AppUserList – AULService

I’m back after a while with a new post about my AppUserList application. At the new company I joined a few months ago, I found new colleagues, one in particular who has much more development experience than I do.

A few days ago I told him about my personal project, AppUserList, and he immediately offered to help me with the development, with the goal of adding features and optimizing how it works. Often, having “good ideas” isn’t enough to know how to implement them in the best way.

We spent a few hours of our (unfortunately limited) free time reviewing the source code of the AULService agent together. Thanks to his expertise, I rewrote part of it so that it works better and uses fewer system resources.

Last night I released the new AULService v2.0.54 on GitHub, which removes the use of SQLite as the local cache DB and replaces it with in-memory Hashtables.

This approach makes AULService much more responsive, less “clunky” (constantly working with SQL queries turned out not to be as smooth as I’d hoped) and, above all, less resource-hungry.

AULService now works like this:

• When the machine boots, AULService starts too; as soon as it starts, AULService runs a few queries against AULMonitor and caches the data it needs in Hashtables kept in memory;
• Once the information is cached, the continuous process starts: it monitors the sessions of the users connected to the machine being analyzed and adds the data of the applications launched by those users to the cache (Hashtable), comparing it with what is already in the cache to avoid duplicates;
• At regular intervals, AULService synchronizes this cache to AULMonitor, saving to the central DB only the changes compared to what it preloaded into the cache at startup. The session monitoring process relies on two functions: one that monitors the registry keys (as described in the previous posts) and a second one that uses Get-WmiObject Win32_Process to get the processes started by the user in the session;

Thanks to these two functions, AULService can now capture 100% of the executables launched by the user, both third-party applications and operating system executables. AULReport still lets you exclude from the reports any processes that aren’t useful for reporting purposes.

With my colleague’s support, I’m planning to rework other parts of the tool as well, to try to make it ever more useful and optimized.