using System;
using System.Collections.Generic;
using System.Text;
using System.Linq;
using System.Diagnostics;
using System.Threading;
using System.Collections;
using System.IO;
using System.Management;
using System.ComponentModel;
namespace ProcessLogger
{
class LoggedProcess
{
[DefaultValue("")]
public string Name { get; set; }
[DefaultValue(0)]
public int PID { get; set; }
[DefaultValue("")]
public string Owner { get; set; }
public string GetConsoleString()
{
return string.Format("{0} \tProcess Started: {1} \t Owner: {2}", PID, Name, Owner);
}
public LoggedProcess(string name, int pid, string owner)
{
Name = name;
PID = pid;
Owner = owner;
}
}
class Program
{
static void Main(string[] args)
{
int iCycleInterval = 1000; // 1 second
List<LoggedProcess> processesBook = new List<LoggedProcess>();
bool bFirstCycle = true;
//create file
FileInfo info = new FileInfo("C:\\Test.txt");
FileStream stream = info.Open(FileMode.Create, FileAccess.Write);
stream.Close();
StreamWriter sw = info.CreateText();
Console.CancelKeyPress += (sender, e) =>
{
sw.Close();
sw.Dispose();
};
while (true)
{
IEnumerable<LoggedProcess> currentlyRunning =
from p in Process.GetProcesses().Distinct()
select new LoggedProcess(p.ProcessName, p.Id, GetProcessInfoByPID(p.Id));
// Record starting time for new processes
foreach (LoggedProcess process in currentlyRunning)
{
if (!processesBook.Contains(process)) // A new process started
{
// Log the Now as the start time for this process (Don't log if this is the the first cycle)
if (!bFirstCycle)
{
string toWrite = process.GetConsoleString();
//write to text.
Console.WriteLine(toWrite);
sw.WriteLine(toWrite);
}
// Book-keep the new process
processesBook.Add(process);
}
}
// We looped already once, so turn this flag off
bFirstCycle = false;
// Record ending time for finished processes
IEnumerable<LoggedProcess> nonLogged =
processesBook.Where(p => !currentlyRunning.Contains(p));
foreach (LoggedProcess logged in nonLogged)
{
// Log the Now as the end time for this process
string console = logged.GetConsoleString();
//write to text file
Console.WriteLine(DateTime.Now.ToString() + console);
sw.WriteLine(DateTime.Now.ToString() + console);
}
// Now Update the process book
processesBook = currentlyRunning.ToList();
// Sleep till the next loop
Thread.Sleep(iCycleInterval);
}
}
public static string GetProcessInfoByPID(int PID)
{
string User = String.Empty;
string Domain = String.Empty;
string OwnerSID = String.Empty;
string processname = String.Empty;
try
{
ObjectQuery sq = new ObjectQuery
("Select * from Win32_Process Where ProcessID = '" + PID + "'");
ManagementObjectSearcher searcher = new ManagementObjectSearcher(sq);
if (searcher.Get().Count == 0)
return OwnerSID;
foreach (ManagementObject oReturn in searcher.Get())
{
string[] o = new String[2];
//Invoke the method and populate the o var with the user name and domain
oReturn.InvokeMethod("GetOwner", (object[])o);
//int pid = (int)oReturn["ProcessID"];
processname = (string)oReturn["Name"];
//dr[2] = oReturn["Description"];
User = o[0];
if (User == null)
User = String.Empty;
Domain = o[1];
if (Domain == null)
Domain = String.Empty;
string[] sid = new String[1];
oReturn.InvokeMethod("GetOwner", (object[])sid);
OwnerSID = sid[0];
return OwnerSID;
}
}
catch
{
return OwnerSID;
}
return OwnerSID;
}
}
}
