How to know if a process has stopped or started using events in C#
There are numerous of ways to detect if a new process has started or stopped, sadly the majority of them are extremely inefficient as it requires you to keep looping through the active process constantly to see if a new one appeared in the array or if one is not there any more.
Luckily the windows Win32_ProcessStartTrace and Win32_ProcessStopTrace classes are here to help out.
The first thing we need to do is reference System.Management.dll in our project. Then we need to define the scope in your class which we will be using.
1 | using System.Management; |
After that we need to initialise the class which will contain the process start and process stopped events and add the handlers and their methods.
Add the two following variables in your Class.
1 2 | ManagementEventWatcher processStartEvent = new ManagementEventWatcher("SELECT * FROM Win32_ProcessStartTrace"); ManagementEventWatcher processStopEvent = new ManagementEventWatcher("SELECT * FROM Win32_ProcessStopTrace"); |
In your constructor the event handlers need to be added.
1 2 | processStartEvent.EventArrived += new EventArrivedEventHandler(processStartEvent_EventArrived); processStopEvent.EventArrived += new EventArrivedEventHandler(processStopEvent_EventArrived); |
and then their event methods that will be trigged when a process either starts or stops.
1 2 3 4 5 6 7 8 9 | void processStartEvent_EventArrived(object sender, EventArrivedEventArgs e) { // A new process has started } void processStopEvent_EventArrived(object sender, EventArrivedEventArgs e) { // A process has been stopped } |
And finally we need to start the events by using
1 2 | processStartEvent.Start(); processStopEvent.Start(); |
Your finished Class should look similar to something like this:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 | using System; using System.Management; using System.Windows.Forms; namespace ProcessWatcher { public partial class ProcessWatch : Form { ManagementEventWatcher processStartEvent = new ManagementEventWatcher("SELECT * FROM Win32_ProcessStartTrace"); ManagementEventWatcher processStopEvent = new ManagementEventWatcher("SELECT * FROM Win32_ProcessStopTrace"); public ProcessWatch() { InitializeComponent(); processStartEvent.EventArrived += new EventArrivedEventHandler(processStartEvent_EventArrived); processStartEvent.Start(); processStopEvent.EventArrived += new EventArrivedEventHandler(processStopEvent_EventArrived); processStopEvent.Start(); } void processStartEvent_EventArrived(object sender, EventArrivedEventArgs e) { string processName = e.NewEvent.Properties["ProcessName"].Value.ToString(); string processID = Convert.ToInt32(e.NewEvent.Properties["ProcessID"].Value).ToString(); Console.WriteLine("Process started. Name: " +processName + " | ID: " + processID); } void processStopEvent_EventArrived(object sender, EventArrivedEventArgs e) { string processName = e.NewEvent.Properties["ProcessName"].Value.ToString(); string processID = Convert.ToInt32(e.NewEvent.Properties["ProcessID"].Value).ToString(); Console.WriteLine("Process stopped. Name: " + processName + " | ID: " + processID); } } } |
This will get the WHOLE path name for the process…
WOW! This worked like a charm the very first time. Online code examples (sometimes) are incomplete or just don’t actually work – this one did exactly what it said it would do!
Very Well Defined Thankyou. But Let me know i want to get path of the processes as well.
Can you tell me how can i get paths.