CODEWITHSUNDEEP
vb.net
Seth
Seth

Reputation: 199

Monitor Executable Use

My goal is to set up a service to watch a network folder containing about 200 .exe files. What I'd like is to have the service update a log each time one of the .exes is launched. Basically I'd like to log usage of each application by recording every time one one of them is used.

I've tried using the FileSystemWatcher class to accomplish this, code below, figuring that the LastAccess filter would do the trick, but it seems it won't. When I run this code no event is raised when the applications are opened.

Is there some way of using the FileSysteWatcher class to do this kind of monitoring? Is there any way to do what I'm attempting?

Private Sub StartWatch()

    Dim exeWatcher As New FileSystemWatcher

    exeWatcher.Path = "<path>"
    exeWatcher.Filter = "*.exe"
    exeWatcher.IncludeSubdirectories = True
    exeWatcher.NotifyFilter = (NotifyFilters.LastAccess Or NotifyFilters.LastWrite Or NotifyFilters.FileName Or NotifyFilters.DirectoryName Or NotifyFilters.Attributes)

    AddHandler exeWatcher.Changed, AddressOf ExeChanged

    exeWatcher.EnableRaisingEvents = True

End Sub

Private Sub ExeChanged(source As Object, e As FileSystemEventArgs)
    Console.WriteLine("File: " & e.FullPath & " " & DateTime.Now.ToString())
End Sub

Upvotes: 3

Views: 155

Answers (2)

Brandon Langley
Brandon Langley

Reputation: 551

Take a look at this Stack Overflow answer, which involves monitoring WMI Win32_Process instance creation events (basically, when WMI registers that a new process has been created). This is probably the most effective way outside of a C++ kernel hook to find out when a process has started.

At that point, you just need to use a regular expression to test the file path against to see if it's originating from that folder, and respond appropriately if it is.

Upvotes: 2

vcsjones
vcsjones

Reputation: 141678

The file system watcher cannot be used to accomplish this because it doesn't know why the file is being accessed. It could be accessed to show the properties of the executable or someone copied it to their local hard drive.

If your goal is to see what machines are running your executable, you can use Windows Management Instrumentation (WMI) to remotely query a machine for Win32_Process and determine if your process is running there.

Upvotes: 1

Related Questions