How to Use system management c# to check application launch

MIPAKTEH_1 445 Reputation points
2024-11-23T14:26:11.5733333+00:00
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using System.Windows.Forms;
using System.Management;
using System.Management.Instrumentation;

namespace app_
{

    public partial class Form1 : Form
    {
        public Form1()
        {
            InitializeComponent();
        }

        private void Form1_Load(object sender, EventArgs e)
        {
            WMIEvent we = new WMIEvent();
            ManagementEventWatcher w = null;
            WqlEventQuery q;
            try
            {
                q = new WqlEventQuery();
                q.EventClassName = "Win32_ProcessStartTrace";
                w = new ManagementEventWatcher(q);
                w.EventArrived += new EventArrivedEventHandler(we.ProcessStartEventArrived);
                w.Start();
                Console.ReadLine(); // block main thread for test purposes
            }
            finally
            {
                w.Stop();
            }
        }

        public void ProcessStartEventArrived(object sender, EventArrivedEventArgs e)
        {
            foreach (PropertyData pd in e.NewEvent.Properties)
            {
                Console.WriteLine("\n============================= =========");
                Console.WriteLine("{0},{1},{2}", pd.Name, pd.Type, pd.Value);
            }
        }

    }
}

C#
C#
An object-oriented and type-safe programming language that has its roots in the C family of languages and includes support for component-oriented programming.
11,121 questions
0 comments No comments
{count} votes

Accepted answer
  1. Jiale Xue - MSFT 47,986 Reputation points Microsoft Vendor
    2024-11-25T05:22:58.6533333+00:00

    Hi @MIPAKTEH_1 , Welcome to Microsoft Q&A,

    ProcessStartEventArrived is the callback function when a WMI event arrives, but in your code, it does not seem to be correctly associated with the method in the Form1 class.

    using System;
    using System.Management;
    using System.Windows.Forms;
    
    namespace xxx
    {
        public partial class Form1 : Form
        {
            private ManagementEventWatcher processStartWatcher;
            public Form1()
            {
                InitializeComponent();
            }
            private void Form1_Load(object sender, EventArgs e)
            {
                StartProcessMonitor();
            }
    
            private void StartProcessMonitor()
            {
                try
                {
                    var query = new WqlEventQuery("SELECT * FROM Win32_ProcessStartTrace");
                    processStartWatcher = new ManagementEventWatcher(query);
                    processStartWatcher.EventArrived += ProcessStartEventArrived;
                    processStartWatcher.Start();
    
                    Console.WriteLine("Monitoring process start events...");
                }
                catch (Exception ex)
                {
                    Console.WriteLine($"Monitor start failed: {ex.Message}");
                }
            }
    
            private void ProcessStartEventArrived(object sender, EventArrivedEventArgs e)
            {
                string processName = e.NewEvent.Properties["ProcessName"]?.Value?.ToString() ?? "Unknown process";
                string processID = e.NewEvent.Properties["ProcessID"]?.Value?.ToString() ?? "Unknown PID";
    
                // Output to console
                Console.WriteLine($"A new process was detected: process name = {processName}, process ID = {processID}");
            }
    
            private void Form1_FormClosing(object sender, FormClosingEventArgs e)
            {
                StopProcessMonitor();
            }
    
            private void StopProcessMonitor()
            {
                if (processStartWatcher != null)
                {
                    processStartWatcher.Stop();
                    processStartWatcher.Dispose();
                    processStartWatcher = null;
                }
                Console.WriteLine("The monitor has stopped.");
            }
        }
    }
    
    

    Best Regards,

    Jiale


    If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". 

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    1 person found this answer helpful.
    0 comments No comments

0 additional answers

Sort by: Most helpful

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.