Scripts for monitoring Processes on Windows Operating Systems

Monitor Job Object Details Performance
Monitor Job Object Performance
Monitor Process Address Space Performance -- Costly
Monitor Process Creation
Monitor Process Deletion
Monitor Process Full Image Performance -- Costly
Monitor Process Image Performance -- Costly
Monitor Process Performance
Monitor Process Performance
Monitor Processor Use by Process
Monitor Thread Details Performance -- Costly
Monitor Thread Performance
Verify Process Availability

You can use any of the VBScript programs below in ActiveXperts Network Monitor. Click here for an explanation about how to include scripts in ActiveXperts Network Monitor.

Monitor Job Object Details Performance

Uses cooked performance counters to return detailed performance information about the processes that make up a job object.

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
set objRefresher = CreateObject("WbemScripting.SWbemRefresher")
Set colItems = objRefresher.AddEnum(objWMIService, _
    "Win32_PerfFormattedData_PerfProc_JobObjectDetails").objectSet
objRefresher.Refresh

For i = 1 to 5
    For Each objItem in colItems
        Wscript.Echo "Caption: " & objItem.Caption
        Wscript.Echo "Creating Process ID: " & objItem.CreatingProcessID
        Wscript.Echo "Description: " & objItem.Description
        Wscript.Echo "Elapsed Time: " & objItem.ElapsedTime
        Wscript.Echo "Handle Count: " & objItem.HandleCount
        Wscript.Echo "ID Process: " & objItem.IDProcess
        Wscript.Echo "I/O Data Bytes Per Second: " & objItem.IODataBytesPersec
        Wscript.Echo "I/O Data Operations Per Second: " & _
            objItem.IODataOperationsPersec
        Wscript.Echo "I/O Other Bytes Per Second: " & _
            objItem.IOOtherBytesPersec
        Wscript.Echo "I/O Other Operations Per Second: " & _
            objItem.IOOtherOperationsPersec
        Wscript.Echo "I/O Read Bytes Per Second: " & objItem.IOReadBytesPersec
        Wscript.Echo "I/O Read Operations Per Second: " & _
            objItem.IOReadOperationsPersec
        Wscript.Echo "I/O Write Bytes Per Second: " & _
            objItem.IOWriteBytesPersec
        Wscript.Echo "I/O Write Operations Per Second: " & _
            objItem.IOWriteOperationsPersec
        Wscript.Echo "Name: " & objItem.Name
        Wscript.Echo "Page Faults Per Second: " & objItem.PageFaultsPersec
        Wscript.Echo "Page File Bytes: " & objItem.PageFileBytes
        Wscript.Echo "Page File Bytes Peak: " & objItem.PageFileBytesPeak
        Wscript.Echo "Percent Privileged Time: " & _
            objItem.PercentPrivilegedTime
        Wscript.Echo "Percent Processor Time: " & objItem.PercentProcessorTime
        Wscript.Echo "Percent User Time: " & objItem.PercentUserTime
        Wscript.Echo "Pool Nonpaged Bytes: " & objItem.PoolNonpagedBytes
        Wscript.Echo "Pool Paged Bytes: " & objItem.PoolPagedBytes
        Wscript.Echo "Priority Base: " & objItem.PriorityBase
        Wscript.Echo "Private Bytes: " & objItem.PrivateBytes
        Wscript.Echo "Thread Count: " & objItem.ThreadCount
        Wscript.Echo "Virtual Bytes: " & objItem.VirtualBytes
        Wscript.Echo "Virtual Bytes Peak: " & objItem.VirtualBytesPeak
        Wscript.Echo "Working Set: " & objItem.WorkingSet
        Wscript.Echo "Working Set Peak: " & objItem.WorkingSetPeak
        Wscript.Sleep 2000
    objRefresher.Refresh
    Next
Next

Monitor Job Object Performance

Uses cooked performance counters to return information about accounting and processor usage data collected by each active named job object.

