Solved

How to Collect the Task Manager logs for some Period of Time?

Posted on 2016-08-25
6
29 Views
Last Modified: 2016-10-03
Hi there,

   Is there any way we can collect the data of Task Manager (Applications & Processes details) for a specific period of time?

   This main need is to capture the processes details which includes processes name and Process ID(PID) for specific time period in order to solve some issue in SQL server which has given only the clue of Process ID.

Thanks
Deepak
0
Comment
Question by:Deepak Kumar
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
6 Comments
 
LVL 3

Expert Comment

by:Ganga Sagar
ID: 41771328
0
 
LVL 12

Expert Comment

by:Benjamin Voglar
ID: 41771588
The best tool to monitor processes is "Process Monitor" wrote by Mark Russinovich.

It's a free tool.

https://technet.microsoft.com/en-us/sysinternals/processmonitor.aspx

You can use Process Explorer:

https://technet.microsoft.com/en-us/sysinternals/processexplorer.aspx

This is 10-time beater version of Task Manager.
0
 
LVL 54

Accepted Solution

by:
Joe Winograd, EE MVE earned 500 total points (awarded by participants)
ID: 41771977
You could use the TASKLIST command, redirect the output to a CSV file, and then analyze it in Excel. Here's its syntax (which you can get via tasklist /?):

TASKLIST [/S system [/U username [/P [password]]]]
         [/M [module] | /SVC | /V] [/FI filter] [/FO format] [/NH]

Description:
    This tool displays a list of currently running processes on
    either a local or remote machine.

Parameter List:
   /S     system           Specifies the remote system to connect to.

   /U     [domain\]user    Specifies the user context under which
                           the command should execute.

   /P     [password]       Specifies the password for the given
                           user context. Prompts for input if omitted.

   /M     [module]         Lists all tasks currently using the given
                           exe/dll name. If the module name is not
                           specified all loaded modules are displayed.

   /SVC                    Displays services hosted in each process.

   /V                      Displays verbose task information.

   /FI    filter           Displays a set of tasks that match a
                           given criteria specified by the filter.

   /FO    format           Specifies the output format.
                           Valid values: "TABLE", "LIST", "CSV".

   /NH                     Specifies that the "Column Header" should
                           not be displayed in the output.
                           Valid only for "TABLE" and "CSV" formats.

   /?                      Displays this help message.

Filters:
    Filter Name     Valid Operators           Valid Value(s)
    -----------     ---------------           --------------------------
    STATUS          eq, ne                    RUNNING |
                                              NOT RESPONDING | UNKNOWN
    IMAGENAME       eq, ne                    Image name
    PID             eq, ne, gt, lt, ge, le    PID value
    SESSION         eq, ne, gt, lt, ge, le    Session number
    SESSIONNAME     eq, ne                    Session name
    CPUTIME         eq, ne, gt, lt, ge, le    CPU time in the format
                                              of hh:mm:ss.
                                              hh - hours,
                                              mm - minutes, ss - seconds
    MEMUSAGE        eq, ne, gt, lt, ge, le    Memory usage in KB
    USERNAME        eq, ne                    User name in [domain\]user
                                              format
    SERVICES        eq, ne                    Service name
    WINDOWTITLE     eq, ne                    Window title
    MODULES         eq, ne                    DLL name

NOTE: "WINDOWTITLE" and "STATUS" filters are not supported when querying
      a remote machine.

Examples:
    TASKLIST
    TASKLIST /M
    TASKLIST /V /FO CSV
    TASKLIST /SVC /FO LIST
    TASKLIST /M wbem*
    TASKLIST /S system /FO LIST
    TASKLIST /S system /U domain\username /FO CSV /NH
    TASKLIST /S system /U username /P password /FO TABLE /NH
    TASKLIST /FI "USERNAME ne NT AUTHORITY\SYSTEM" /FI "STATUS eq running"

Open in new window

So you could do something like this:

tasklist /fo>taskmanagerdata.csv

Open in new window

It creates these columns:

"Image Name","PID","Session Name","Session#","Mem Usage"

To have it run for a specific period of time, set up a task in the Task Scheduler. Regards, Joe
1
Online Training Solution

Drastically shorten your training time with WalkMe's advanced online training solution that Guides your trainees to action. Forget about retraining and skyrocket knowledge retention rates.

 

Author Comment

by:Deepak Kumar
ID: 41774338
Hi Joe,

   Thank you very much for your reply .

As you stated, I have ran the command as "tasklist /fo>taskmanagerdata.csv". I got an error something like this
ERROR: Invalid syntax. Value expected for '/fo'
Type "TASKLIST /?" for usage.

could you help me out on this ?

Thanks in advance!!

Regards
Mohan
0
 
LVL 54

Assisted Solution

by:Joe Winograd, EE MVE
Joe Winograd, EE MVE earned 500 total points (awarded by participants)
ID: 41774759
Hi Mohan,
My error — sorry about that! You need to specify the format after the fo option (table or list or csv). So the correct syntax is:

tasklist /fo csv>taskmanagerdata.csv

Open in new window

You should get a spreadsheet that looks like this (I bolded the heading in Excel and then sorted ascending by PID):

tasklist output
Then, of course, schedule it via the Task Scheduler. Regards, Joe
0
 
LVL 54

Expert Comment

by:Joe Winograd, EE MVE
ID: 41825990
Accepting the post that the asker had already endorsed, along with the follow-up post that corrected a typo.
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Possible fixes for Windows 7 and Windows Server 2008 updating problem. Solutions mentioned are from Microsoft themselves. I started a case with them from our Microsoft Silver Partner option to open a case and get direct support from Microsoft. If s…
The Windows functions GetTickCount and timeGetTime retrieve the number of milliseconds since the system was started. However, the value is stored in a DWORD, which means that it wraps around to zero every 49.7 days. This article shows how to solve t…
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…
This is used to tweak the memory usage for your computer, it is used for servers more so than workstations but just be careful editing registry settings as it may cause irreversible results. I hold no responsibility for anything you do to the regist…

734 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question