{"id":279,"date":"2011-09-16T20:43:52","date_gmt":"2011-09-16T18:43:52","guid":{"rendered":"http:\/\/dev.flauschig.ch\/wordpress\/?p=279"},"modified":"2011-09-16T20:43:52","modified_gmt":"2011-09-16T18:43:52","slug":"listen-for-process-starts","status":"publish","type":"post","link":"http:\/\/dev.flauschig.ch\/wordpress\/?p=279","title":{"rendered":"Listen for Process Starts"},"content":{"rendered":"<p>Sometimes you might want to listen for a Process Start and do some Actions.<\/p>\n<p>To start listening, just run the following code:<\/p>\n<pre class=\"brush: csharp; title: ; wrap-lines: false; notranslate\" title=\"\">\r\npublic void StartProcessMonitoring()\r\n{\r\n\t\/\/ Create event query to be notified within 1 second of a change in a service\r\n\tWqlEventQuery query = new WqlEventQuery(&quot;__InstanceCreationEvent&quot;, new TimeSpan(0, 0, 1), &quot;TargetInstance isa \\&quot;Win32_Process\\&quot;&quot;);\r\n\r\n\t\/\/ Create the Watcher\r\n\twatcher = new ManagementEventWatcher();\r\n\twatcher.Query = query;\r\n\twatcher.EventArrived += new EventArrivedEventHandler(ProcessStartEvent);\r\n\twatcher.Start();\r\n}\r\n<\/pre>\n<p>The callback could then look like this:<\/p>\n<pre class=\"brush: csharp; title: ; wrap-lines: false; notranslate\" title=\"\">\r\npublic static void ProcessStartEvent(object sender, EventArrivedEventArgs e)\r\n{\r\n\tManagementBaseObject targetInstance = (ManagementBaseObject)e.NewEvent.Properties&#x5B;&quot;TargetInstance&quot;].Value;\r\n\tstring processName = targetInstance.Properties&#x5B;&quot;Name&quot;].Value.ToString();\r\n\tif (processName == &quot;myprocess.exe&quot;)\r\n\t{\r\n\t\t\/\/ Do whatever you want\r\n\t}\r\n}\r\n<\/pre>\n<p>I created a member for the watcher Object<\/p>\n<pre class=\"brush: csharp; gutter: false; title: ; wrap-lines: false; notranslate\" title=\"\">\r\nManagementEventWatcher watcher;\r\n<\/pre>\n<p>and closed it when the App closes, otherwise I got a COM Error or something.<br \/>\nHere&#8217;s the cleanup Code:<\/p>\n<pre class=\"brush: csharp; gutter: false; title: ; wrap-lines: false; notranslate\" title=\"\">\r\nwatcher.Stop();\r\nwatcher.Dispose();\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>Sometimes you might want to listen for a Process Start and do some Actions. To start listening, just run the following code: public void StartProcessMonitoring() { \/\/ Create event query to be notified within 1 second of a change in a service WqlEventQuery query = new WqlEventQuery(&quot;__InstanceCreationEvent&quot;, new TimeSpan(0, 0, 1), &quot;TargetInstance isa \\&quot;Win32_Process\\&quot;&quot;); \/\/ &hellip; <\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[4,3],"tags":[],"class_list":{"0":"entry","1":"post","2":"publish","3":"author-roemer","4":"post-279","6":"format-standard","7":"category-csharp","8":"category-programming"},"acf":[],"views":1749,"_links":{"self":[{"href":"http:\/\/dev.flauschig.ch\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/279"}],"collection":[{"href":"http:\/\/dev.flauschig.ch\/wordpress\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/dev.flauschig.ch\/wordpress\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/dev.flauschig.ch\/wordpress\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/dev.flauschig.ch\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=279"}],"version-history":[{"count":0,"href":"http:\/\/dev.flauschig.ch\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/279\/revisions"}],"wp:attachment":[{"href":"http:\/\/dev.flauschig.ch\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=279"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/dev.flauschig.ch\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=279"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/dev.flauschig.ch\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=279"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}