Detecting the launch of a application

Question

How do I detect with C# on Windows the moment when an external application is being launched?

I tried the FilesystemWatcher which doesn't work because the file is not really changing. Also having a timer constantly check all the open processes might be a bit over kill. Is there any other way to do this? If not in C# is it possible to do so in C++ (if so please give me an example).

The reason I want to do this is for logging purposes.

Answer 1

You can use System.Management and WMI (Windows Management Instrumentation)

class WMIEvent {
    public static void Main() {
        WMIEvent we = new WMIEvent();
        ManagementEventWatcher w= null;
        WqlEventQuery q;
        try {
      q = new WqlEventQuery();
      q.EventClassName = "Win32_ProcessStartTrace";
      w = new ManagementEventWatcher(q);
      w.EventArrived += new EventArrivedEventHandler(we.ProcessStartEventArrived);
      w.Start();
      Console.ReadLine(); // block main thread for test purposes
        }
     finally {
   w.Stop();
     }
 }

    public void ProcessStartEventArrived(object sender, EventArrivedEventArgs e) {    
     foreach(PropertyData pd in e.NewEvent.Properties) {
      Console.WriteLine("\n============================= =========");
      Console.WriteLine("{0},{1},{2}",pd.Name, pd.Type, pd.Value);
     }
  }