How to monitor process in vb.net?

by: game-masterPosted on 2009-11-04 at 17:11:57ID: 25745908

have a check to this link...

this might give u some idea...

http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Server/2003_Server/Q_23436726.html?sfQueryTermInfo=1+monitor+net+process

game-master

by: Dream_GPosted on 2009-11-04 at 17:24:34ID: 25745958

Hi,

The link is different from what I want because I want a way by a class or code in VB.NET that notify me if there is any create/kill process after run my app.

I have an idea but its not good enough which can get a copy of process list and re-check it again by every 1 sec to see of there is any different, but by this I cant check which source process kills a process or other information.

Waiting for Experts.

by: game-masterPosted on 2009-11-04 at 17:50:56ID: 25746088

good morning!

as u have said, u can get a copy of the process running..

***suggestion:

List the processes u have found on the two listbox.
First listbox holds the processes running and when some process kill it will reload the process running (every second)
Second listbox is a counter checker from which process has been kill.
Match the process listed on the 1st and 2nd listbox to determine what process has been kill...

game-master

by: Dream_GPosted on 2009-11-04 at 17:58:48ID: 25746123

Hi, good morning,

Yes as I suggest before, but this is useless because you will just know the name of process has been killed or created but you cant know other important info just as who killed it ? which is the thing I want to know after knowing the processes have been killed or created on the new process list after 1 sec time.

As I have been read, I guess there is a need to work with Windows API , Hook to implement this kind of detection but still don't know from where start.

by: game-masterPosted on 2009-11-04 at 18:14:40ID: 25746195

its hard to determine if the process was killed by the user or its due to error...

on the task manager, u can see the processes running as well as the User Name(denotes who is using the process, either the person log on the system or the system itself, etc)

On some point, the processes uses by the "SYSTEM" will not be killed by the "SYSTEM" itself, thus, it can be
the user who log on the computer who does killed it.

*Significance: If you are sure that the computer will not kill its own process, then u can assume that the processes
will be killed by the user who logs on the computer.*

game-master

by: Dream_GPosted on 2009-11-05 at 05:35:31ID: 25749224

Hi,
Yes as you mentioned, its hard to determine by your own. but I am sure there are Windows API that can notify you before any process run or kill as I have read before but don't know from where get the code.

Waiting for Experts,

by: egl1044Posted on 2009-11-06 at 08:35:36ID: 25760616

In VB6 I use WMI to raise event when a process is created. Converting to .NET should be easy.
Instead of Microsoft WMI Scripting library you would use the WMI Managment class.

__InstanceCreationEvent
__InstanceDeletionEvent

There is no API to accomplish this unless you are refering to the creating of (windows) and catching the created,destroyed messages.

Option Explicit
 
Dim WithEvents MySink As SWbemSink
Private objWMIService As SWbemServices
Dim strComputer As String
 
Private Sub Form_Load()
 
strComputer = "."
'//service
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\CIMV2")
Set MySink = New SWbemSink
 
'// __InstanceCreationEvent
objWMIService.ExecNotificationQueryAsync MySink, "SELECT * FROM __InstanceCreationEvent" & " WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'"
 
End Sub
 
Private Sub Form_QueryUnload(Cancel As Integer, UnloadMode As Integer)
'//Cancels all asynchronous operations that are associated with this sink.
MySink.Cancel
End Sub
 
Private Sub MySink_OnObjectReady(ByVal objWbemObject As WbemScripting.ISWbemObject, ByVal objWbemAsyncContext As WbemScripting.ISWbemNamedValueSet)
'//event
Debug.Print objWbemObject.TargetInstance.Name
End Sub

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:

Select all Open in new window

by: Dream_GPosted on 2009-11-08 at 12:35:11ID: 25771755

Hi egl1044,

Thanks, I have test the code which was difficult before because every time start the application gave me an error about WMI library I guess.

I have solved it and run the application with your code and start different application manually such as Notepad and Internet explorer and closed them, nothing happen to your application there is no notification in any kind, could you please help me ? for example show a message box that says the notepad is running now fore example ? or iexplorer.exe is created ?

by: Dream_GPosted on 2009-11-09 at 12:33:46ID: 25779727

Waiting for egl1044 or other Experts.

by: egl1044Posted on 2009-11-09 at 14:22:45ID: 25780772

Dream G,

I am in the process of bulding my computer from a fresh install so I have to install .NET. However in the mean time you can do some searching online

VB .NET __InstanceCreationEvent example using WMI

Something like this should give you examples how to do this in .NET

by: egl1044Posted on 2009-12-08 at 06:30:45ID: 25998092

Add reference to System.Managment.dll

Dim WithEvents p As New EventWatcherPolling

Imports System
Imports System.Management
 
Public Class EventWatcherPolling
 
  Public Event ProcessCreated(ByVal Name As String,
                              ByVal Path As String,
                              ByVal id As Integer)
  Public Event ProcessDeleted(ByVal Name As String,
                              ByVal Path As String,
                              ByVal id As Integer)
 
  Dim watcher As New ManagementEventWatcher
 
  Private Sub HandleEvent(ByVal sender As Object, ByVal e As EventArrivedEventArgs)
    Dim eventType As String = e.NewEvent.ClassPath.ClassName
    Dim procInstance As PropertyData = e.NewEvent.Properties("TargetInstance")
    Dim procObject As ManagementBaseObject = procInstance.Value
    Select Case eventType
      Case "__InstanceCreationEvent"
        RaiseEvent ProcessCreated(
            procObject("Name").ToString,
            procObject("ExecutablePath").ToString,
            Convert.ToInt32(procObject("ProcessID")))
      Case "__InstanceDeletionEvent"
        RaiseEvent ProcessDeleted(
            procObject("Name").ToString,
            procObject("ExecutablePath").ToString,
            Convert.ToInt32(procObject("ProcessID")))
    End Select
  End Sub
 
  Sub StartWatching()
    Dim query As New WqlEventQuery("SELECT * FROM __InstanceOperationEvent" &
                                   " WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'")
    watcher.Query = query
    AddHandler watcher.EventArrived, AddressOf HandleEvent
    watcher.Start()
  End Sub
 
  Sub StopWatching()
    watcher.Stop()
  End Sub
 
End Class

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:

Select all Open in new window

Question

How to monitor process in vb.net?

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

Visual Basic Programming

.NET

Microsoft Visual Studio Express

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Need individual assistance?

Our experts are ready to help.

Want to learn from the best?

Read articles from industry experts.

Working on a long term project?

Store your work and research.

What Makes Experts Exchange Unique?

Trusted by the world's most respected brands.

Faithfully serving IT professionals since 1996.

Related Solutions

Free Tech Articles

Cloud Class Webinars

Join the Community

Give a Little. Get a Lot.

Answers

3 Ways to Join

The Experts

The Experts

Testimonials

Testimonials

Testimonials

Business Clients

Business Clients

In the Press

In the Press

In the Press