Solved

Exception thrown when start listening to window event

Posted on 2009-07-15
1
1,477 Views
Last Modified: 2013-12-17
Hi Experts,

I am trying to get the event everytime user invokes a window application.  For example, my application should get the event when user runs notepad.exe

I am using WMI to capture the windows event asynchronously, however, I got exception thrown (Exception from HRESULT: 0x80042002) everytime I starts to listen to the window event.

I would like to seek for your advice and guidence on solving this issue.
Thank you!



I am using C# 2005 and .Net Framework 2.0.

The following are the exception detail:
System.Runtime.InteropServices.COMException was unhandled
  Message="Exception from HRESULT: 0x80042002"
  Source="mscorlib"
  ErrorCode=-2147213310
  StackTrace:
       at System.Runtime.InteropServices.Marshal.ThrowExceptionForHRInternal(Int32 errorCode, IntPtr errorInfo)
       at System.Management.ManagementEventWatcher.Start()
       at EventMonitoring.WindowEventWatcher.Start() in C:\Projects\AppMonitoring\WindowEventWatcher.cs:line 54
       at EventMonitoring.FrmAppSelect..ctor() in C:\Projects\AppMonitoring\FrmAppSelect.cs:line 29
       at EventMonitoring.Program.Main() in C:\Projects\AppMonitoring\Program.cs:line 17
       at System.AppDomain._nExecuteAssembly(Assembly assembly, String[] args)
       at System.AppDomain.ExecuteAssembly(String assemblyFile, Evidence assemblySecurity, String[] args)
       at Microsoft.VisualStudio.HostingProcess.HostProc.RunUsersAssembly()
       at System.Threading.ThreadHelper.ThreadStart_Context(Object state)
       at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
       at System.Threading.ThreadHelper.ThreadStart()

WqlEventQuery m_eventQuery = new WqlEventQuery("__InstanceCreationEvent", "TargetInstance isa \"Win32_Process\"");

private ManagementEventWatcher m_eventWatcher = new ManagementEventWatcher(m_eventQuery);

m_eventWatcher.EventArrived += new EventArrivedEventHandler(HandleEvent);
 

m_eventWatcher.Start();            // Exception thrown!!! (Exception from HRESULT: 0x80042002)

Open in new window

0
Comment
Question by:cskiong
1 Comment
 
LVL 85

Accepted Solution

by:
Mike Tomlinson earned 250 total points
ID: 24866704
Not sure...this works for me (I'm definitely no WMI expert!).  Note the extra parameter of a TimeSpan to the constructor of WqlEventQuery.
See: http://msdn.microsoft.com/en-us/library/6s90836x(VS.80).aspx
    public partial class Form1 : Form

    {
 

        private delegate void CreatedDelegate(EventArrivedEventArgs e);

        private ManagementEventWatcher watcherCreation;
 

        public Form1()

        {

            InitializeComponent();

        }
 

        private void Form1_Load(object sender, EventArgs e)

        {

            WqlEventQuery queryCreation = new WqlEventQuery("__InstanceCreationEvent",

                new TimeSpan(0, 0, 1), "TargetInstance isa \"Win32_Process\"");

            watcherCreation = new ManagementEventWatcher(queryCreation);

            watcherCreation.EventArrived += new EventArrivedEventHandler(watcherCreation_EventArrived);

            watcherCreation.Start();

        }
 

        void watcherCreation_EventArrived(object sender, EventArrivedEventArgs e)

        {

            if (this.InvokeRequired)

                this.Invoke(new CreatedDelegate(ProcessStarted), new Object[] { e });

            else

                ProcessStarted(e);

        }
 

        private void ProcessStarted(EventArrivedEventArgs e)

        {

            // do something in here...

            Console.WriteLine("Process Started @ " + DateTime.Now.ToString());

        }
 

        private void Form1_FormClosing(object sender, FormClosingEventArgs e)

        {

            watcherCreation.Stop();

        }
 

    }

Open in new window

0

Featured Post

Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

Join & Write a Comment

Whether you've completed a degree in computer sciences or you're a self-taught programmer, writing your first lines of code in the real world is always a challenge. Here are some of the most common pitfalls for new programmers.
Active Directory replication delay is the cause to many problems.  Here is a super easy script to force Active Directory replication to all sites with by using an elevated PowerShell command prompt, and a tool to verify your changes.
The viewer will learn how to dynamically set the form action using jQuery.
In this fifth video of the Xpdf series, we discuss and demonstrate the PDFdetach utility, which is able to list and, more importantly, extract attachments that are embedded in PDF files. It does this via a command line interface, making it suitable …

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now