Solved

Script to Kill process using over 700MB memory

Posted on 2010-08-31
24
1,939 Views
Last Modified: 2013-11-09
Can i please have help with a script which can run in the background constantly that will kill a process with a specific name like iexplore.exe which is using more then 700MB memory in a specified amount of time?

Also at the same time before killing the process send a message popup warning to the PID user sayinfg something like "Your app will close due to high memory usage in 3 minutes, please save all your work"

Just to be more clear on this:

I am running a home made app over citrix. This app seems to have some memory issues, and when the memory utilization is high, it slows down the server considerably. The process runs on the admin user account, but of course has a seperate PID based on the user who logged in.

If i can warn the users, and then close the high memory usage app automatically, this would be a nice temporary fix until the apps memory issue is fixed.

Its run on windows 2003 r2
0
Comment
Question by:alexr54
  • 10
  • 9
  • 3
  • +1
24 Comments
 
LVL 22

Expert Comment

by:plusone3055
ID: 33569118
0
 
LVL 2

Author Comment

by:alexr54
ID: 33569201
tasklill does not run in the background, it must be executed at the time of a process kill no?

Also there is no message and timer option as far as i can see.
0
 
LVL 17

Expert Comment

by:Tony Massa
ID: 33569251
This may help, but it doesn't identify the user.  Perhaps if it's run under the user context (at logon), they may only be able to see their own processes.  You may also have to tweak the timing of the POPUP box and Script sleeping
strComputer = "."



On Error Resume Next

strPopUpText = "To improve server performance we need to close your session" & _

	vbCRLF & vbCRLF & "Please save your work NOW.  Your session will automatically terminate in 3 minutes"

strPopUpTimeout = "180" 'Timeout in seconds

strPopUpTitle = "Application Restart Required"



	Set objShell = CreateObject("WScript.Shell")

	Set objFSO = CreateObject("Scripting.FileSystemObject")



	Set objWMIService = GetObject("winmgmts:" _

    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")



Do Until x = 2

	Set colProcessList = objWMIService.ExecQuery _

    ("Select * from Win32_Process Where Name = 'iexplore.exe' AND workingSetSize > 500000")



	For Each objProcess in colProcessList

			objShell.Popup strPopUpText, strPopupTimeout, strPopUpTitle

			objProcess.Terminate

	Next

	WScript.Sleep(300000) 'Five minute wait to try again

Loop

Open in new window

0
 
LVL 17

Expert Comment

by:Tony Massa
ID: 33569261
My script would kill any iexplore.exe session over 500000 kb
0
 
LVL 2

Author Comment

by:alexr54
ID: 33569280
     Set colProcessList = objWMIService.ExecQuery _
    ("Select * from Win32_Process Where Name = 'iexplore.exe' AND workingSetSize > 500000")

Is where i can set the memory usage interval?

0
 
LVL 2

Author Comment

by:alexr54
ID: 33569310
Thanks, this looks good. I will try it out.
0
 
LVL 2

Author Comment

by:alexr54
ID: 33569358
It looks like it terminates right away, when the OK button is pushed.
0
 
LVL 2

Author Comment

by:alexr54
ID: 33569423
Also when first run, it terminates the process regardless of mem usage
0
 
LVL 17

Expert Comment

by:Tony Massa
ID: 33569654
Line 17 should read:

("Select * from Win32_Process Where Name = 'iexplore.exe' AND workingSetSize > 512000000")

when divided by 1024, that would get 500,000 kb
0
 
LVL 68

Expert Comment

by:Qlemo
ID: 33569681
This would be the batch file running on the console (admin) session endlessly, checking for iexplore and size of 700MB.
@echo off

setlocal EnableDelayedExpansion



:endless

for /F "tokens=1,2,4,5 delims=," %%A in ('tasklist /fi "memusage gt 700000" /fi "imagename eq iexplore.exe" /nh /fo csv ^| find /V "INFORMATION:"') do (

  echo,Process %%A with PID %%B in session %%C uses %%D memory

  msg %%C /time:300 /w Your app will close due to high memory usage in 3 minutes, please save all your work

  taskkill /PID %%B /f

)

REM wait 300 sec.

choice /T 300 /C CA /D C /M "Continue or Abort"

goto endless

Open in new window

0
 
LVL 17

Expert Comment

by:Tony Massa
ID: 33569689
and before objProcess.Terminate, add a new line with:

wscript.sleep(180000) to force 3 minutes.
0
Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

 
LVL 2

Author Comment

by:alexr54
ID: 33569750
tmassa99,

Do you know how i can remove the "OK" button from the popup? When pushed it triggers the closure to be immediate.
0
 
LVL 17

Expert Comment

by:Tony Massa
ID: 33569794
Qlemo -
Can that run under the system account, or would an admin have to log on to run it?  If a user acknowledges the message, will the taskkill process be initiated immediately?  My popup box was similar, in that, when acknowledged, the process would be killed immediately without the user having the option of waiting.  You may also need a wait command there as well.

Alex -
The workingsetsize is the amount of memory in bytes.  716800000 = 700,000 KB as seen in task manager.
0
 
LVL 17

Expert Comment

by:Tony Massa
ID: 33569809
Alex - If you add the WScript.Sleep(180000) line before objProcess.Terminiate, it won't kill it immediately.
0
 
LVL 17

Expert Comment

by:Tony Massa
ID: 33569854
Here's the updated script with the forced 3 minute wait.  Just change the workingsetsize number to fit your needs.
strComputer = "."



