Command line version of Procmon
See the question and my original answer on StackOverflowYou can build your own using the Microsoft.Diagnostics.Tracing.TraceEvent nuget package. It's a wrapper over ETW (Event Tracing for Windows) events, and its developed my Microsoft.
Here is some sample C# Console Application code that displays all process Start and Stop events:
using System;
using Microsoft.Diagnostics.Tracing.Parsers;
using Microsoft.Diagnostics.Tracing.Session;
namespace ProcMon
{
class Program
{
static void Main(string[] args)
{
if (TraceEventSession.IsElevated() != true)
{
Console.WriteLine("To turn on ETW events you need to be Administrator, please run from an Admin process.");
return;
}
using (var session = new TraceEventSession("whatever"))
{
// handle console CTRL+C gracefully
Console.CancelKeyPress += (sender, e) => session.Stop();
// we filter on events we need
session.EnableKernelProvider(KernelTraceEventParser.Keywords.Process);
session.Source.Kernel.ProcessStart += data =>
{
Console.WriteLine("START Id:" + data.ProcessID + " Name:" + data.ProcessName);
};
session.Source.Kernel.ProcessStop += data =>
{
// stop has no name
Console.WriteLine("STOP Id:" + data.ProcessID);
};
// runs forever, press CTRL+C to stop
session.Source.Process();
}
}
}
}