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
set objRefresher = CreateObject("WbemScripting.SWbemRefresher")
Set colItems = objRefresher.AddEnum _
    (objWMIService, "Win32_PerfFormattedData_PerfProc_JobObject").objectSet
objRefresher.Refresh

For i = 1 to 5
    For Each objItem in colItems
        Wscript.Echo "Caption: " & objItem.Caption
        Wscript.Echo "Current Percent Kernel Mode Time: " & _
            objItem.CurrentPercentKernelModeTime
        Wscript.Echo "Current Percent Processor Time: " & _
            objItem.CurrentPercentProcessorTime
        Wscript.Echo "Current Percent User Mode Time: " & _\
            objItem.CurrentPercentUserModeTime
        Wscript.Echo "Description: " & objItem.Description
        Wscript.Echo "Name: " & objItem.Name
        Wscript.Echo "Pages Per Second: " & objItem.PagesPerSec
        Wscript.Echo "Process Count Active: " & objItem.ProcessCountActive
        Wscript.Echo "Process Count Terminated: " & _
            objItem.ProcessCountTerminated
        Wscript.Echo "Process Count Total: " & objItem.ProcessCountTotal
        Wscript.Echo "This Period Milliseconds Kernel Mode: " & _
            objItem.ThisPeriodmSecKernelMode
        Wscript.Echo "This Period Milliseconds Processor: " & _
            objItem.ThisPeriodmSecProcessor
        Wscript.Echo "This Period Milliseconds User Mode: " & _
            objItem.ThisPeriodmSecUserMode
        Wscript.Echo "Total Milliseconds Kernel Mode: " & _
            objItem.TotalmSecKernelMode
        Wscript.Echo "Total Milliseconds Processor: " & _
            objItem.TotalmSecProcessor
        Wscript.Echo "Total Milliseconds User Mode: " & _
            objItem.TotalmSecUserMode
        Wscript.Sleep 2000
        objRefresher.Refresh
    Next
Next

Monitor Process Address Space Performance -- Costly

Uses cooked performance counters to return information about memory allocation and use for a selected process

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
set objRefresher = CreateObject("WbemScripting.SWbemRefresher")
Set colItems = objRefresher.AddEnum(objWMIService, _
    "Win32_PerfFormattedData_PerfProc_ProcessAddressSpace_Costly").objectSet
objRefresher.Refresh

For i = 1 to 5
    For Each objItem in colItems
        Wscript.Echo "Bytes Free: " & objItem.BytesFree
        Wscript.Echo "Bytes Image Free: " & objItem.BytesImageFree
        Wscript.Echo "Bytes Image Reserved: " & objItem.BytesImageReserved
        Wscript.Echo "Bytes Reserved: " & objItem.BytesReserved
        Wscript.Echo "Caption: " & objItem.Caption
        Wscript.Echo "Description: " & objItem.Description
        Wscript.Echo "ID Process: " & objItem.IDProcess
        Wscript.Echo "Image Space Exec Read-Only: " & _
            objItem.ImageSpaceExecReadOnly
        Wscript.Echo "Image Space Exec Read Per Write: " & _
            objItem.ImageSpaceExecReadPerWrite
        Wscript.Echo "Image Space Executable: " & objItem.ImageSpaceExecutable
        Wscript.Echo "Image Space Exec Write Copy: " & _
            objItem.ImageSpaceExecWriteCopy
        Wscript.Echo "Image Space NoA ccess: " & objItem.ImageSpaceNoAccess
        Wscript.Echo "Image Space Read-Only: " & objItem.ImageSpaceReadOnly
        Wscript.Echo "Image Space Read Per Write: " & _
            objItem.ImageSpaceReadPerWrite
        Wscript.Echo "Image Space Write Copy: " & objItem.ImageSpaceWriteCopy
        Wscript.Echo "Mapped Space Exec Read-Only: " & _
            objItem.MappedSpaceExecReadOnly
        Wscript.Echo "Mapped Space Exec Read Per Write: " & _
            objItem.MappedSpaceExecReadPerWrite
        Wscript.Echo "Mapped Space Executable: " & _
            objItem.MappedSpaceExecutable
        Wscript.Echo "Mapped Space Exec Write Copy: " & _
            objItem.MappedSpaceExecWriteCopy
        Wscript.Echo "Mapped Space No Access: " & objItem.MappedSpaceNoAccess
        Wscript.Echo "Mapped Space Read Only: " & objItem.MappedSpaceReadOnly
        Wscript.Echo "Mapped Space Read Per Write: " & _
            objItem.MappedSpaceReadPerWrite
        Wscript.Echo "Mapped Space Write Copy: " & objItem.MappedSpaceWriteCopy
        Wscript.Echo "Name: " & objItem.Name
        Wscript.Echo "Reserved Space Exec Read-Only: " & _
            objItem.ReservedSpaceExecReadOnly
        Wscript.Echo "Reserved Space Exec Read Per Write: " & _
            objItem.ReservedSpaceExecReadPerWrite
        Wscript.Echo "Reserved Space Executable: " & _
            objItem.ReservedSpaceExecutable
        Wscript.Echo "Reserved Space Exec Write Copy: " & _
            objItem.ReservedSpaceExecWriteCopy
        Wscript.Echo "Reserved Space No Access: " & _
            objItem.ReservedSpaceNoAccess
        Wscript.Echo "Reserved Space Read-Only: " & _
            objItem.ReservedSpaceReadOnly
        Wscript.Echo "Reserved Space Read Per Write: " & _
            objItem.ReservedSpaceReadPerWrite
        Wscript.Echo "Reserved Space Write Copy: " & _
            objItem.ReservedSpaceWriteCopy
        Wscript.Echo "Unassigned Space Exec Read-Only: " & _
            objItem.UnassignedSpaceExecReadOnly
        Wscript.Echo "Unassigned Space Exec Read Per Write: " & _
            objItem.UnassignedSpaceExecReadPerWrite
        Wscript.Echo "Unassigned Space Executable: " & _
            objItem.UnassignedSpaceExecutable
        Wscript.Echo "Unassigned Space Exec Write Copy: " & _
            objItem.UnassignedSpaceExecWriteCopy
        Wscript.Echo "Unassigned Space No Access: " & _
            objItem.UnassignedSpaceNoAccess
        Wscript.Echo "Unassigned Space Read-Only: " & _
            objItem.UnassignedSpaceReadOnly
        Wscript.Echo "Unassigned Space Read Per Write: " & _
            objItem.UnassignedSpaceReadPerWrite
        Wscript.Echo "Unassigned Space Write Copy: " & _
        objItem.UnassignedSpaceWriteCopy
        Wscript.Sleep 2000
        objRefresher.Refresh
    Next
Next

