Solved

How to Collect the Task Manager logs for some Period of Time?

Posted on 2016-08-25
6
30 Views
Last Modified: 2016-10-03
Hi there,

   Is there any way we can collect the data of Task Manager (Applications & Processes details) for a specific period of time?

   This main need is to capture the processes details which includes processes name and Process ID(PID) for specific time period in order to solve some issue in SQL server which has given only the clue of Process ID.

Thanks
Deepak
0
Comment
Question by:Deepak Kumar
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
6 Comments
 
LVL 3

Expert Comment

by:Ganga Sagar
ID: 41771328
0
 
LVL 12

Expert Comment

by:Benjamin Voglar
ID: 41771588
The best tool to monitor processes is "Process Monitor" wrote by Mark Russinovich.

It's a free tool.

https://technet.microsoft.com/en-us/sysinternals/processmonitor.aspx

You can use Process Explorer:

https://technet.microsoft.com/en-us/sysinternals/processexplorer.aspx

This is 10-time beater version of Task Manager.
0
 
LVL 54

Accepted Solution

by:
Joe Winograd, EE MVE 2015&2016 earned 500 total points (awarded by participants)
ID: 41771977
You could use the TASKLIST command, redirect the output to a CSV file, and then analyze it in Excel. Here's its syntax (which you can get via tasklist /?):

TASKLIST [/S system [/U username [/P [password]]]]
         [/M [module] | /SVC | /V] [/FI filter] [/FO format] [/NH]

Description:
    This tool displays a list of currently running processes on
    either a local or remote machine.

Parameter List:
   /S     system           Specifies the remote system to connect to.

   /U     [domain\]user    Specifies the user context under which
                           the command should execute.

   /P     [password]       Specifies the password for the given
                           user context. Prompts for input if omitted.

   /M     [module]         Lists all tasks currently using the given
                           exe/dll name. If the module name is not
                           specified all loaded modules are displayed.

   /SVC                    Displays services hosted in each process.

   /V                      Displays verbose task information.

   /FI    filter           Displays a set of tasks that match a
                           given criteria specified by the filter.

   /FO    format           Specifies the output format.
                           Valid values: "TABLE", "LIST", "CSV".

   /NH                     Specifies that the "Column Header" should
                           not be displayed in the output.
                           Valid only for "TABLE" and "CSV" formats.

   /?                      Displays this help message.

Filters:
    Filter Name     Valid Operators           Valid Value(s)
    -----------     ---------------           --------------------------
    STATUS          eq, ne                    RUNNING |
                                              NOT RESPONDING | UNKNOWN
    IMAGENAME       eq, ne                    Image name
    PID             eq, ne, gt, lt, ge, le    PID value
    SESSION         eq, ne, gt, lt, ge, le    Session number
    SESSIONNAME     eq, ne                    Session name
    CPUTIME         eq, ne, gt, lt, ge, le    CPU time in the format
                                              of hh:mm:ss.
                                              hh - hours,
                                              mm - minutes, ss - seconds
    MEMUSAGE        eq, ne, gt, lt, ge, le    Memory usage in KB
    USERNAME        eq, ne                    User name in [domain\]user
                                              format
    SERVICES        eq, ne                    Service name
    WINDOWTITLE     eq, ne                    Window title
    MODULES         eq, ne                    DLL name

NOTE: "WINDOWTITLE" and "STATUS" filters are not supported when querying
      a remote machine.

Examples:
    TASKLIST
    TASKLIST /M
    TASKLIST /V /FO CSV
    TASKLIST /SVC /FO LIST
    TASKLIST /M wbem*
    TASKLIST /S system /FO LIST
    TASKLIST /S system /U domain\username /FO CSV /NH
    TASKLIST /S system /U username /P password /FO TABLE /NH
    TASKLIST /FI "USERNAME ne NT AUTHORITY\SYSTEM" /FI "STATUS eq running"

Open in new window

So you could do something like this:

tasklist /fo>taskmanagerdata.csv

Open in new window

It creates these columns:

"Image Name","PID","Session Name","Session#","Mem Usage"

To have it run for a specific period of time, set up a task in the Task Scheduler. Regards, Joe
1
Get 15 Days FREE Full-Featured Trial

Benefit from a mission critical IT monitoring with Monitis Premium or get it FREE for your entry level monitoring needs.
-Over 200,000 users
-More than 300,000 websites monitored
-Used in 197 countries
-Recommended by 98% of users

 

Author Comment

by:Deepak Kumar
ID: 41774338
Hi Joe,

   Thank you very much for your reply .

As you stated, I have ran the command as "tasklist /fo>taskmanagerdata.csv". I got an error something like this
ERROR: Invalid syntax. Value expected for '/fo'
Type "TASKLIST /?" for usage.

could you help me out on this ?

Thanks in advance!!

Regards
Mohan
0
 
LVL 54

Assisted Solution

by:Joe Winograd, EE MVE 2015&2016
Joe Winograd, EE MVE 2015&2016 earned 500 total points (awarded by participants)
ID: 41774759
Hi Mohan,
My error — sorry about that! You need to specify the format after the fo option (table or list or csv). So the correct syntax is:

tasklist /fo csv>taskmanagerdata.csv

Open in new window

You should get a spreadsheet that looks like this (I bolded the heading in Excel and then sorted ascending by PID):

tasklist output
Then, of course, schedule it via the Task Scheduler. Regards, Joe
0
 
LVL 54

Expert Comment

by:Joe Winograd, EE MVE 2015&2016
ID: 41825990
Accepting the post that the asker had already endorsed, along with the follow-up post that corrected a typo.
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article helps those who get the 0xc004d307 error when trying to rearm (reset the license) Office 2013 in a Virtual Desktop Infrastructure (VDI) and/or those trying to prep the master image for Microsoft Key Management (KMS) activation. (i.e.- C…
An introduction to the wonderful sport of Scam Baiting.  Learn how to help fight scammers by beating them at their own game. This great pass time helps the world, while providing an endless source of entertainment. Enjoy!
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
Finding and deleting duplicate (picture) files can be a time consuming task. My wife and I, our three kids and their families all share one dilemma: Managing our pictures. Between desktops, laptops, phones, tablets, and cameras; over the last decade…

691 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question