Detecting process start

10 Mar 2006 11:21 AM

Niclas

Hi,

I am trying to fire an event when a certain process starts, but can't get
the event to fire. Would appreciate if someone could validate the code below
for any obvious errors.
I was hoping this code would write an entry to my eventlog when every new
process start (as a test)

Public Class myClass

Private WithEvents ProcessWatch As ManagementEventWatcher

'Service OnStart Event launches StartProcessWatcher here

Private Sub StartProcessWatcher()

Dim wmiQuery As WqlEventQuery
wmiQuery = New WqlEventQuery("SELECT * FROM Win32_ProcessStartTrace")
ProcessWatch = New ManagementEventWatcher(wmiQuery)
AddHandler ProcessWatch.EventArrived, AddressOf Process_EventArrived
ProcessWatch.Start()
End Sub

Private Sub Logon_EventArrived(ByVal sender As Object, ByVal e As
System.Management.EventArrivedEventArgs)

WriteToLog(e.NewEvent.Properties("ProcessName").Value.ToString,
EventLogEntryType.Error)
'Writetolog method writes to eventlog
End Sub

Thanks

Niclas

10 Mar 2006 4:09 PM

Cor Ligthert [MVP]

Niclas,

In VB is to fire an event simple. The instruction is RaiseEvent,

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/vblr7/html/vastmraiseevent.asp

However I think that you needs probably the waitforexit of process

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cpref/html/frlrfsystemdiagnosticsprocessclasswaitforexittopic2.asp

I hope this helps,

Cor

Show quoteHide quote

"Niclas" <lindblom_nic***@hotmail.com> schreef in bericht
news:urM2jWDRGHA.4344@TK2MSFTNGP12.phx.gbl...
> Hi,
>
> I am trying to fire an event when a certain process starts, but can't get
> the event to fire. Would appreciate if someone could validate the code
> below for any obvious errors.
> I was hoping this code would write an entry to my eventlog when every new
> process start (as a test)
>
> Public Class myClass
>
> Private WithEvents ProcessWatch As ManagementEventWatcher
>
> 'Service OnStart Event launches StartProcessWatcher here
>
> Private Sub StartProcessWatcher()
>
> Dim wmiQuery As WqlEventQuery
> wmiQuery = New WqlEventQuery("SELECT * FROM Win32_ProcessStartTrace")
> ProcessWatch = New ManagementEventWatcher(wmiQuery)
> AddHandler ProcessWatch.EventArrived, AddressOf Process_EventArrived
> ProcessWatch.Start()
> End Sub
>
> Private Sub Logon_EventArrived(ByVal sender As Object, ByVal e As
> System.Management.EventArrivedEventArgs)
>
> WriteToLog(e.NewEvent.Properties("ProcessName").Value.ToString,
> EventLogEntryType.Error)
> 'Writetolog method writes to eventlog
> End Sub
>
>
>
> Thanks
>
> Niclas
>
>