I see if anybody else knows of a better way, but WMI is not all that slow
and that is the only way that I know to register for events. These are
accessed through a System.Management.WQLEventQuery that is associated with a
System.Management.ManagementEventWatcher
Counters are just values, very lightweight, WMI is the infrastructure that
does what you are asking, creating the ability to attach events to the
counters.

You could write your own process factory and make you own event for creating
processes and then launch the Process using the System.Diagnostics.Process
object, but that would only work on your program's processes.

Otherwise Windows launches the processes and I don't think there is an event
in the Win32 api, I will look later though...

The examples I have seen all use some kind of polling to do this (for
example creating a simple Task Manager and being able to update the process
list, this is done on threads).

Mitch

The "WMI Kernel Trace Event Provider" (XP and higher) is a high performance
provider exposing Win32_ProcessStartTrace, Win32_ProcessStopTrace,
Win32_ThreaStartTrace, Win32_ThreadStopTrace  events is superfast and
provides a new scope for monitoring process related resources.

Willy.