 |
|
 |
First off, thank you for putting this class together – it exposes exactly what I need in a nice, clean manner.
The reason for this post is that I’m having issues consuming the events that RegistryMonitor generates (if it is indeed generating them) from a Windows service.
To make sure I had everything working I first created a stand-alone WinForms executable. The program was pretty basic and consisted of a single form with a private RegistryMonitor variable. In the form’s constructor there was code to instantiate a new object assigned to that variable, and then lines to delegate the RegChanged and Error events to subroutines in the form’s code. I called Start on the class as the last line of the constructor, and everything worked as expected.
I then tried to port that code over to a service without much luck. I copied the RegChanged and Error routines verbatim, copied the private variable declaration over, and moved the code from the stand-alone executable’s constructor to the service’s OnStart event. The service starts fine, I can attach to it from Visual Studio, and I know it’s running because it will break on the OnStop event when I stop the service, but I never get any events.
The RegistryMonitor class remains unchanged from the one provided on this site, and my class looks as follows:
<code> using System; using System.IO; using System.ServiceProcess; using Microsoft.Win32;
namespace Lullaby {
public partial class Lullaby : ServiceBase {
private RegistryMonitor p_oMonitor;
public Lullaby() { InitializeComponent(); }
protected override void OnStart(string[] args) { p_oMonitor = new RegistryMonitor(RegistryHive.CurrentUser, "Control Panel\\PowerCfg"); p_oMonitor.RegChanged += new EventHandler(OnRegChanged); p_oMonitor.Error += new ErrorEventHandler(OnError); p_oMonitor.Start(); }
protected override void OnStop() { if (p_oMonitor != null) { p_oMonitor.Stop(); p_oMonitor.RegChanged -= new EventHandler(OnRegChanged); p_oMonitor.Error -= new ErrorEventHandler(OnError); p_oMonitor = null; } }
private void OnRegChanged(object sender, EventArgs e) { }
private void OnError(object sender, ErrorEventArgs e) { }
}
} </code>
I’m a moderately experienced C# coder but admittedly have done little to no work with either Windows services or threaded code so I may be missing something obvious, but if you had any insights they’d be appreciated.
|
| Sign In·View Thread·PermaLink | |
|
|
|
 |
|
 |
You are monitoring a key inside HKEY_CURRENT_USER
If you are running the app as a desktop app it will be monitor the key in the presently logged on users registry hive.
If you are running the app as a service it will be looking in the registry hive of the service user account, not the logged on user. By default this will be the HKEY_USERS\S-1-5-18 for local system HKEY_USERS\S-1-5-19 for local service HKEY_USERS\S-1-5-20 for network service
If you are trying to monitor the logged on users keys from a service, you need to do something like getting the sids of the logged on users (or users) or monitoring the windows logon events, and then monitoring from you service HKEY_USERS\. Note if you do this you need ot be extremly careful that you detect user session ends and removing the monitoring, otherwise it can prevent things like roaming profile uploads at logoff as you have the users registry hive locked.
- Drayath
|
| Sign In·View Thread·PermaLink | |
|
|
|
 |
|
 |
Hello Thomas, It's really very good for monitoring registry entry.Its Really very good.
How can i get the name of created or modified or deleted registry entry name. If you have any suggestion or answer please help.
Thanks
If you can think then I Can.
|
| Sign In·View Thread·PermaLink | |
|
|
|
 |
|
 |
It's not possible, see my reply to puyopuy.
Regards Thomas Disclaimer: Because of heavy processing requirements, we are currently using some of your unused brain capacity for backup processing. Please ignore any hallucinations, voices or unusual dreams you may experience. Please avoid concentration-intensive tasks until further notice. Thank you.
|
| Sign In·View Thread·PermaLink | |
|
|
|
 |
|
 |
Hello, I keep getting the above exception no matter what key I try to watch.
