Process Start Event Using WMI - Not All Process Starts Being Detected

c# events process wmi wql
Xenon picture Xenon · Apr 13, 2012 · Viewed 8.8k times · Source

I am using the following C# code in a Windows Service (which runs as NT_AUTHORITY\SYSTEM) to create an event handler for receiving process creation events (using WMI and WQL):

string queryString = "SELECT * FROM Win32_ProcessStartTrace";
ManagementEventWatcher watcher = new ManagementEventWatcher(new WqlEventQuery(queryString));
watcher.EventArrived += new EventArrivedEventHandler(ProcessStartEvent);
watcher.Start();

In ProcessStartEvent:

int processId = int.Parse(e.NewEvent.Properties["ProcessId"].Value.ToString());
Process proc = Process.GetProcessById(processId);

Out("Received process: " + proc.ProcessName);

The problem I'm having is that (for some strange reason) not every process start is captured and reported by the program. If I start about 6 processes simultaneously, one may not show up in the output.

I've tried to do some research on capturing process creation events using WMI, but there is limited information available. I've seen that it is also possible to capture process starts using something similar to:

SELECT TargetInstance
FROM __InstanceCreationEvent
WITHIN  2
WHERE TargetInstance ISA 'Win32_Process'

(As seen in this Stack Overflow answer)

Are there any major differences between using __InstanceCreationEvent and Win32_ProcessStartTrace? Could this be the cause of my problems?

Is there an explanation as to why I'm not receiving events for all process starts? Is there something more obvious that I'm doing wrong here?

Answer

RRUZ picture RRUZ · Apr 13, 2012

Both methods are valid but works in differents ways.

When you uses the __InstanceCreationEvent WMI class you are using a intrinsic event which means which you are monitoring changes in the standard WMI data model (this works like a trigger in a table).

When you uses the Win32_ProcessStartTrace you are using a Extrinsic event that means you are using a specialized event class made for a specific task in this case monitor the process creation.

Now back to your issue, the best way to avoid the "lost" of some events is creating a permanent event consumer.

Related questions

How to remove all event handlers from an event

To create a new event handler on a control you can do this c.Click += new EventHandler(mainFormButton_Click); or this c.Click += mainFormButton_Click; and to remove an event handler you can do this c.Click -= mainFormButton_Click; …

Read More
Understanding events and event handlers in C#

I understand the purpose of events, especially within the context of creating user interfaces. I think this is the prototype for creating an event: public void EventName(object sender, EventArgs e); What do event handlers do, why are they needed, …

Read More
What is the use of "object sender" and "EventArgs e" parameters?

In case of Page_Load, Init and other page events, what is the use of these (object sender, EventArgs e) parameters? Examples would be more helpful.

Read More