Posted on • Originally published ateuantorano.co.uk on
Monitoring Windows Services With C#
Ever wanted to monitor the state of Windows Services in a .NET project? This is a problem I recently had to solve and after some experimentation I settled on using WMI to monitor changes.
This approach allows monitoring the start mode, state, process ID, and much more for any Windows Services on either a local or remote server.
To get started, you’ll need to install theSystem.Management NuGet package:
dotnet add package System.Management --version 7.0.0Then it’s simply a case of using theManagementEventWatcher class to monitor for intrinsic events where the target instance is of the typeWin32_Service.
Note that there are a lot of otherevent types andclassesthat you can monitor with WMI – these are worth experimenting with too!
So how does this work? Let’s see an example:
usingSystem.Management;EventQueryquery=new("SELECT * FROM __InstanceOperationEvent WITHIN 1 WHERE TargetInstance isa \"Win32_Service\"");usingManagementEventWatchereventWatcher=new(query);eventWatcher.EventArrived+=EventArrived;try{eventWatcher.Start();Console.ReadLine();eventWatcher.Stop();}finally{eventWatcher.EventArrived-=EventArrived;}staticvoidEventArrived(object?sender,EventArrivedEventArgse){if(e.NewEvent.GetPropertyValue("TargetInstance")isManagementBaseObjectinstanceDescription){using(instanceDescription){foreach(PropertyDatapropertyininstanceDescription.Properties){Console.WriteLine("{0}:: {1}",property.Name,property.Value);}Console.WriteLine();}}}This is a console app which starts watching for events, and whenever any instance event occurs it prints each property for the service that changed to the standard output. If you run this and then start/stop some services, you should see some output like the following:
AcceptPause:: FalseAcceptStop:: FalseCaption:: Background Intelligent Transfer ServiceCheckPoint:: 0CreationClassName:: Win32_ServiceDelayedAutoStart:: TrueDescription:: Transfers files in the background using idle network bandwidth. If the service is disabled, then any applications that depend on BITS, such as Windows Update or MSN Explorer, will be unable to automatically download programs and other information.DesktopInteract:: FalseDisplayName:: Background Intelligent Transfer ServiceErrorControl:: NormalExitCode:: 0InstallDate::Name:: BITSPathName:: C:\WINDOWS\System32\svchost.exe -k netsvcs -pProcessId:: 0ServiceSpecificExitCode:: 0ServiceType:: Share ProcessStarted:: FalseStartMode:: AutoStartName:: LocalSystemState:: StoppedStatus:: OKSystemCreationClassName:: Win32_ComputerSystemSystemName:: COMPUTER-NAMETagId:: 0WaitHint:: 0Actions such as changing the service start mode or the display name will also cause events to be raised too.
You can find all of the available properties by looking at the documentation for theWin32_Service class.
Top comments(0)
For further actions, you may consider blocking this person and/orreporting abuse
