Task Manager

The Task Manager is one tool you're bound to frequent, perhaps more than any other. Whenever an application crashes, you believe you're running some suspect process that you want to kill, or you want to check on the state of system resources (for example, RAM usage), you can use the Task Manager. Even as nothing more than an educational tool, the Task Manager is informative.

The Task Manager is always available, with a simple press of the "three-finger salute" (Ctrl+Alt+Del), and up pops the Task Manager (see Figure 27.17). Note that this is different from Windows NT and Windows 2000 where the Windows Security dialog box appeared following this keystroke pattern. You can also launch the Task Manager by pressing Ctrl+Shift+Esc or right-clicking over an empty area on the Taskbar and selecting Task Manager from the pop-up menu.

Figure 27.17. The Task Manager shows you which applications and processes are running and lets you terminate hung programs. It also indicates some important aspects of system performance.

The Task Manager of Windows XP has five tabs, two more than that of Windows NT and Windows 2000. Plus, there is a new menuShut Down. The Shut Down menu performs many of the same operations that the Windows Security dialog box performed under Windows NT/2000 when you pressed Ctrl+Alt+Del. This menu offers quick access to Stand By, Hibernate, Turn Off, Restart, Log Off current user, and Switch User. You'll note that all of these functions can also be accessed through the Start menu's Log Off and Turn Off Computer commands.

The other menus of File, Options, View, Windows, and Help all contain the items you've become accustomed to. These menus are somewhat context sensitive, meaning they have different elements depending on which tab is selected. You are smart enough to figure out what most of these commands do, so take the time to explore each menu from each tab. However, I will point out a few interesting commands when appropriate.

Applications Tab

You can click the Applications tab of the Task Manager to see a list of the programs currently running on the computer. Not a lot of information is displayed, only the application name and the status (running or not responding). However, this tab does provide a more complete report than you'll get by glancing at the taskbar buttons or via the dialog box you see if you press Alt+Tab.

You can sort the list by clicking the column heads. If an application has multiple documents open, the application appears only once in the list, probably with the name of the document that is foremost at the time (has the focus). Some applications don't comply with this single-document interface (SDI) approach, listing each new document as a separate application. Some examples of non-SDI applications are MS Office programs such as Word, Excel, and PowerPoint.

From this list, you can kill a hung application. If an application has hung, it is probably reported in the list as Not responding (although this is not always true). Click the End Task button to terminate the task. If a document is open and unsaved, and if, for some unexpected reason, the program responds gracefully to Windows's attempt to shut it down (which is unlikely), you might see a dialog asking whether you want to save. More likely, Windows XP will just ask for confirmation to kill the application.

If you have killed applications and they still appear in the Applications tab listing, see "The Task Manager Is Stalled" in the "Troubleshooting" section at the end of this chapter.

TIP

Before you give an application its last rites, pause for a bit. In general, it's not a good idea to kill an application if you can avoid doing so. Terminating an application can cause instability in the operating system (even though it shouldn't in most cases because of the kernel design). Or at the least, you can lose data. Try "jiggling" the application in various ways, in hopes of being able to close it gracefully first. Switch to it and back a few times. Give it a little time. Maybe even do some work in another application for a few minutes, or take a trip to the water cooler. Try pressing Esc while the application is open.

When executing some macros in Word, for example, I noticed that one of my macros hangs for no apparent reason. It seems to crash Word. So, I killed it from the Task Manager, losing some work. I later realized the solution was to press Esc, which terminated the macro. Having slow network connections and attempting to link to nonexistent Web pages, printers, or removable media can also cause apparent hangs. Try opening a drive door, removing a network cable, or performing some other trick to break a loop a program might be in before resorting to killing the program from the Task Manager. This is especially true if you've been working on a document and you might potentially lose data.

Some applications will so intensely perform calculations that the Task Manager will list them as Not Responding. If you suspect this, give the program five minutes or so to complete its thinking, I've learned the hard way to be patient with some applications.

Dr. Watson, Come Quick!

