Solved

How to Collect the Task Manager logs for some Period of Time?

Posted on 2016-08-25
6
27 Views
Last Modified: 2016-10-03
Hi there,

   Is there any way we can collect the data of Task Manager (Applications & Processes details) for a specific period of time?

   This main need is to capture the processes details which includes processes name and Process ID(PID) for specific time period in order to solve some issue in SQL server which has given only the clue of Process ID.

Thanks
Deepak
0
Comment
Question by:Deepak Kumar
6 Comments
 
LVL 3

Expert Comment

by:Ganga Sagar
ID: 41771328
0
 
LVL 12

Expert Comment

by:Benjamin Voglar
ID: 41771588
The best tool to monitor processes is "Process Monitor" wrote by Mark Russinovich.

It's a free tool.

https://technet.microsoft.com/en-us/sysinternals/processmonitor.aspx

You can use Process Explorer:

https://technet.microsoft.com/en-us/sysinternals/processexplorer.aspx

This is 10-time beater version of Task Manager.
0
 
LVL 53

Accepted Solution

by:
Joe Winograd, EE MVE earned 500 total points (awarded by participants)
ID: 41771977
You could use the TASKLIST command, redirect the output to a CSV file, and then analyze it in Excel. Here's its syntax (which you can get via tasklist /?):

TASKLIST [/S system [/U username [/P [password]]]]
         [/M [module] | /SVC | /V] [/FI filter] [/FO format] [/NH]

Description:
    This tool displays a list of currently running processes on
    either a local or remote machine.

Parameter List:
   /S     system           Specifies the remote system to connect to.

   /U     [domain\]user    Specifies the user context under which
                           the command should execute.

   /P     [password]       Specifies the password for the given
                           user context. Prompts for input if omitted.

   /M     [module]         Lists all tasks currently using the given
                           exe/dll name. If the module name is not
                           specified all loaded modules are displayed.

   /SVC                    Displays services hosted in each process.

   /V                      Displays verbose task information.

   /FI    filter           Displays a set of tasks that match a
                           given criteria specified by the filter.

   /FO    format           Specifies the output format.
                           Valid values: "TABLE", "LIST", "CSV".

   /NH                     Specifies that the "Column Header" should
                           not be displayed in the output.
                           Valid only for "TABLE" and "CSV" formats.

   /?                      Displays this help message.

Filters:
    Filter Name     Valid Operators           Valid Value(s)
    -----------     ---------------           --------------------------
    STATUS          eq, ne                    RUNNING |
                                              NOT RESPONDING | UNKNOWN
    IMAGENAME       eq, ne                    Image name
    PID             eq, ne, gt, lt, ge, le    PID value
    SESSION         eq, ne, gt, lt, ge, le    Session number
    SESSIONNAME     eq, ne                    Session name
    CPUTIME         eq, ne, gt, lt, ge, le    CPU time in the format
                                              of hh:mm:ss.
                                              hh - hours,
                                              mm - minutes, ss - seconds
    MEMUSAGE        eq, ne, gt, lt, ge, le    Memory usage in KB
    USERNAME        eq, ne                    User name in [domain\]user
                                              format
    SERVICES        eq, ne                    Service name
    WINDOWTITLE     eq, ne                    Window title
    MODULES         eq, ne                    DLL name

NOTE: "WINDOWTITLE" and "STATUS" filters are not supported when querying
      a remote machine.

Examples:
    TASKLIST
    TASKLIST /M
    TASKLIST /V /FO CSV
    TASKLIST /SVC /FO LIST
    TASKLIST /M wbem*
    TASKLIST /S system /FO LIST
    TASKLIST /S system /U domain\username /FO CSV /NH
    TASKLIST /S system /U username /P password /FO TABLE /NH
    TASKLIST /FI "USERNAME ne NT AUTHORITY\SYSTEM" /FI "STATUS eq running"

Open in new window

So you could do something like this:

tasklist /fo>taskmanagerdata.csv

Open in new window

It creates these columns:

"Image Name","PID","Session Name","Session#","Mem Usage"

To have it run for a specific period of time, set up a task in the Task Scheduler. Regards, Joe
1
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Author Comment

by:Deepak Kumar
ID: 41774338
Hi Joe,

   Thank you very much for your reply .

As you stated, I have ran the command as "tasklist /fo>taskmanagerdata.csv". I got an error something like this
ERROR: Invalid syntax. Value expected for '/fo'
Type "TASKLIST /?" for usage.

could you help me out on this ?

Thanks in advance!!

Regards
Mohan
0
 
LVL 53

Assisted Solution

by:Joe Winograd, EE MVE
Joe Winograd, EE MVE earned 500 total points (awarded by participants)
ID: 41774759
Hi Mohan,
My error — sorry about that! You need to specify the format after the fo option (table or list or csv). So the correct syntax is:

tasklist /fo csv>taskmanagerdata.csv

Open in new window

You should get a spreadsheet that looks like this (I bolded the heading in Excel and then sorted ascending by PID):

tasklist output
Then, of course, schedule it via the Task Scheduler. Regards, Joe
0
 
LVL 53

Expert Comment

by:Joe Winograd, EE MVE
ID: 41825990
Accepting the post that the asker had already endorsed, along with the follow-up post that corrected a typo.
0

Featured Post

Building an interactive eFuture classroom

Watch and learn how ATEN provided a total control system solution including seamless switching matrix switch, HDBaseT extenders, PDU, lighting control to build an interactive eFuture classroom.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When you try to extract and to view the contents of a Microsoft Update Standalone Package (MSU) for Windows Vista, you cannot extract the files from the MSU. Here we are going to explain how to extract those hotfix details without using any third pa…
This article summaries thoughts and ideas from two years of sustained use. It provides good reasoning to make the jump to Windows 10.
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
The Task Scheduler is a powerful tool that is built into Windows. It allows you to schedule tasks (actions) on a recurring basis, such as hourly, daily, weekly, monthly, at log on, at startup, on idle, etc. This video Micro Tutorial is a brief intro…

685 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question