CODEWITHSUNDEEP
c#wqlexecutable-path
Mike Pateras
Mike Pateras

Reputation: 15015

Can I get the ExecutablePath from a System.Management.EventArrivedEventArgs object?

I'm using a System.Management.ManagementEventWatcher to get the process ID and executable path for a started process:

private void startWatcher_EventArrived(Object sender, EventArrivedEventArgs e)
{
    String processID = e.NewEvent.Properties["ProcessID"].Value.ToString();

    var searcher = new ManagementObjectSearcher(new WqlObjectQuery(String.Format("Select ExecutablePath from Win32_Process where ProcessID = {0}", processID)));

    ManagementObject managementObject = null;
    foreach (ManagementObject obj in searcher.Get())
    {
        managementObject = obj;
        break;
    }

    Console.WriteLine(managementObject["ExecutablePath"]);
}

Using this WQL Query:

Select ExecutablePath from Win32_ProcessStartTrace

Is there a way that I can avoid doing the object search, but still get the ExecutionPath, using what is already available in the EventArrivedEventArgs object?

All I really need is the ProcessID and the ExecuatblePath for each new process that starts up. Is this the simplest way to get that?

Upvotes: 2

Views: 4368

Answers (2)

Hans Passant
Hans Passant

Reputation: 941555

No, what you got is as good as it gets. The available properties are listed here...

Upvotes: 2

Giorgi
Giorgi

Reputation: 30883

I believe this article can help you: Using WMI to monitor process creation, deletion and modification in .NET

Upvotes: 0

Related Questions