You might want to know about a debugging program called Dr. Watson which is supplied with Windows XP. It's primarily designed for programmers or for technical support people who might be helping you resolve a software conflict on the workstation. The program sits in memory, keeping an eagle eye on applications as they run. If one bombs or breaches security, Windows XP shuts down the errant program, and Dr. Watson creates an entry in a special log file named Drwtsn32.log found in the \Documents and Settings\All Users\Application Data\Microsoft\Dr Watson folder by default. The entry contains key information about what the application did wrong, and some other details of your computer's operation at the time of the error. If you are getting application crashes on a specific program, you can contact the vendor and ask whether the tech support people want to see the log. To start the Dr. Watson program to set up preferences, you can choose Start, Run, and enter drwtsn32. The default settings are fine under most circumstances.

Incidentally, two Dr. Watson programs are actually included with Windows XP. You'll find both 32-bit and 16-bit versions for the corresponding Windows applications. The programs are named drwtsn32.exe (for 32-bit programs) and drwatson.exe (for 16-bit programs).

By default, drwtsn32.exe creates a Crash Dump file for each error that is generated. It is a binary file that can be opened and examined in a debugger program. These files can be quite large, however. They take up space on your disk and cause a bit of a system slowdown while writing the files to disk. The last time I checked one of these files on one of my machines, it was 45MB. If you don't expect to be debugging a program, you can turn off this feature by running drwtsn32.exe and turning off the Create Crash Dump File option.

Notice that you can also switch to an application in the list or run a new one. Just double-click the application you want to switch to (or click Switch To). Similarly, to run a new application, click New Task, and enter the executable name or use the Browse dialog box to find it. This dialog is no different from the Start, Run dialog box, even though its name is different.

If you're frustrated because you cannot send the Task Manager to the background, see "Sending the Task Manager to the Background" in the "Troubleshooting" section at the end of this chapter.

Processes Tab

Whereas the Application tab displays only the full-fledged applications you're running, the Processes tab shows all running processes, including programs (for example, Photoshop), services (for example, Event Log), or subsystems (for example, wowexec.exe for running Windows 3.x applications). In addition to just listing active processes, Windows XP displays the user or security context (that is, the user, service, or system object under which the process is executing) for each processa great new feature not present in previous OSes. Also by default, the percentage of CPU utilization and memory utilization in bytes is listed. You can change the displayed information through the View, Columns command.

Almost any listed process can be terminated by selecting it and then clicking the End Process button. There are some system-level processes which even you as administrator don't have sufficient privileges to kill. You might also discover at times that an application will fail to be killed, typically due to a programming error or a memory glitch. In those cases, you should reboot the system. You might find that sometimes a hung application also will prevent a normal shutdown. If your attempt to reboot fails, you'll have to resort to manually turning the power off and then back on. Hopefully, you saved often and didn't lose too much work.

TIP

At the bottom of the Processes tab is a check box labeled Show processes from all users. If you've switched users, you can see not just the processes under your user account and those of the system, but also those of other active users. Plus, once displayed, you can also terminate them using the End Process button.

By studying the entries in the process list, you can learn some interesting facts about the operating system. For starters, you might be shocked to see just how many separate processes the operating system has to multitask just to keep going (see Figure 27.18). Notice that the highlighted process is ntvdm (NT Virtual DOS Machine); also, notice that wowexec.exe is running in it and is indented a bit (it appears just above ntvdm). The processes running along with the wowexec (three instances of Alarm, listed below wowexec) are also indented. All Windows 3.x processes run in the same VDM (by default), with wowexec.exe (WOW means "Windows on Windows") being the process that emulates Windows 3.x. Terminating the ntvdm or wowexec process will terminate all three Windows 3.x applications.

Figure 27.18. Examining running processes. Notice the wowexec.exe process, which is the Windows 3.x subsystem, and the three Windows 3.x programs.

For more details on managing DOS and Windows 3.x environments, please jump to Chapter 25, "Maintaining and Optimizing System Performance."