Monitor Process Creation

Temporary event consumer that issues an alert each time a new process is created.

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colMonitoredProcesses = objWMIService. _        
    ExecNotificationQuery("select * from __instancecreationevent " _ 
        & " within 1 where TargetInstance isa 'Win32_Process'")
i = 0

Do While i = 0
    Set objLatestProcess = colMonitoredProcesses.NextEvent
    Wscript.Echo objLatestProcess.TargetInstance.Name
Loop

Monitor Process Deletion

Temporary event consumer that issues an alert each time a process terminates.

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colMonitoredProcesses = objWMIService. _
    ExecNotificationQuery("select * from __instancedeletionevent " _ 
            & "within 1 where TargetInstance isa 'Win32_Process'")
i = 0

Do While i = 0
    Set objLatestProcess = colMonitoredProcesses.NextEvent
    Wscript.Echo objLatestProcess.TargetInstance.Name
Loop

Monitor Process Full Image Performance -- Costly

Uses cooked performance counters to return information about the virtual address usage of images executed by computer processes.

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
set objRefresher = CreateObject("WbemScripting.SWbemRefresher")
Set colItems = objRefresher.AddEnum(objWMIService, _
    "Win32_PerfFormattedData_PerfProc_FullImage_Costly").objectSet
objRefresher.Refresh

For i = 1 to 5
    For Each objItem in colItems
        Wscript.Echo "Caption: " & objItem.Caption
        Wscript.Echo "Description: " & objItem.Description
        Wscript.Echo "Exec Read-Only: " & objItem.ExecReadOnly
        Wscript.Echo "Exec Read Per Write: " & objItem.ExecReadPerWrite
        Wscript.Echo "Executable: " & objItem.Executable
        Wscript.Echo "Exec Write Copy: " & objItem.ExecWriteCopy
        Wscript.Echo "Name: " & objItem.Name
        Wscript.Echo "No Access: " & objItem.NoAccess
        Wscript.Echo "Read-Only: " & objItem.ReadOnly
        Wscript.Echo "Read Per Write: " & objItem.ReadPerWrite
        Wscript.Echo "Write Copy: " & objItem.WriteCopy
        Wscript.Sleep 2000
        objRefresher.Refresh
    Next
Next

Monitor Process Image Performance -- Costly

Uses cooked performance counters to return information about the virtual address usage of images executed by computer processes.

