window is always a top one (due to the nature of the event you subscribe), suspect this is a new process or deleted process and rescan all processes. Not a very cheap method.

To get a "raw" notification, use global window hook with shell proc callback.

--SA

Arun India 23-Mar-11 1:06am

Thank you SAKryukov. Thank you very much for your valuable time..

Arun India 23-Mar-11 1:06am

and Let me to try with "System.Diagnostic.Process".

Sergey Alexandrovich Kryukov 23-Mar-11 1:10am

Wait, read my next idea, about a global system hook...
With Process.Wait the solution is not practical. You have to wait for all processes at the same time... on some thread(s)...
--SA

Sergey Alexandrovich Kryukov 23-Mar-11 1:24am

Good news for your. Forget system hook. Look at my other Answer.
I think the solution is found. Please test it.
--SA

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Sergey Alexandrovich Kryukov · Accepted Answer · 2011-03-22T19:17:00

Solution 3

Answering a follow-up question: how to monitor process creation and deletion.

Here is the CodeProject article explaining the technique: Hooking the native API and controlling process creation on a system-wide basis[^]
Most probably you need a C++ project which can interface with your C# assembly.

I think, there is a better solution.

This solution is based on WMI and complete with C# code: http://weblogs.asp.net/whaggard/archive/2006/02/11/438006.aspx[^].
In a nutshell, you should use the class System.Management.ManagementEventWatcher to do the trick.

—SA

Posted 22-Mar-11 19:17pm

Sergey Alexandrovich Kryukov

Updated 22-Mar-11 19:25pm

v4

Comments

Arun India 23-Mar-11 2:39am

Thank You SAKryukov.. You help me a lot. "System.Management.ManagementEventWatcher" will solve my problem.. Once again Thank you for your Valuable guidance.

Sergey Alexandrovich Kryukov 23-Mar-11 13:43pm

Great. You're welcome, Arun.
Thanks for accepting this Answer.
Good luck, call again.
--SA

Espen Harlinn 22-May-11 11:05am

Answer reuse - BTW: my 5

Sergey Alexandrovich Kryukov 22-May-11 13:53pm

Thank you, Espen.
Back than I was happy to learn myself that consuming that kind of events was possible with WMI.
--SA

#realJSOP · Accepted Answer · 2011-03-22T01:35:00

Solution 1

Try this:

C#

[DllImport("coredll.dll", SetLastError = true)]
public static extern int GetClassName(IntPtr hWnd, StringBuilder buf, int nMaxCount);

If that doesn't work, try this:

C#

[DllImport("user32.dll", SetLastError = true)]
public static extern int GetClassName(IntPtr hWnd, StringBuilder buf, int nMaxCount);

You many need to modify the attribute, but I'm not sure what else you would have to add. Google is your friend in that regard.

Call it like this from your main form:

C#

StringBuilder str = new StringBuilder();
GetClassName(this, str, 1);

Posted 22-Mar-11 1:35am

#realJSOP

Updated 22-Mar-11 1:42am

v3

Comments

Henry Minute 22-Mar-11 7:43am

I edited your solution because the last snippet had malformed tags and wasn't showing. Please check that I haven't cocked it up. :)

Arun India 22-Mar-11 8:28am

First of all Thanks John and Henry for your immediate reply. Could you tell me something more about it.
See I have a monitoring program called "Monitor" in C sharp. Suppose this monitoring program is running all the time, once you switch on the System. Now while launching an application(eg. IE), how this Monitor program get notified and how to access the class name of that application.
Thanks a lot for your Valuable time.

#realJSOP 22-Mar-11 8:33am

Post a new question for that.

Sergey Alexandrovich Kryukov 22-Mar-11 13:19pm

As I put in my answer, it makes no sense. (Please see.) The Application class is just the artifact of some library used to build applications.
--SA

Sergey Alexandrovich Kryukov 22-Mar-11 13:16pm

John, this is a windows class name, works only for a window. "Application class name" is not a universal concept, makes no sense for a general application.
--SA