Best way to record process start time?

Question

I am writing a program that should record the start time of a process such as notepad. I thought it was good to create a timer that checks all processes every second. But I think this will slow down the user's computer. Is there a better way to do this?

Answer 1

Initially, determine the creation time for all running processes. then use WMI to log process events.

See the code below for a small example of using WMI for process creation events:

static void Main(string[] args) { using (ManagementEventWatcher eventWatcher = new ManagementEventWatcher(@"SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'")) { // Subscribe for process creation notification. eventWatcher.EventArrived += ProcessStarted_EventArrived; eventWatcher.Start(); Console.In.ReadLine(); eventWatcher.EventArrived -= ProcessStarted_EventArrived; eventWatcher.Stop(); } } static void ProcessStarted_EventArrived(object sender, EventArrivedEventArgs e) { ManagementBaseObject obj = e.NewEvent["TargetInstance"] as ManagementBaseObject; // The Win32_Process class also contains a CreationDate property. Console.Out.WriteLine("ProcessName: {0} " + obj.Properties["Name"].Value); } 

START EDIT:

Next, I examined process detection with WMI, and there is a (more) relevant solution (but needs administrative privileges) using the Win32_ProcessStartTrace class (see TECHNET for more information):

 using (ManagementEventWatcher eventWatcher = new ManagementEventWatcher(@"SELECT * FROM Win32_ProcessStartTrace")) { // Subscribe for process creation notification. eventWatcher.EventArrived += ProcessStarted_EventArrived; eventWatcher.Start(); Console.Out.WriteLine("started"); Console.In.ReadLine(); eventWatcher.EventArrived -= ProcessStarted_EventArrived; eventWatcher.Stop(); } static void ProcessStarted_EventArrived(object sender, EventArrivedEventArgs e) { Console.Out.WriteLine("ProcessName: {0} " + e.NewEvent.Properties["ProcessName"].Value); } 

In this solution, you do not need to set the polling interval.

End edit

START EDIT 2:

You can use the Win32_ProcessStopTrace class to track process stop events. To combine both processes and process stop events, use the Win32_ProcessTrace class. In the event handler, use ClassPath proberty to distinguish between start / stop events:

 using (ManagementEventWatcher eventWatcher = new ManagementEventWatcher(@"SELECT * FROM Win32_ProcessTrace")) { eventWatcher.EventArrived += Process_EventArrived; eventWatcher.Start(); Console.Out.WriteLine("started"); Console.In.ReadLine(); eventWatcher.EventArrived -= Process_EventArrived; eventWatcher.Stop(); } static void Process_EventArrived(object sender, EventArrivedEventArgs e) { Console.Out.WriteLine(e.NewEvent.ClassPath); // Use class path to distinguish // between start/stop process events. Console.Out.WriteLine("ProcessName: {0} " + e.NewEvent.Properties["ProcessName"].Value); } 

END EDIT 2

Answer 2

There is no need to control anything at all. All you have to do is list the processes and selections from instances of the StartTime process.