Solved

Powershell script to kill a process

Posted on 2013-05-14
23
1,496 Views
Last Modified: 2013-11-20
Hi,

We have a program that has an issue that causes it to use 98% of the CPU. The developer of this program has left and we are working with others to try and correct this, but until resolved, does anyone know of a powershell script that could be run that would detect the high cpu usage, determine the PID of the problem process and then kill it specifically.

Thanks
0
Comment
Question by:TyreeSupport
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 11
  • 9
  • 3
23 Comments
 
LVL 42

Expert Comment

by:sedgwick
ID: 39167155
Is it enough to periodacly check this specific program cpu usage and if above xxx% then kill it.
0
 

Author Comment

by:TyreeSupport
ID: 39167172
Hi sedgwick,

Yes I was assuming that I would run the script via task scheduler every 15 min.
0
 
LVL 42

Expert Comment

by:sedgwick
ID: 39167217
change firefox to the process name.
the script kills the process when cpu is over 90,u can change it in the script to whatever u fill like.
the script creates logfile and log details upon every run.

cls
$procname = 'firefox'
$cpu_usage=90
$logfile = 'c:\temp\1.log'
$proc = Get-Process $procname | select cpu,id
"{0} {1} cpu usage: {2}" -f (Get-Date), $procname, $proc.cpu | Out-File -Append $logfile 

if($proc.cpu -gt $cpu_usage){
"killing process" | Out-File -Append $logfile
kill $proc.id 
}

Open in new window


save the script as xxx.ps1 and run the following command to create task scheduler:
schtasks /create /tn "TaskName" /sc MINUTE /mo 15 /tr "powershell xxx.ps1" 

Open in new window

change TaskName and xxx.ps1 to the full path of the script.
0
Backup Solution for AWS

Read about how CloudBerry Backup fully integrates your backups with Amazon S3 and Amazon Glacier to provide military-grade encryption and dramatically cut storage costs on any platform.

 

Author Comment

by:TyreeSupport
ID: 39167227
just wanted to check and make sure, we run a number of copies of that program on the server, so I think the problem with this script is that it will kill all of them, but we need it to only kill the specific PID of the process that is out of control.
0
 
LVL 42

Expert Comment

by:sedgwick
ID: 39167241
Let me modify the script
0
 
LVL 69

Expert Comment

by:Qlemo
ID: 39167327
Should be easy, we just need a loop:
cls
$procname = 'firefox'
$cpu_usage=90
$logfile = 'c:\temp\1.log'
Get-Process $procname | select cpu,id | % {
  "{0} {1} cpu usage: {2}" -f (Get-Date), $procname, $_.cpu | Out-File -Append $logfile 
  if($_.cpu -gt $cpu_usage)
  {
    "killing process" | Out-File -Append $logfile
     kill $_.id 
  }  
}

Open in new window

BTW, you can also create scripts triggered by Performance counters. That way no periodic check script is needed.
0
 
LVL 42

Expert Comment

by:sedgwick
ID: 39167687
here the script:
cls
$procname = 'firefox'
$cpu_usage=90
$logfile = 'c:\temp\1.log'
Get-Process $procname | select cpu,id | where 
{$_.cpu -gt $cpu_usage} | % {
  "{0} {1} cpu usage: {2}" -f (Get-Date), $procname, $_.cpu | Out-File -Append $logfile 
("killing process {0}" -f $_.id) | Out-File -Append $logfile
     kill $_.id
}

Open in new window

0
 

Author Comment

by:TyreeSupport
ID: 39186485
Hi,

I tried the script when I had the issue and it appeared to recognise the application that was causing the issue, but it asked me (with Yes or No prompt in the shell) to kill all the running version of the app, even thought they were not using high CPU usage.

Any reason why? I am running Powershell 2.0 on Windows 2003.
0
 
LVL 42

Expert Comment

by:sedgwick
ID: 39186514
i changed the script to suppress the confirmation.
cls
$procname = 'firefox'
$cpu_usage=90
$logfile = 'c:\temp\1.log'
Get-Process $procname | select cpu,id | where 
{$_.cpu -gt $cpu_usage} | % {
  "{0} {1} cpu usage: {2}" -f (Get-Date), $procname, $_.cpu | Out-File -Append $logfile 
("killing process {0}" -f $_.id) | Out-File -Append $logfile
     kill $_.id -force
}

Open in new window


also when the issue occur again, prior running the script, open task manager and click Resource Monitor.
look for the PID of the app instances, and locate the one that causes the cpu exception.
now run the script and check in the log that it outputs, which process ID the script killed.
check which process IDs the script kills comparing to what u saw in the Resource Monitor.
screenshot
0
 

Author Comment

by:TyreeSupport
ID: 39206781
Hi,

Sorry been a while since the issue had occurred.

The first script you sent me would work, but the last two give me an error;

cmdlet Where-Object at command pipeline position 3
Supply values for the following parameters:
FilterScript:

Any suggestions as to what is happening?
0
 
LVL 42

Expert Comment

by:sedgwick
ID: 39206783
who do u refer to?
can u post the script which gives the error with line number?
0
 

Author Comment

by:TyreeSupport
ID: 39206790
The script above is what I am running

cls
$procname ='BackflushStation.exe'
$cpu_usage=90
$logfile = 'c:\temp\HighCPU.log'
Get-Process $procname | select cpu,id | where 
{$_.cpu -gt $cpu_usage} | % {
  "{0} {1} cpu usage: {2}" -f (Get-Date), $procname, $_.cpu | Out-File -Append $logfile 
("killing process {0}" -f $_.id) | Out-File -Append $logfile
     kill $_.id 
}