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
set objRefresher = CreateObject("WbemScripting.SWbemRefresher")
Set colItems = objRefresher.AddEnum _
    (objWMIService, "Win32_PerfFormattedData_PerfProc_Image_Costly").objectSet
objRefresher.Refresh

For i = 1 to 5
    For Each objItem in colItems
        Wscript.Echo "Caption: " & objItem.Caption
        Wscript.Echo "Description: " & objItem.Description
        Wscript.Echo "Exec Read-Only: " & objItem.ExecReadOnly
        Wscript.Echo "Exec Read Per Write: " & objItem.ExecReadPerWrite
        Wscript.Echo "Executable: " & objItem.Executable
        Wscript.Echo "Exec Write Copy: " & objItem.ExecWriteCopy
        Wscript.Echo "Name: " & objItem.Name
        Wscript.Echo "No Access: " & objItem.NoAccess
        Wscript.Echo "Read-Only: " & objItem.ReadOnly
        Wscript.Echo "Read Per Write: " & objItem.ReadPerWrite
        Wscript.Echo "Write Copy: " & objItem.WriteCopy
        Wscript.Sleep 2000
        objRefresher.Refresh
    Next
Next

Monitor Process Performance

Reports statistics such as thread count and working set size for all the processes running on a computer.

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colProcessList = objWMIService.ExecQuery("Select * from Win32_Process")

For Each objProcess in colProcessList
    Wscript.Echo "Process: " & objProcess.Name 
    Wscript.Echo "Process ID: " & objProcess.ProcessID 
    Wscript.Echo "Thread Count: " & objProcess.ThreadCount 
    Wscript.Echo "Page File Size: " & objProcess.PageFileUsage 
    Wscript.Echo "Page Faults: " & objProcess.PageFaults 
    Wscript.Echo "Working Set Size: " & objProcess.WorkingSetSize 
Next

Monitor Process Performance

Uses cooked performance counters to return information about running application program and system processes.

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
set objRefresher = CreateObject("WbemScripting.SWbemRefresher")
Set colItems = objRefresher.AddEnum _
    (objWMIService, "Win32_PerfFormattedData_PerfProc_Process").objectSet
objRefresher.Refresh

For i = 1 to 5
    For Each objItem in colItems
        Wscript.Echo "Caption: " & objItem.Caption
        Wscript.Echo "Creating Process ID: " & objItem.CreatingProcessID
        Wscript.Echo "Description: " & objItem.Description
        Wscript.Echo "Elapsed Time: " & objItem.ElapsedTime
        Wscript.Echo "Handle Count: " & objItem.HandleCount
        Wscript.Echo "ID Process: " & objItem.IDProcess
        Wscript.Echo "I/O Data Bytes Per Second: " & _
            objItem.IODataBytesPersec
        Wscript.Echo "I/O Data Operations Per Second: " & _
            objItem.IODataOperationsPersec
        Wscript.Echo "I/O Other Bytes Per Second: " & _
            objItem.IOOtherBytesPersec
        Wscript.Echo "I/O Other Operations Per Second: " & _
            objItem.IOOtherOperationsPersec
        Wscript.Echo "I/O Read Bytes Per Second: " & _
            objItem.IOReadBytesPersec
        Wscript.Echo "I/O Read Operations Per Second: " & _
            objItem.IOReadOperationsPersec
        Wscript.Echo "I/O Write Bytes Per Second: " & _
            objItem.IOWriteBytesPersec
        Wscript.Echo "I/O Write Operations Per Second: " & _
            objItem.IOWriteOperationsPersec
        Wscript.Echo "Name: " & objItem.Name
        Wscript.Echo "Page Faults Per Second: " & objItem.PageFaultsPersec
        Wscript.Echo "Page File Bytes: " & objItem.PageFileBytes
        Wscript.Echo "Page File Bytes Peak: " & objItem.PageFileBytesPeak
        Wscript.Echo "Percent Privileged Time: " & _
            objItem.PercentPrivilegedTime
        Wscript.Echo "Percent Processor Time: " & _
            objItem.PercentProcessorTime
        Wscript.Echo "Percent User Time: " & objItem.PercentUserTime
        Wscript.Echo "Pool Nonpaged Bytes: " & objItem.PoolNonpagedBytes
        Wscript.Echo "Pool Paged Bytes: " & objItem.PoolPagedBytes
        Wscript.Echo "Priority Base: " & objItem.PriorityBase
        Wscript.Echo "Private Bytes: " & objItem.PrivateBytes
        Wscript.Echo "Thread Count: " & objItem.ThreadCount
        Wscript.Echo "Virtual Bytes: " & objItem.VirtualBytes
        Wscript.Echo "Virtual Bytes Peak: " & objItem.VirtualBytesPeak
        Wscript.Echo "Working Set: " & objItem.WorkingSet
        Wscript.Echo "Working Set Peak: " & objItem.WorkingSetPeak
        Wscript.Sleep 2000
        objRefresher.Refresh
    Next
Next

