How to Retrieve the Last Run Time of a Terminated Process in .NET?

Retrieving the Last Execution Time of a Terminated Process using .NET

The standard .NET Process.GetProcessesByName method only retrieves currently running processes. To obtain information about terminated processes, Windows Management Instrumentation (WMI) provides a solution using the Win32_ProcessTrace classes.

Illustrative Example:

This example demonstrates how to create a console application that monitors process starts and stops using WMI. Remember to add a reference to System.Management in your project.

using System;
using System.Management;

public class ProcessMonitor
{
    public static void Main(string[] args)
    {
        // Establish event watchers for process start and stop events.
        using (ManagementEventWatcher startWatch = new ManagementEventWatcher(new WqlEventQuery("SELECT * FROM Win32_ProcessStartTrace")))
        {
            startWatch.EventArrived += StartWatch_EventArrived;
            startWatch.Start();

            using (ManagementEventWatcher stopWatch = new ManagementEventWatcher(new WqlEventQuery("SELECT * FROM Win32_ProcessStopTrace")))
            {
                stopWatch.EventArrived += StopWatch_EventArrived;
                stopWatch.Start();

                // Await user input to end monitoring.
                Console.WriteLine("Press any key to exit...");
                Console.ReadKey();
            }
        }
    }

    private static void StopWatch_EventArrived(object sender, EventArrivedEventArgs e)
    {
        Console.WriteLine($"Process stopped: {e.NewEvent.Properties["ProcessName"].Value}");
    }

    private static void StartWatch_EventArrived(object sender, EventArrivedEventArgs e)
    {
        Console.WriteLine($"Process started: {e.NewEvent.Properties["ProcessName"].Value}");
    }
}

Implementation Steps:

1. Permissions: Ensure your application has sufficient permissions (elevated privileges).
2. Execution: Run the application.
3. Observation: Monitor the console output to see process start and stop events.

Important Note: WMI's performance for this task might not be optimal. For high-performance scenarios, alternative methods should be explored.

The above is the detailed content of How to Retrieve the Last Run Time of a Terminated Process in .NET?. For more information, please follow other related articles on the PHP Chinese website!