WMI Programming with Visual Basic.NET: More About Trapping System Events

You can download the zip of the entire Visual Studio.NET solution (developed for this article) here.

The first part of my series gives you the details for creating a Visual Studio.NET solution for WMI from scratch. It will not be repeated anymore in any of the future articles in this series.

Can we watch for events permanently?

In my previous article (part six), I introduced the concept of events
in WMI. I also discussed "Event Queries." Several new classes were also introduced. Finally we looked at a simple example of handling the events of WMI. Therefore, before reading this article, I strongly suggest that you read the previous article in this series. You will understand this article if and only if you have thoroughly grasped my previous article.

If you understood my previous article, you will know that the example
I discussed in that article works only for one single event. The
program automatically stops listening (or watching) for successive events (after the first notification of the event). Can we listen (or watch) continuously (permanently) for the events being generated by system? Will we be able to catch the events forever? Is the implementation much more difficult than for the single event handler?

Any one who understands the example in my previous article would certainly raise the above questions. And of course, it is also a FAQ. But the wonder is that, the implementation is very easy. The only issues are the need to have a permanent "subscriber" for the respective type of event, and the need to add an event handler on
our own.

This raises another question. When should it stop listening (or watching)? Of course, this is as important as the above questions.
If we don’t stop "watching" for the events (or, in other words, unsubscribe), some of the system resources may be blocked unnecessarily. So, our new application should "start" (subscribe) listening (or watching) and should also be able to "stop" (unsubscribe) listening.

To meet all the requirements mentioned above, I would develop another application which looks pretty similar to that of the previous article, but with some minor changes. So, let’s start with the application then.

I would like to develop a simple Windows application, which starts to listen (watch for events) forever (permanent subscriber). Once it receives a notification of a specified event instance, it just displays the status (or information) of that event and continues listening (watching) for the next event. This is what we call a permanent subscriber.

So, let us start by opening the Visual Studio.NET 2003 Enterprise Architect. Create a Windows application with two buttons and a
multi-lined textbox. Don’t forget to add the reference to “System.Management” (as explained in part one) and import it into your application. Your design should look something like the following figure (Fig 1):

Declare the following declaration at class level (above all methods or events but within the class definition):

DimwatcherAsManagementEventWatcher

Copy the following code into the button “start” click event:

Dim query As WqlEventQuery = New WqlEventQuery( _
   "__InstanceModificationEvent", _
    NewTimeSpan(0, 0, 1), _
    "TargetInstance isa ""Win32_Service""")
watcher =New ManagementEventWatcher(query)
AddHandler watcher.EventArrived, AddressOf HandleEvent

' Start listening
watcher.Start()

Add the following event handler:

Public Sub HandleEvent(ByVal sender As Object, _
    ByVal e As EventArrivedEventArgs)
  Dim ev As ManagementBaseObject = e.NewEvent
  TextBox1.Text &= ControlChars.NewLine & _
    "Service '" &CType(ev("TargetInstance"),
ManagementBaseObject)("DisplayName") & "' has changed,
State is '" &CType(ev("TargetInstance"),
ManagementBaseObject)("State") & "'"

EndSub

Copy the following code into the button “stop” click event:

watcher.Stop()

That’s it. We are finished. Try executing it. Press the start button after you execute your application. It starts listening to events. To notify the listener, open “services.msc” from Start->Run and change the status of any process (choose a generic process rather than harmful system process like RPC).  I generally use “Indexing Service” for my demonstration purpose and I suggest the same (unless installed on your computer). When you change the status, you should be able to see the textbox updated accordingly. Observe that it can listen to any number of events. Finally stop the subscription of events by clicking on button “stop”.

There exists nothing new in this application apart from handling the event through a dedicated handler (which is the concept of “adding event handlers” in OOP using .NET). Earlier we used to work with the method “WaitForNextEvent” method, which works only for a single (temporary) event and hangs our application till it receives the event.  Now we removed that concept totally. We are not “waiting” anymore.  We are handling if and only if it occurs. We don’t hang our application (like my earlier version) for the events to come in. Don’t you think this is better?

Is there any other good example to work with?

Why not? We can develop several other examples with the same concept. Until now, I have always been working with the “Win32_Service” class only. Not let us start with another class, “Win32_Process”.  Part three and part five of this series have already discussed this class (but not to the events level).  Now, I would like to modify the above created application, so that it subscribes to the class “Win32_Process”.