On Error Resume Next

strPopUpText = "To improve server performance we need to close your session" & _

	vbCRLF & vbCRLF & "Please save your work NOW.  Your session will automatically terminate in 3 minutes"

strPopUpTimeout = "180" 'Timeout in seconds

strPopUpTitle = "Application Restart Required"



	Set objShell = CreateObject("WScript.Shell")

	Set objFSO = CreateObject("Scripting.FileSystemObject")



	Set objWMIService = GetObject("winmgmts:" _

    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")



Do Until x = 2

	Set colProcessList = objWMIService.ExecQuery _

    ("Select * from Win32_Process Where Name = 'iexplore.exe' AND workingSetSize > 716800000")



	For Each objProcess in colProcessList

			objShell.Popup strPopUpText, strPopupTimeout, strPopUpTitle

			WScript.Sleep(180000_

			objProcess.Terminate

	Next

	WScript.Sleep(300000) 'Five minute wait to try again

Loop

Open in new window

0
 
LVL 17

Expert Comment

by:Tony Massa
ID: 33569868
Geez...sorry.  Fix the

WScript.Sleep(180000_

to

WScript.Sleep(180000)
0
 
LVL 2

Author Comment

by:alexr54
ID: 33569894
Thanks, works great!
0
 
LVL 2

Author Comment

by:alexr54
ID: 33570258
oops still a problem.. It dosnt just close my IE it closes every users IE, even if the script is not run on that user account. It closes with no warning message
0
 
LVL 17

Expert Comment

by:Tony Massa
ID: 33570285
In the mean time, try the other solution posted here.

I don't think that WMI exposes the user running the process, but I'll check.
0
 
LVL 17

Accepted Solution

by:
Tony Massa earned 500 total points
ID: 33570539
This checks the user running the script, and if the process iexplore.exe is running as the same user ID, then it will get killed.
strComputer = "."

x = 2



On Error Resume Next



Set WSHNetwork = CreateObject("WScript.Network")

strCurrentUser = WSHNetwork.Username



strPopUpText = "To improve server performance we need to close your session" & _

	vbCRLF & vbCRLF & "Please save your work NOW.  Your session will automatically terminate in 3 minutes"

strPopUpTimeout = "180" 'Timeout in seconds

strPopUpTitle = "Application Restart Required"



	Set objShell = CreateObject("WScript.Shell")

	Set objFSO = CreateObject("Scripting.FileSystemObject")



	Set objWMIService = GetObject("winmgmts:" _

    & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")



Do While x = 2 ' This will run forever

	Set colProcessList = objWMIService.ExecQuery _

    ("Select * from Win32_Process Where Name = 'iexplore.exe' AND workingSetSize > 716800000")



	For Each objProcess in colProcessList

			colProperties = objProcess.GetOwner(strUser,strDomain)

			If strUser = strCurrentUser Then

				objShell.Popup strPopUpText, strPopupTimeout, strPopUpTitle

				WScript.Sleep(180000)

				objProcess.Terminate

			End If

	Next

	WScript.Sleep(300000) 'Five minute wait to try again

Loop

Open in new window

0
 
LVL 68

Expert Comment

by:Qlemo
ID: 33572030
Here the batch version which will always wait 180 sec. before killing. The wait & kill is running in a separate task, so if more than one process is to kill, they are processed as quick as possible.
@echo off

setlocal EnableDelayedExpansion



:endless

for /F "tokens=1,2,4,5 delims=," %%A in ('tasklist /fi "memusage gt 700000" /fi "imagename eq iexplore.exe" /nh /fo csv ^| find /V "INFORMATION:"') do (

  echo,Process %%A with PID %%B in session %%C uses %%D memory

  msg %%C Your app will close due to high memory usage in 3 minutes, please save all your work

  start /min "Killing %%A (%%B)" choice /T 180 /C N /D N /M "Wait ..." & taskkill /PID %%B /f

)

REM wait 300 sec.

choice /T 300 /C CA /D C /M "Continue or Abort"

goto endless

Open in new window

0
 
LVL 68

Expert Comment

by:Qlemo
ID: 33613677
Any results yet?
0
 
LVL 2

Author Comment

by:alexr54
ID: 33619237
Yes tmassa99 solution did the trick.

Thanks so much
0

Featured Post

Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

Join & Write a Comment

Batch, VBS, and scripts in general are incredibly useful for repetitive tasks.  Some tasks can take a while to complete and it can be annoying to check back only to discover that your script finished 5 minutes ago.  Some scripts may complete nearly …
Use this article to create a batch file to backup a Microsoft SQL Server database to a Windows folder.  The folder can be on the local hard drive or on a network share.  This batch file will query the SQL server to get the current date & time and wi…
Learn the basics of if, else, and elif statements in Python 2.7. Use "if" statements to test a specified condition.: The structure of an if statement is as follows: (CODE) Use "else" statements to allow the execution of an alternative, if the …
The viewer will learn how to create and use a small PHP class to apply a watermark to an image. This video shows the viewer the setup for the PHP watermark as well as important coding language. Continue to Part 2 to learn the core code used in creat…

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now