using System.Diagnostics; using Trigger.Events; namespace Trigger.Tasks { /// /// Logs all events from /// // TODO: There is bug in here: Eine nicht behandelte Ausnahme des Typs "System.Runtime.InteropServices.InvalidComObjectException" ist in System.Management.dll aufgetreten. Ein COM-Objekt, das vom zugrunde liegenden RCW getrennt wurde, kann nicht verwendet werden. class LogProcessesEvents : TaskPlugin { #region Properties internal Main Main; internal Log Log; #endregion #region Methods public override bool Init(Main Main) { return Init(Main, new System.Diagnostics.Stopwatch()); } public override bool Init(Main Main, System.Diagnostics.Stopwatch swInit) { if (!Main.EventMgr.PluginExists()) { this.Log.LogLine("Task \"LogProcessStartedEvents\" is missing EventPlugin \"ProcessStarted\"!", Log.Type.Error); return false; } this.Main = Main; this.Log = Main.Log; swInit.Stop(); Events.Processes procEvents = Main.EventMgr.GetPlugin(); swInit.Start(); procEvents.ProcessCreated += new Events.EventPlugin.EventValue(procEvents_ProcessCreated); procEvents.ProcessExited += new EventPlugin.EventValue(procEvents_ProcessExited); return true; } public override void Dispose() { Events.Processes procEvents = Main.EventMgr.GetPlugin(); procEvents.ProcessCreated -= new Events.EventPlugin.EventValue(procEvents_ProcessCreated); procEvents.ProcessExited -= new EventPlugin.EventValue(procEvents_ProcessExited); } #endregion #region Event handlers private void procEvents_ProcessCreated(object sender, EventArgsValue e) { try { this.Log.LogLineDate("A new process was created: " + e.Value.ProcessName + " (" + e.Value.Id + ")", Trigger.Log.Type.ProcessesEvent); } catch { this.Log.LogLineDate("A new process was created", Trigger.Log.Type.ProcessesEvent); }; } private void procEvents_ProcessExited(object sender, EventArgsValue e) { string exitCode = ""; try { exitCode = " Code " + e.Value.ExitCode.ToString(); } catch { } this.Log.LogLineDate("A process has exited: " + e.Value.ProcessName + " (" + e.Value.Id + ")" + exitCode, Trigger.Log.Type.ProcessesEvent); } #endregion } }