How record behavior of a process in windows?

Question

1.78/5 (3 votes)

See more:

I want to know a process what file create or delete or change in Windows? Is it possible in c#? Please suggest me how I should do it? Give me example or useful link. Thanks

What I have tried:

I see the ProcessExplorer but I don't know how it work.

Posted 17-May-16 7:13am

saeedmir

Updated 17-May-16 9:42am

Add a Solution

Comments

BillWoodruff 17-May-16 13:46pm

Do NOT post the same question in two forums.

2 solutions

Solution 2

Please see this class: https://msdn.microsoft.com/en-us/library/system.io.filesystemwatcher%28v=vs.110%29.aspx[^].

[EDIT]

The comment by RickZeeland below is important; please see:
FileSystemWatcher Follies | Windows SDK Support Team Blog[^].

Sorry that I did not mention the problem with this class.

—SA

Posted 17-May-16 9:42am

Sergey Alexandrovich Kryukov

Updated 18-May-16 4:44am

v2

Comments

RickZeeland 18-May-16 10:05am

But beware of it's limitations, read about it here: https://blogs.msdn.microsoft.com/winsdk/2015/05/19/filesystemwatcher-follies/

Sergey Alexandrovich Kryukov 18-May-16 10:37am

Thank you about this important comment. I knew about the problems with this class but failed to mention it.
Good link. I credited your comment in the edited version of my answer.
—SA

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

RickZeeland · Accepted Answer · 2016-05-17T07:41:00

Solution 1

Getting basic process information is possible from C#, see example here:
Process.GetCurrentProcess Method (System.Diagnostics)[^]

If you want more, you will need C / C++, see example here:
Process viewer[^]

Another option would be to use Sysmon by SysInternals, this is a free tool that logs to the Windows Eventlog. Your program could monitor the Eventlog which is possible from C#. Download Sysmon here: Sysmon[^]

Old Sysinternals source code (before it was acquired by Microsoft) can be found here: GitHub - xcud/sysinternals-source[^]

Posted 17-May-16 7:41am

RickZeeland

Updated 17-May-16 8:33am

v3

Comments

saeedmir 17-May-16 13:48pm

Thanks @RickZeelan. means its impossible in c#? Process viewer is good but I like write with c#? Is there any way?

RickZeeland 17-May-16 13:53pm

Can't say that it's impossible in C#, but I think this stuff is way too low level for C#.
I will have a look into the subject and let you know if I find anything interesting !

saeedmir 17-May-16 14:02pm

Thanks man. I think it sovle with find "process handle" but yet not found useful content...