Automating the restart of Voicemeeter

Aug 9, 2024 — by Andrew Holloway Automation

The Problem

Voicemeeter (my audio management program) crashes every other time I login to my computer. The issue isn't consistent and the program doesn't seem to have an issue itself. I seems to be mostly because I hibernate my machine.

The Solution

Investigation

Now, I know I'm going to use Task Scheduler. I figured Windows would have Application Logs that track if an application crashes. What I found was no, this was not correct, well.. it is, but not by default. It turns out it is up to the application developer to log this information to the Windows Event Log. The Voicemeeter developer did not implement this.

I quickly remembered investigating a Sysinternals program called Sysmon a while ago that adds a lot of these extremely detailed information to the Event Viewer. Anything from network connections, file changes, and process creations and ends. After installing Sysmon, I dove into seeing if Voicemeeter shows up in the viewer, and it did!

Implementation

I've used Task Scheduler before for automation like this, such as restarting Voicemeeter when I connect my Bluetooth headphones.

Creating a task I quickly realised I had to make a custom filter as a trigger as Sysmon doesn't break down it's triggers as the different programs, it is all labelled Sysmon and you need to filter by EventData. I've never done a query search before which was daunting. Below are the prototype queries I went through to figure out what would return the correct results.

To test my queries, I used Event Viewer directly. I went through a few different variations of my queries. Some were valid but returned 0 items, others were not valid at all and I wasn't sure why. Below is the working custom event filter I used for the trigger.

<QueryList>
    <Query Id="0" Path="Microsoft-Windows-Sysmon/Operational">
        <Select Path="Microsoft-Windows-Sysmon/Operational">
            *[EventData[Data[@Name='Image'] and (Data='C:\Program Files (x86)\VB\Voicemeeter\voicemeeter.exe')]]
            and *[System[(EventID=5)]]
        </Select>
    </Query>
</QueryList>

Testing this was simple. I just force closed Voicemeeter via Task Manager. It was successful!

Resources