0

Is there some sort of service in the windows operating system that tracks all processes that have run on a computer throughout the day? Task manager tells you what is currently happening, but I want to find out what is happening throughout the entire day.

I know that it is possible to use WMI to monitor ongoing process creation and deletion, through system System.Management namespace. E.g.:

String query = @"SELECT * FROM __InstanceOperationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'";

ManagementEventWatcher watcher = new ManagementEventWatcher(query);

// Set up a listener for events
watcher.EventArrived += new EventArrivedEventHandler(this.HandleEvent);

// Start listening
watcher.Start();

But I am wondering if there is an API (even WMI) that already tracks process lifetimes for the current Windows session.

I apologize if my question is way too generic and vague.

Vadim Kotov
  • 8,084
  • 8
  • 48
  • 62
kvaganyan
  • 86
  • 6

2 Answers2

1

The Event Viewer seems close to what you want. Check here

David Jiboye
  • 511
  • 8
  • 19
0

Perhaps we should start with what you are trying to accomplish by tracking process history.

Generally such history is not stored unless the process logs to the event log or its own log.

Each process has its own logging preferences, so this is not effective - we must target what is needed.

If you want to profile active events over time, perhaps you need a service collecting such info over time - but knowing your ultimate goal will assist with providing the proper course of action.

The event viewer sol'n mentioned above is way too vague.

Justin C
  • 647
  • 7
  • 11