You need to modify the WQL query as follows:

Dim query As WqlEventQuery = New WqlEventQuery( _
  "__InstanceCreationEvent", _
  New TimeSpan(0, 0, 1), "TargetInstance isa ""Win32_Process""")

And the event handler as following:

Public Sub HandleEvent(ByVal sender As Object, ByVal _
e As EventArrivedEventArgs)
  Dim ev AsManagementBaseObject = e.NewEvent
  TextBox1.Text &= ControlChars.NewLine & _
    "Process '" &CType(ev("TargetInstance"), ManagementBaseObject)("Name") & "' started"

        TextBox1.Refresh()

EndSub

That’s it. We are finished. Try executing it. Press the start button after you execute your application. It starts listening to events. To notify the listener, open any application such as “notepad”, “calculator”, “PaintBrush” etc. When you open any application, the WMI treats it as a new process and notifies our application of the event. You should be able to observe that the textbox gets updated accordingly (with “process started” messages).  Finally stop the subscription of events by clicking on button “stop”. Is it not interesting?

Did you observe the above code carefully?  I replaced “__InstanceModificationEvent” with “__InstanceCreationEvent”. This is very important as we are “creating” (opening) a new process, but not modifying an existing process.

What about __InstanceDeletionEvent?

I didn’t discuss this issue at all. I have discussed  “__InstanceModificationEvent” or “__InstanceCreationEvent”, but never touched “__InstanceDeletionEvent”.  Now let us modify the program discussed in the previous section in such a way that it handles “__InstanceDeletinEvent” related events.

Modify your WQL query as follows:

Dim query As WqlEventQuery =NewWqlEventQuery( _
  "__InstanceDeletionEvent", _
  New TimeSpan(0, 0, 1), "TargetInstance isa ""Win32_Process""")

That’s it. I just replaced “__InstanceCreationEvent” with “__InstanceDeletionEvent”. You need not change anything else. Try executing it. Press the start button after you execute your application.  It starts listening to events. To notify the listener, open any application such as “notepad”, “calculator”, “PaintBrush” etc. When you close any of those applications, the WMI treats it as a process being deleted from memory and notifies our application of the event. You should be able to observe that the textbox gets updated accordingly (with “process stopped” messages). Finally stop the subscription of events by clicking on button “stop”.

{mospagebreak title=Can we handle more than one type of event simultaneously?}

Why not? You can handle as many types of events as possible. The sky is the limit. Now let us modify the previous application completely so that it listens to both “__InstanceCreationEvent” and “__InstanceDeletionEvent” together. Does that sound interesting?

Before we begin, you need to remove the code (only what we added, excluding the IDE generated code) in our previous application. After removing the code, you can start as follows:

Declare the following declaration at class level (above all methods or events but within the class definition):

  Dim watcherCreation As ManagementEventWatcher
Dim watcherDeletion As ManagementEventWatcher

Copy the following code into the button “start” click event:

'Watcher for Creation
Dim queryCreation As WqlEventQuery = _
   New WqlEventQuery( "__InstanceCreationEvent", _
   NewTimeSpan(0, 0, 1), "TargetInstance isa ""Win32_Process""")
watcherCreation = New _
   ManagementEventWatcher(queryCreation)
AddHandler watcherCreation.EventArrived,
AddressOf HandleCreationEvent

'Watcher for Deletion
Dim queryDeletion As WqlEventQuery = New _
   WqlEventQuery( "__InstanceDeletionEvent", _
   NewTimeSpan(0, 0, 1), "TargetInstance isa ""Win32_Process""")
watcherDeletion = New _
   ManagementEventWatcher(queryDeletion)
AddHandler watcherDeletion.EventArrived,
AddressOf HandleDeletionEvent

' Start listening
watcherCreation.Start()
watcherDeletion.Start()

Add the following two event handlers:

Public Sub HandleCreationEvent(ByVal sender As Object,
   ByVal e As EventArrivedEventArgs)
  Dim ev As ManagementBaseObject = e.NewEvent
  TextBox1.Text &= ControlChars.NewLine & _
   "Process '" &CType(ev("TargetInstance"), ManagementBaseObject)("Name") & "' started.."
  TextBox1.Refresh()
EndSub

Public Sub HandleDeletionEvent(ByVal sender As Object,
   ByVal e As EventArrivedEventArgs)
  Dim ev As ManagementBaseObject = e.NewEvent
  TextBox1.Text &= ControlChars.NewLine & _
   "Process '" &CType(ev("TargetInstance"), ManagementBaseObject)("Name") & "' stopped.."
  TextBox1.Refresh()

EndSub

Copy the following code into the button “stop” click event:

watcherCreation.Stop()
watcherDeletion.Stop()

I don’t think I need to explain much about the above modifications. I just doubled each of the statements explained in the previous section to listen for two types of events.