Monitor Processor Use by Process

Reports processor use time, in seconds, for each process running on a computer.

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

Set colProcesses = objWMIService.ExecQuery("Select * from Win32_Process")

For Each objProcess in colProcesses
    sngProcessTime = (CSng(objProcess.KernelModeTime) + _
            CSng(objProcess.UserModeTime)) / 10000000
    Wscript.Echo objProcess.name & VbTab & sngProcessTime
Next

Monitor Thread Details Performance -- Costly

Uses cooked performance counters to return information about thread behavior that are difficult or time-consuming to collect.

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
set objRefresher = CreateObject("WbemScripting.SWbemRefresher")
Set colItems = objRefresher.AddEnum(objWMIService, _
    "Win32_PerfFormattedData_PerfProc_ThreadDetails_Costly").objectSet
objRefresher.Refresh

For i = 1 to 5
    For Each objItem in colItems
        Wscript.Echo "Caption: " & objItem.Caption
        Wscript.Echo "Description: " & objItem.Description
        Wscript.Echo "Name: " & objItem.Name
        Wscript.Echo "User PC: " & objItem.UserPC
        Wscript.Sleep 2000
        objRefresher.Refresh
    Next
Next

Monitor Thread Performance

Uses cooked performance counters to return information about thread behavior.

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
set objRefresher = CreateObject("WbemScripting.SWbemRefresher")
Set colItems = objRefresher.AddEnum _
    (objWMIService, "Win32_PerfFormattedData_PerfProc_Thread").objectSet
objRefresher.Refresh

For i = 1 to 5
    For Each objItem in colItems
        Wscript.Echo "Caption: " & objItem.Caption
        Wscript.Echo "Context Switches Per Second: " & _
            objItem.ContextSwitchesPersec
        Wscript.Echo "Description: " & objItem.Description
        Wscript.Echo "Elapsed Time: " & objItem.ElapsedTime
        Wscript.Echo "ID Process: " & objItem.IDProcess
        Wscript.Echo "ID Thread: " & objItem.IDThread
        Wscript.Echo "Name: " & objItem.Name
        Wscript.Echo "Percent Privileged Time: " & _
            objItem.PercentPrivilegedTime
        Wscript.Echo "Percent Processor Time: " & objItem.PercentProcessorTime
        Wscript.Echo "Percent User Time: " & objItem.PercentUserTime
        Wscript.Echo "Priority Base: " & objItem.PriorityBase
        Wscript.Echo "Priority Current: " & objItem.PriorityCurrent
        Wscript.Echo "Start Address: " & objItem.StartAddress
        Wscript.Echo "Thread State: " & objItem.ThreadState
        Wscript.Echo "Thread Wait Reason: " & objItem.ThreadWaitReason
        Wscript.Sleep 2000
        objRefresher.Refresh
    Next
Next

Verify Process Availability

Identifies whether or not a hypothetical process Database.exe is running.

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colProcesses = objWMIService.ExecQuery _
    ("Select * from Win32_Process Where Name = 'Database.exe'")

If colProcesses.Count = 0 Then
    Wscript.Echo "Database.exe is not running."
Else
    Wscript.Echo "Database.exe is running."
End If

Footer Navigation

Site Map
Contact Us
Terms of Use
Privacy Policy