The exception is thrown by: RegistryUtils.RegistryMonitor.ThreadLoop()
I'm pretty sure these are the offending lines of code:
private void ThreadLoop() { IntPtr registryKey; int result = RegOpenKeyEx(_registryHive, _registrySubName, 0, STANDARD_RIGHTS_READ | KEY_QUERY_VALUE | KEY_NOTIFY, out registryKey); if (result != 0) throw new Win32Exception(result);
...
}
Unfortunately, I have no idea what the exception message means. What file is it looking for? Any help would be appreciated. This code would be awesome if it worked for me! 
Thanks,
Andrew
|
| Sign In·View Thread·PermaLink | |
|
|
|
 |
|
 |
What does the callstack say?
Regards Thomas Disclaimer: Because of heavy processing requirements, we are currently using some of your unused brain capacity for backup processing. Please ignore any hallucinations, voices or unusual dreams you may experience. Please avoid concentration-intensive tasks until further notice. Thank you.
|
| Sign In·View Thread·PermaLink | |
|
|
|
 |
|
|
 |
|
 |
Hi,
Never had much luck with trial ware for monitoring registry. However I managed a reasonable solution using commonly installed windows components.
1. Load RegEdit.EXE 2. Export tree to file1.reg 3. Perform your task 4. Export tree to file2.reg 5. Use WinMerge.EXE on the files
100% works and is faster then purchasing other snapshot software. http://winmerge.org/[^]
|
| Sign In·View Thread·PermaLink | 1.00/5 (1 vote) |
|
|
|
 |
|
 |
Hello all,
In the demo it only tell us if there a key changed but it cannot tell whether it is a new key or modified old key, what is the new value and what is the key type(e.g. string, boolean or integer ...). Anyone have idea how to do it?
I would appreciate any help and suggestion. puyo
|
| Sign In·View Thread·PermaLink | |
|
|
|
 |
|
 |
Hi Puyo, Unfortunately, the API of RegNotifyChangeKeyValue[^] does not expose that information.
Regards Thomas Disclaimer: Because of heavy processing requirements, we are currently using some of your unused brain capacity for backup processing. Please ignore any hallucinations, voices or unusual dreams you may experience. Please avoid concentration-intensive tasks until further notice. Thank you.
|
| Sign In·View Thread·PermaLink | 2.00/5 (1 vote) |
|
|
|
 |
|
|
 |
|
 |
Not as far as I know.
Regards Thomas Disclaimer: Because of heavy processing requirements, we are currently using some of your unused brain capacity for backup processing. Please ignore any hallucinations, voices or unusual dreams you may experience. Please avoid concentration-intensive tasks until further notice. Thank you.
|
| Sign In·View Thread·PermaLink | |
|
|
|
 |
|
|
 |
|
 |
I have this silly idea..
Can we get the keys subkeys and the values in any way?
If we can, we can store them in a struct (with fields: name,type,value,solitary hash code) and order it by the field solitary hashcode (which field will be a special solitary number that would generate when the key or value is going to store in the struct through an MD5 or something like algorithm) then we use the function RegNotifyChangeKeyValue[^] which gives us the key that is modified and not the type and the value). Then we can take in the same struct but in another instance the subkeys and the values of the modified keys and compare them with the first struct (with that we have the changed keys and the values) after comparing the hashcodes of the 2 structs. With that we can find the type that is changed and the value) is this possible? sounds tricky. thanks Alex
|
| Sign In·View Thread·PermaLink | 2.00/5 (2 votes) |
|
|
|
 |
|
 |
Of course, that's possible.
Regards Thomas Disclaimer: Because of heavy processing requirements, we are currently using some of your unused brain capacity for backup processing. Please ignore any hallucinations, voices or unusual dreams you may experience. Please avoid concentration-intensive tasks until further notice. Thank you.
|
| Sign In·View Thread·PermaLink | |
|
|
|
 |
|
 |
Hi,
I'm having problems using the class in a Windows Service. On changing the monitored registry I get the error: "Object reference not set to an instance of an object.." The handled 'crash' is in the protected virtual void OnRegChanged() function in the RegistryMonitor class, when setting the handler constructor (Ln99)
The change is clearly caught, but I don't seem to get the signal, any thoughts?