Open in new window

0
 
LVL 42

Expert Comment

by:sedgwick
ID: 39206798
first of all remove .exe from the proc name, the filter works on the name itself without the extension
0
 

Author Comment

by:TyreeSupport
ID: 39206804
I have tried that and I get the same error, sorry I left that on after last edit to see if I could get it going.
0
 
LVL 42

Expert Comment

by:sedgwick
ID: 39206805
can u post the exact error?
which line?
0
 

Author Comment

by:TyreeSupport
ID: 39206806
But if I run the very first script that you sent in ID: 39167327 it runs OK, but wants to kill all process's running not the specific process with the high cpu usage.
0
 
LVL 42

Expert Comment

by:sedgwick
ID: 39206808
the script kills just the process with specific id, which its cpu usage is exceeds the limit.
can u post the error please and the line number?
0
 

Author Comment

by:TyreeSupport
ID: 39206822
Hi,

If I run the script in powershell cli this is the error I get

cmdlet Where-Object at command pipeline position 3
Supply values for the following parameters:
FilterScript:


If I run it in the IDE, A box pops up with the above error and a window asking for the FilterScript parameter as attached.
Error.png
0
 
LVL 42

Expert Comment

by:sedgwick
ID: 39206829
its because the opening curly bracket is in another line, pfffffffft.
here is updated script:
cls
$procname ='BackflushStation.exe'
$cpu_usage=90
$logfile = 'c:\temp\HighCPU.log'
Get-Process $procname | select cpu,id | where {$_.cpu -gt $cpu_usage} | % {
  "{0} {1} cpu usage: {2}" -f (Get-Date), $procname, $_.cpu | Out-File -Append $logfile 
("killing process {0}" -f $_.id) | Out-File -Append $logfile
     kill $_.id 
}

Open in new window

0
 

Author Comment

by:TyreeSupport
ID: 39206838
Sorry to be a pain, that now runs but it still wants to kill all sessions of the process that are running. When I ran it through the IDE each separate running copy of the process asked me did I want to kill it even though when I look in process monitor they are only using 1% or less of the CPU.

Maybe the metric is out because we have cpu usage as 90 in the script but when I open the log, it says they are all over 90. Below is the log file and attached is the process usage when I ran it.

30/05/2013 4:36:19 PM BackflushStation cpu usage: 1493.5
killing process 4340
30/05/2013 4:36:23 PM BackflushStation cpu usage: 454.59375
killing process 4608
30/05/2013 4:36:24 PM BackflushStation cpu usage: 989.9375
killing process 6204
30/05/2013 4:36:25 PM BackflushStation cpu usage: 1420.734375
killing process 9596
30/05/2013 4:36:25 PM BackflushStation cpu usage: 543.625
killing process 13936
30/05/2013 4:36:26 PM BackflushStation cpu usage: 1234.21875
killing process 16968
30/05/2013 4:36:28 PM BackflushStation cpu usage: 469.046875
killing process 20184
30/05/2013 4:36:28 PM BackflushStation cpu usage: 1268.890625
killing process 22512
30/05/2013 4:36:29 PM BackflushStation cpu usage: 1441.09375
killing process 26448
30/05/2013 4:36:30 PM BackflushStation cpu usage: 1133.09375
killing process 27512
30/05/2013 4:36:31 PM BackflushStation cpu usage: 322.46875
killing process 36132
process.png
0
 
LVL 42

Expert Comment

by:sedgwick
ID: 39206994
try this one:
get-wmiobject win32_perfformatteddata_perfproc_process | where{$_.name -eq 'BackflushStation' -and $_.percentprocessortime -gt 90} | %{
"{0} {1} cpu usage: {2}" -f (Get-Date), $procname, $_.percentprocessortime | Out-File -Append $logfile 
("killing process {0}" -f $_.idprocess) | Out-File -Append $logfile
kill $_.idprocess
}

Open in new window

0
 
LVL 69

Accepted Solution

by:
Qlemo earned 500 total points
ID: 39207324
We should have checked that before, but System.Diagnostics.Process (the result of Get-Process) does not provide the CPU utilization. CPU is the same as TotalProcessorTime, and tells us how much time the process has consumed on all processors/cores since started.

Win32_PerfFormattedData_PerfProc_Process seems to be a good choice. However, I prefer to filter on WMI level, if possible. That is important in particular if you run WMI remotely.
Integrated in the script (I've also reintroduced the missing vars ;-), and changed the output slightly to be a single line only):
cls
$procname ='BackflushStation'
$cpu_usage=90
$logfile = 'c:\temp\HighCPU.log'
Get-WmiObject Win32_PerfFormattedData_PerfProc_Process -Filter "Name like '$procname%' and PercentProcessorTime > $cpu_usage" | 
% {
  "{0} - killing process {1} ID {2} cpu usage: {3}" -f (Get-Date), $procname, $_.IDProcess, $_.PercentProcessorTime | Out-File -Append $logfile 
  kill $_.idprocess
}

Open in new window

1
 
LVL 69

Expert Comment

by:Qlemo
ID: 39662683
Why only a "B" grade, after leaving the question open for almost 6 months? Either the code works, and earns an "A", or it does not (and doesn't earn anything), or you were not able to test and need to fall back to either of both dispositions.
Looks like you just wanted to get rid of the question to be able to ask another one.
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Create and license users in Office 365 in bulk based on a CSV file. A step-by-step guide with PowerShell script examples.
A quick Powershell script I wrote to find old program installations and check versions of a specific file across the network.
How to Install VMware Tools in Red Hat Enterprise Linux 6.4 (RHEL 6.4) Step-by-Step Tutorial
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an antispam), the adminiā€¦

730 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question