c# application to monitor process start / stop - memory issues

Hi folks,

We created an app for monitoring process start / stop based on a text file list we created. The idea is that we are monitoring the use of applications on workstations so we can report back to mgmt with regard licensing as in if nobody is using MS access do we need to buy licenses for it.

The app works fine but what we noticed is that when it runs it will start and consume about 8mb of memory but then it will cycle up to about 26mb and then drop back to 8mb - it will continue to do this over and over every 30 secs or so - after a while the 8mb will rise to about 12 / 13mb and the upper peak will rise to about 32mb or so which also makes me suspect it is leaking memory.

I am wondering if the method we are using is the right method we have found a few ways to do this - we did try systemhooks but not get them to work correctly.

Any ideas?

     public static String currentDir = Path.GetDirectoryName(Assembly.GetExecutingAssembly().CodeBase);
        
        public static String AppFilePath = currentDir.Replace("file:\\", "") + "\\Apps.txt";
        public static String LogFilePath = currentDir.Replace("file:\\", "") + "\\sm.log";

        public static ArrayList arrApps = new ArrayList();

        protected override void OnStart(string[] args)
        {
            // start monitoring
            var worker = new Thread(StartMonitoring);
            worker.Name = "StartMonitoring";
            worker.IsBackground = false;
            worker.Start();
        }

          protected override void OnStop()
        {
            if (!EventLog.SourceExists("Trilogy"))
            {
                EventLog.CreateEventSource("Trilogy", "Trilogy");
            }
            EventLog.WriteEntry("Trilogy", "EdgeMeter Stopped", EventLogEntryType.Warning, 1001);
            foreach (Thread t in System.Diagnostics.Process.GetCurrentProcess().Threads)
            {
                if (t.Name == "StartMonitoring")
                {
                    t.Abort();
                }
            }

        }

        static void StartMonitoring()
        {
            using (StreamReader sr = new StreamReader(AppFilePath))
            {
                String line;
                while ((line = sr.ReadLine()) != null)
                {
                   arrApps.Add(line);
                }
            }

            WMI.Win32.ProcessWatcher procWatcher = new WMI.Win32.ProcessWatcher();
            procWatcher.ProcessCreated += new WMI.Win32.ProcessEventHandler(procWatcher_ProcessCreated);
            procWatcher.ProcessDeleted += new WMI.Win32.ProcessEventHandler(procWatcher_ProcessDeleted);

            procWatcher.Start();
            while (true)
            {
               
                procWatcher.WaitForNextEvent();
            }
        }

        static void procWatcher_ProcessCreated(WMI.Win32.Process process)
        {
            if (arrApps.Contains(process.Name))
            {
                using (StreamWriter sw = new StreamWriter(LogFilePath, true))
                {
                    sw.WriteLine(DateTime.Today.ToShortDateString() + " " + DateTime.Now.ToShortTimeString() + "," + process.Name + "," + process.ProcessId.ToString() + ",1");
                }
            }
        }

        static void procWatcher_ProcessDeleted(WMI.Win32.Process proc)
        {
            if (arrApps.Contains(proc.Name))
            {
                using (StreamWriter sw = new StreamWriter(LogFilePath, true))
                {
                    sw.WriteLine(DateTime.Today.ToShortDateString() + " " + DateTime.Now.ToShortTimeString() + "," + proc.Name + "," + proc.ProcessId.ToString() + ",0");
                }
            }
        }

Open in new window

LVL 5
mickinoz2005Asked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

mickinoz2005Author Commented:
sorry just to clarify questions.

1. Is this the best method for doing what we want
2. Why does it cycle through memory
3. Is a memory leak likely here?

thanks

I was trying to think if I actually asked a question or not...
0
Meir RivkinFull stack Software EngineerCommented:
on which OS do u run the code?
WMI is known to have a high cpu usage especially on vista and server2008 (http://support.microsoft.com/kb/2505348)

can u check which process goes crazy? is it WmiPrvSE.exe?
0
shanejhCommented:
I'm not sure if there is a better way to do this. But I can comment on the memory use.

It sounds like normal garbage collection to me, the wonders of auto cleanup. If it is in fact a memory leak you will see the lower limit grow and grow and grow never falling back, always growing.
0
CompTIA Network+

Prepare for the CompTIA Network+ exam by learning how to troubleshoot, configure, and manage both wired and wireless networks.

mickinoz2005Author Commented:
no wmiprvse is active but not going mad.

it is our actual service that is fluctuating and it is not CPU it is memory.

I think shanejh might be right it might just be garbage collection - the only thing I will say is that earlier the lower limit was increasing however I am monitoring it now and it seems to be fairly static with a range from 9mb - 26mb and then back again.
0
shanejhCommented:
Had a better look at your code. I don't see anything obvious there that would cause memory issues. It seems simple enough yet is quite a nice solution really. Something like this that sends information back to a service on a server would be really handy!

Anyway, I definitely think you just have a normal memory profile here, but if you want to make sure you could run it against a process you know will stop and start often for a prolonged period (24 hours maybe)

By the sound of it you have probably already gone down a similar track though. Good luck with your little project.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
mickinoz2005Author Commented:
thanks we are running tests on it at the moment on 3 machines so we will see how it performs...
0
mickinoz2005Author Commented:
Thanks for you feedback - I think it is just acting normal although looks a bit odd...

appreciate the comments also.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
.NET Programming

From novice to tech pro — start learning today.