WMI Programming with Visual Basic.NET: More About Trapping System Events - What about __InstanceDeletionEvent?

(Page 4 of 4 )

I didn’t discuss this issue at all. I have discussed  “__InstanceModificationEvent” or “__InstanceCreationEvent”, but never touched “__InstanceDeletionEvent”.  Now let us modify the program discussed in the previous section in such a way that it handles “__InstanceDeletinEvent” related events.

Modify your WQL query as follows:

Dim query As WqlEventQuery =NewWqlEventQuery( _
  "__InstanceDeletionEvent", _
  New TimeSpan(0, 0, 1), "TargetInstance isa ""Win32_Process""")

That’s it. I just replaced “__InstanceCreationEvent” with “__InstanceDeletionEvent”. You need not change anything else. Try executing it. Press the start button after you execute your application.  It starts listening to events. To notify the listener, open any application such as “notepad”, “calculator”, “PaintBrush” etc. When you close any of those applications, the WMI treats it as a process being deleted from memory and notifies our application of the event. You should be able to observe that the textbox gets updated accordingly (with “process stopped” messages). Finally stop the subscription of events by clicking on button “stop”.

{mospagebreak title=Can we handle more than one type of event simultaneously?}

Why not? You can handle as many types of events as possible. The sky is the limit. Now let us modify the previous application completely so that it listens to both “__InstanceCreationEvent” and “__InstanceDeletionEvent” together. Does that sound interesting?

Before we begin, you need to remove the code (only what we added, excluding the IDE generated code) in our previous application. After removing the code, you can start as follows:

Declare the following declaration at class level (above all methods or events but within the class definition):

  Dim watcherCreation As ManagementEventWatcher
Dim watcherDeletion As ManagementEventWatcher

Copy the following code into the button “start” click event:

'Watcher for Creation
Dim queryCreation As WqlEventQuery = _
   New WqlEventQuery( "__InstanceCreationEvent", _
   NewTimeSpan(0, 0, 1), "TargetInstance isa ""Win32_Process""")
watcherCreation = New _
   ManagementEventWatcher(queryCreation)
AddHandler watcherCreation.EventArrived,
AddressOf HandleCreationEvent

'Watcher for Deletion
Dim queryDeletion As WqlEventQuery = New _
   WqlEventQuery( "__InstanceDeletionEvent", _
   NewTimeSpan(0, 0, 1), "TargetInstance isa ""Win32_Process""")
watcherDeletion = New _
   ManagementEventWatcher(queryDeletion)
AddHandler watcherDeletion.EventArrived,
AddressOf HandleDeletionEvent

' Start listening
watcherCreation.Start()
watcherDeletion.Start()

Add the following two event handlers:

Public Sub HandleCreationEvent(ByVal sender As Object,
   ByVal e As EventArrivedEventArgs)
  Dim ev As ManagementBaseObject = e.NewEvent
  TextBox1.Text &= ControlChars.NewLine & _
   "Process '" &CType(ev("TargetInstance"), ManagementBaseObject)("Name") & "' started.."
  TextBox1.Refresh()
EndSub

Public Sub HandleDeletionEvent(ByVal sender As Object,
   ByVal e As EventArrivedEventArgs)
  Dim ev As ManagementBaseObject = e.NewEvent
  TextBox1.Text &= ControlChars.NewLine & _
   "Process '" &CType(ev("TargetInstance"), ManagementBaseObject)("Name") & "' stopped.."
  TextBox1.Refresh()

EndSub

Copy the following code into the button “stop” click event:

watcherCreation.Stop()
watcherDeletion.Stop()

I don’t think I need to explain much about the above modifications. I just doubled each of the statements explained in the previous section to listen for two types of events.

DISCLAIMER: The content provided in this article is not warranted or guaranteed by Developer Shed, Inc. The content provided is intended for entertainment and/or educational purposes in order to introduce to the reader key ideas, concepts, and/or product reviews. As such it is incumbent upon the reader to employ real-world tactics for security and implementation of best practices. We are not liable for any negative consequences that may result from implementing any information covered in our articles or tutorials. If this is a hardware review, it is not recommended to open and/or modify your hardware.

Comments On: WMI Programming with Visual Basic.NET: More About Trapping System Events

>>> Be the FIRST to comment on this article!