A new addition to the agent capabilities in v4.x has been a new concept in task processing, the Live task. A Live task is one that:
- Runs permanently, often as a dedicated thread for handling Windows messages and events
- Has a data gathering interval, at which time summaries and lists are passed to the Tasks Engine
The primary difference is that a Live task only works when something happens in Windows, like a program is launched, whereas regular tasks have to poll for their information on every pass. A regular task would thus need to re-read the entire process list, then compare it to a previously stored one, just to be able to sense that a new program has been launched. If the regular task runs hourly, it would not notice a program that was run in the interim. Live tasks get notified of every program startup, and they can accumulate lists for each and every event. All program launches are noticed, with the lowest possible overhead, altogether a much better approach!
This task type is used in the agent's Application Metering with
Foreground Window Tracking and
Application Quarantine capabilities, using a number of Windows hooks that notify when new processes or desktop window changes occur.