ProcessTermination Event

Fires when a process is being terminated.

Syntax

ANSI (Cross Platform)
virtual int FireProcessTermination(CBProcessProcessTerminationEventParams *e);
typedef struct {
int ProcessId;
const char *ProcessName;
int ResultCode; int reserved; } CBProcessProcessTerminationEventParams; Unicode (Windows) virtual INT FireProcessTermination(CBProcessProcessTerminationEventParams *e);
typedef struct {
INT ProcessId;
LPCWSTR ProcessName;
INT ResultCode; INT reserved; } CBProcessProcessTerminationEventParams;
#define EID_CBPROCESS_PROCESSTERMINATION 4

virtual INT CBFSFILTER_CALL FireProcessTermination(INT &iProcessId, LPWSTR &lpszProcessName, INT &iResultCode);

Remarks

This event fires when a process is being terminated, just before its last thread is destroyed.

Applications cannot prevent a process from being terminated using this event; use the ProcessHandleOperation event instead.

The ProcessId parameter reflects the Id of the terminating process.

The ProcessName parameter reflects the name of the terminating process. This parameter's value is the same one that the GetProcessName method would return for ProcessId.

The ResultCode parameter will always be 0 when the event is fired. If the event cannot be handled in a "successful" manner for some reason (e.g., a resource isn't available, security checks failed, etc.), set it to a non-zero value to report an appropriate error. Please refer to the Error Reporting and Handling topic for more information.

Note that the system APIs offer no way to report errors which occur during the processing of this request. Exceptional ResultCode values are therefore largely ignored.

This event is fired synchronously; please refer to the Event Types topic for more information.

Copyright (c) 2022 Callback Technologies, Inc. - All rights reserved.
CBFS Filter 2020 C++ Edition - Version 20.0 [Build 8317]