Is there a way to detect if/when a Process starts another Process in C# .Net 2.0?

Question

I'm looking for a way to detect if a Process started by my application has in turn spawned additional Processes. The hope is that i can have a thread that starts and application, watches until it exits, and then triggers some other action when that application exits. The problem is that with some of the applications that i want to monitor, they are starting an additional process and then exiting. so my trigger fires before the application has exited.

for example, i start a program in a Process. that executable does some file patching, and then launches the main program - a separate exe - and then exits. this causes Process.HasExited to return true, which fires off my trigger prematurely. what i really care about is when the main program exits, in this case the program that the initial Process started, but i can't seem to find a way to do this programatically.

Answer 1

If those other processes are proprietary/not within your control, I really don't see how you can monitor them the check if they spawned new processes, more so if you want to check if the spawned processes spawn grandchildren processes and... (you know where I'm going).

Anyway that's my opinion, it might be do-able, I just don't think it can be achieve using .NET/C# alone.

Hopefully someone else can provide a real solution.

Answer 2

ok, i figured it out. there's no direct access to parent process information using the Process class in .Net 2.0, but using the System.Diagnostics.PerformanceCounter class you can get access to the parent process id from the "Creating Process Id" counter name. to solve my problem i did something similar to:

...
/// check to see if the monitored application (started in myProcess) is still running
public bool isRunning()
{
    bool running = !this.myProcess.HasExited;
    if(!running){
        foreach (Process p in Process.GetProcesses())
        {
            PerformanceCounter pc = new PerformanceCounter("Process", "Creating Process Id", p.ProcessName);
            if (this.myProcess.Id == (int)pc.RawValue)
            {
                running = true;
            }
        }
    }
    return running;
}
...

i left out error handling in this example, and as a more advanced solution, you could keep track of a tree of spawned processes by maintaining a list of all branch process ids, this example only watches one direct child process.

Answer 3

Hi !

I think, it's not really very simple, but doable.

In this case, I would opt for using WMI instead. You first start enumerating the existing processes [ether way, WMI or Net Process] and remembers these, you'll watch. Then you start two WMI eventqueries, one using *Win32_ProcessStartTrace* and onther one to query *Win32_ProcessStopTrace* [see WMI SDK]. Both return an instance of *Win32_Process*, which always contains the "ParentProcessID". If this is one of these, you saved before, you have the spawned process. The "Win32_Process" also contains a "Kill" method;No clue, what you finally want to do ;-)

Hope, this helps. Don't hesitate to ask for more details.

br--mabra