How did my process exit?

Question

From C# on a Windows box, is there a way to find out how a process was stopped? I've had a look at the Process class, managed to get a nice friendly callback from the Exited event once I set EnableRaisingEvents = true; but I have not managed to find out whether the process was killed or whether it exited naturally?

Answer 1

Fire up Process Monitor (from Sysinternals, part of Microsoft), run your process and let it die, then filter the Process Monitor results by your process name -- you will be able to see everything that it did, including exit codes.

Answer 2

You can use the return code of the process for that. If your process returns a non-zero value from its Main method, you can then check whether or not the process exited by itself (the return value matches).

Answer 3

Nice answer Antoine, sadly I cannot change the return code. My bad - I guess I need to narrow down the scope of the question.

Realistically I don't think I even need a programmatic solution either - a utility would be fine - I've had a look at the impressive looking Process Explorer but that doesn't appear to give me these details.

The problem I have is the program I wish to interrogate is being run by a scheduling system, equivalent to Windows scheduled tasks, but not that. Is there a way of detecting whether that scheduler is forcefully stopping the program?