Detecting application startup and exit events

Hi,

I have written ( using VS2008 c++ ) a windows service which sends information about PC usage to a central database, as part of a PC availability setup. I have been asked to add the following functionality to it:

1) What applications are most used, when and how long for, and

2) What web sites are being accessed, again to find the most popular etc.

My main question is, what functionality is there to trap application start / close events from within my service ( just need the application name ), and secondly, would somebody be able to confirm that, as I am already using sockets to send information to a PHP script on a server, the best way to see what web pages are being accessed is to build in a packet sniffer, and extract the information from that.

Thanks in advance

Do the users of these PCs know your service is running and what it is doing?

Yes, it's mentioned in our University PC open access area guidelines, and the more technically minded students are always offering advice on how to improve the availability displays and make it more accurate...

Quote:

---

Originally Posted by Flidmouse

1) What applications are most used, when and how long for, and

---

This is very windows centric. You'll probably have better luck in the windows part of the C++ forums: http://forums.codeguru.com/forumdisplay.php?f=7 Here, we speak mostly raw C++.

You should also ask in a generic windows forum (eg, not necessarily C++ specific), just to see what windows itself can provide you with.

Quote:

---

Originally Posted by Flidmouse

What web sites are being accessed, again to find the most popular etc.

---

I do believe that's the kind of thing you build into your router. It should already be monitoring each connection to make sure the users don't end up in the wrong places. Having it also dump logs of who connects to what and when shouldn't be too hard (and probably exists off the shelf).

I highly doubt that you will be able to know what websites are being visited. Different browsers access it very very differently. IE will go through microsoft's API, Safari and Firefox will use curl (I think), and chrome has it's own custom way. They also don't share any proxy information, so you can't redirect info through a sniffer.

As for programs booting up and shutting down, can't you just create a daemon that checks the process list every couple of seconds? Then just do a

Code:

---

system("<windows equivalent of `ps`>");

---

Following is a bit old article, however may help you to get what you want.

Detecting Windows NT/2K process execution

Additionally, ninja9578 is correct. Don't forget that you'll have to keep the footprints of your application small, otherwise it might suck too much of the CPU. As each browser architecture is different, therefore you'll probably have to pick your best options (such as supporting only IE/FF) and target only them.

Well, actually, if they are school computers, you can configure the browsers to interact with your program. It won't prevent someone who knows what they are doing to bypass the spyware, but if you set up each browser to use proxy localhost:8080, you could listen on that port, and act as a proxy. That way you are in the path of each request and can see where traffic is being sent.