c# application to monitor process start / stop - memory issues

Hi folks,

We created an app for monitoring process start / stop based on a text file list we created. The idea is that we are monitoring the use of applications on workstations so we can report back to mgmt with regard licensing as in if nobody is using MS access do we need to buy licenses for it.

The app works fine but what we noticed is that when it runs it will start and consume about 8mb of memory but then it will cycle up to about 26mb and then drop back to 8mb - it will continue to do this over and over every 30 secs or so - after a while the 8mb will rise to about 12 / 13mb and the upper peak will rise to about 32mb or so which also makes me suspect it is leaking memory.

I am wondering if the method we are using is the right method we have found a few ways to do this - we did try systemhooks but not get them to work correctly.

Any ideas?

     public static String currentDir = Path.GetDirectoryName(Assembly.GetExecutingAssembly().CodeBase);
        
        public static String AppFilePath = currentDir.Replace("file:\\", "") + "\\Apps.txt";
        public static String LogFilePath = currentDir.Replace("file:\\", "") + "\\sm.log";

        public static ArrayList arrApps = new ArrayList();

        protected override void OnStart(string[] args)
        {
            // start monitoring
            var worker = new Thread(StartMonitoring);
            worker.Name = "StartMonitoring";
            worker.IsBackground = false;
            worker.Start();
        }

          protected override void OnStop()
        {
            if (!EventLog.SourceExists("Trilogy"))
            {
                EventLog.CreateEventSource("Trilogy", "Trilogy");
            }
            EventLog.WriteEntry("Trilogy", "EdgeMeter Stopped", EventLogEntryType.Warning, 1001);
            foreach (Thread t in System.Diagnostics.Process.GetCurrentProcess().Threads)
            {
                if (t.Name == "StartMonitoring")
                {
                    t.Abort();
                }
            }

        }

        static void StartMonitoring()
        {
            using (StreamReader sr = new StreamReader(AppFilePath))
            {
                String line;
                while ((line = sr.ReadLine()) != null)
                {
                   arrApps.Add(line);
                }
            }

            WMI.Win32.ProcessWatcher procWatcher = new WMI.Win32.ProcessWatcher();
            procWatcher.ProcessCreated += new WMI.Win32.ProcessEventHandler(procWatcher_ProcessCreated);
            procWatcher.ProcessDeleted += new WMI.Win32.ProcessEventHandler(procWatcher_ProcessDeleted);

            procWatcher.Start();
            while (true)
            {
               
                procWatcher.WaitForNextEvent();
            }
        }

        static void procWatcher_ProcessCreated(WMI.Win32.Process process)
        {
            if (arrApps.Contains(process.Name))
            {
                using (StreamWriter sw = new StreamWriter(LogFilePath, true))
                {
                    sw.WriteLine(DateTime.Today.ToShortDateString() + " " + DateTime.Now.ToShortTimeString() + "," + process.Name + "," + process.ProcessId.ToString() + ",1");
                }
            }
        }

        static void procWatcher_ProcessDeleted(WMI.Win32.Process proc)
        {
            if (arrApps.Contains(proc.Name))
            {
                using (StreamWriter sw = new StreamWriter(LogFilePath, true))
                {
                    sw.WriteLine(DateTime.Today.ToShortDateString() + " " + DateTime.Now.ToShortTimeString() + "," + proc.Name + "," + proc.ProcessId.ToString() + ",0");
                }
            }
        }

Open in new window

LVL 5
mickinoz2005Asked:
Who is Participating?
 
shanejhCommented:
Had a better look at your code. I don't see anything obvious there that would cause memory issues. It seems simple enough yet is quite a nice solution really. Something like this that sends information back to a service on a server would be really handy!

Anyway, I definitely think you just have a normal memory profile here, but if you want to make sure you could run it against a process you know will stop and start often for a prolonged period (24 hours maybe)

By the sound of it you have probably already gone down a similar track though. Good luck with your little project.
0
 
mickinoz2005Author Commented:
sorry just to clarify questions.

1. Is this the best method for doing what we want
2. Why does it cycle through memory
3. Is a memory leak likely here?

thanks

I was trying to think if I actually asked a question or not...
0
 
Meir RivkinFull stack Software EngineerCommented:
on which OS do u run the code?
WMI is known to have a high cpu usage especially on vista and server2008 (http://support.microsoft.com/kb/2505348)

can u check which process goes crazy? is it WmiPrvSE.exe?
0
Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

 
shanejhCommented:
I'm not sure if there is a better way to do this. But I can comment on the memory use.

It sounds like normal garbage collection to me, the wonders of auto cleanup. If it is in fact a memory leak you will see the lower limit grow and grow and grow never falling back, always growing.
0
 
mickinoz2005Author Commented:
no wmiprvse is active but not going mad.

it is our actual service that is fluctuating and it is not CPU it is memory.

I think shanejh might be right it might just be garbage collection - the only thing I will say is that earlier the lower limit was increasing however I am monitoring it now and it seems to be fairly static with a range from 9mb - 26mb and then back again.
0
 
mickinoz2005Author Commented:
thanks we are running tests on it at the moment on 3 machines so we will see how it performs...
0
 
mickinoz2005Author Commented:
Thanks for you feedback - I think it is just acting normal although looks a bit odd...

appreciate the comments also.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.