The implementation is simple:
string keyName = string.Format("{0}\\{1}", Registry.LocalMachine.Name, registryPath); monitor = new RegistryMonitor(keyName); monitor.RegChanged += new EventHandler(OnRegChanged); monitor.Error += new System.IO.ErrorEventHandler(OnError); monitor.Start(); ... private void OnRegChanged(object sender, EventArgs e)...
|
| Sign In·View Thread·PermaLink | |
|
|
|
 |
|
|
 |
|
 |
I can download both files without a problem. Maybe it was a temporary glitch. Please try again.
Regards Thomas Disclaimer: Because of heavy processing requirements, we are currently using some of your unused brain capacity for backup processing. Please ignore any hallucinations, voices or unusual dreams you may experience. Please avoid concentration-intensive tasks until further notice. Thank you.
|
| Sign In·View Thread·PermaLink | |
|
|
|
 |
|
 |
First off - nice article. Very helpful  It looks like there's a thread problem here, though. If I call Start(), then immediately modify the registry programmatically, then the ThreadLoop() call may not have reached RegNotifyChangeKeyValue(), so the change will go unnoticed. This can be partially fixed by at least waiting in Start() until that call is reached (although that's not a perfect solution). Also, if a registry change is picked up, then it's possible that another change could occur between OnRegChanged() and the next RegNotifyChangeKeyValue() call, which would also fall through the cracks. Finally, if the terminate event is signalled, then OnRegChanged() will get called - the code doesn't differentiate between termination or notification.
Is there no alternative method of monitoring the registry, that could be done with, say, callbacks, rather than signalling?
Edit: Ha. My bad - I just checked: RegNotifyChangeKeyValue() will pick up on changes between calls, so my second point is nonsense.
-- modified at 6:52 Monday 20th August, 2007
|
| Sign In·View Thread·PermaLink | |
|
|
|
 |
|
|
 |
|
 |
I'm using VB 2005 and facing a similar problem here. Here's what my code looks like.
Imports RegistryUtils
Private Sub TestReg_Load(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Load Dim objRegMon As New RegistryMonitor(RegistryHive.LocalMachine, "System\CurrentControlSet\Services\USBSTOR")
objRegMon.RegChanged += New EventHandler(OnRegChanged) objRegMon.Start() End Sub
I tried to use Intellisense to type objRegMon.RegChanged, but when I hit "." (dot) after objRegMon, I can't find the RegChanged event. I checked the RegistryUtils source code at the RegChanged event, it already stated as Public. What did I do wrong with my code? Or is it just an incompatibility with VS 2005?
|
| Sign In·View Thread·PermaLink | 1.00/5 (1 vote) |
|
|
|
 |
|
|
 |
|
 |
No, you can´t. You can only monitor keys (and subkeys optionally), but not the contained values.
Regards Thomas Disclaimer: Because of heavy processing requirements, we are currently using some of your unused brain capacity for backup processing. Please ignore any hallucinations, voices or unusual dreams you may experience. Please avoid concentration-intensive tasks until further notice. Thank you.
|
| Sign In·View Thread·PermaLink | 1.00/5 (1 vote) |
|
|
|
 |
|
 |
I'm just wanting to clarify with your response. So there is no way to tell the name of the key that was modified?
jgehman Software Engineer
|
| Sign In·View Thread·PermaLink | |
|
|
|
 |
|
 |
Exactly. My code can't do more than what RegNotifyChangeKeyValue provides.
Regards Thomas Disclaimer: Because of heavy processing requirements, we are currently using some of your unused brain capacity for backup processing. Please ignore any hallucinations, voices or unusual dreams you may experience. Please avoid concentration-intensive tasks until further notice. Thank you.
|
| Sign In·View Thread·PermaLink | 1.00/5 (1 vote) |
|
|
|
 |