If the true identity of some of the processes is something you're dedicated to uncovering, check the Services snap-in described later in this chapter. Many of the entries in the processes list are system services, the bulk of which load during bootup.

Altering the Priority of a Task

In the beginning, all tasks are created equal. Well, most of them, at least. All of the processes under your user account's security context will have Normal priority by default. Most kernel or system processes will have High priority. You might want to increase or decrease the priority of a process, though changing the priority typically isn't necessary. To do so, right-click the task and choose the new priority through the Set Priority sub-menu.

Avoid altering the priority of any task listed with a username of SYSTEM. This indicates the process is in use by the kernel. Altering the execution priority of such processes can render your system nonfunctional. Fortunately, process priority settings are not preserved across a reboot, so if you do change something and the system stops responding, you can reboot and return to normal. In some cases, raising the priority of an application can improve its performance. However, increase the priority in single steps instead of automatically setting it to the maximum. Throwing another top-priority application into the mix of kernel-level activities can render the system dead too.

There are six priority levels you can assign to processes: Realtime, High, AboveNormal, Normal, BelowNormal, and Low. Realtime is restricted for use by administrators. You should keep away from High since it can interfere with essential OS operations (especially if you have several user processes set to High). More details about process priorities is discussed in Chapter 25, "Maintaining and Optimizing System Performance."

TIP

If you have a multiprocessor computer, and you want to assign a task to a given processor, right-click the process and choose the Set Affinity command. Choosing this command guarantees that the process receives CPU time only from the CPU you choose.

Performance Tab

The Performance tab of the Task Manager indicates important conditions of your operating system. It shows a dynamic overview of your computer's performance, including CPU usage; memory usage; and totals of handles, threads, and processes (see Figure 27.19).

Figure 27.19. The Performance tab displays some interesting statistics and a chart of CPU and page file usage over time.

From the Performance tab, the View menu includes CPU History and Show Kernel Times. The former command is used to show different graphs for each CPU (only useful on multiple CPU systems). The latter command sets the display to show kernel activity in red and user activity in green on the CPU and Page file usage graphs. You should also notice that paging file usage is shown instead of memory usage.

Although CPU usage is interesting, the most important of these numbers is memory usage. You can easily check in the Physical Memory area to see how much memory is installed in your system, how much is available for use by applications before disk caching begins, and how much the system is using for caching.

NOTE

System cache is the total current swap and RAM area allocated for system operations. When your computer has to go to a disk cache to access information it significantly slows down overall system performance, which is why having more system RAM is almost always better.

The Kernel Memory area reports the memory in use strictly by the operating system for running the operating system internals. Nonpaged kernel memory is available only to the operating system. This memory is in physical RAM and can't be paged out to the hard disk because the operating system always needs fast access to it, and it needs to be highly protected. Paged memory can be used by other programs when necessary. Commit memory is memory allocated to programs and the system. Because virtual memory increases the amount of actual memory available, the Commit Peak memory can exceed the maximum physical memory.

In the Totals section, you can see the number of handles, threads, and processes. Threads are discussed in more detail in Chapter 2. Handles are tokens or pointers that let the operating system uniquely identify a resource, such as a file or Registry key, so that a program can access it.

Most of these size reports are of use only to programmers. However, the charts can offer strong, telltale signs of system overstressing. If you see, for example, that your page file usage is consistently nearing the top of its range, you are running too many programs. If the CPU is topped out most of the time, you also could be in trouble. Perhaps you have a background task running that is consuming way too much CPU time. An example could be a background program doing statistical analysis or data gathering.

TIP

When the Task Manager is running, even if minimized, a green box appears in the system tray, indicating CPU usage. It's a miniature bar graph.

Networking Tab

The Networking tab (see Figure 27.20) displays a bandwidth consumption history graph. As network operations occur, this graph will plot the levels of usage. The View menu includes a Network Adapter History submenu. This submenu offers the ability to include bytes sent (red), bytes received (yellow), and bytes total (green) on the graph (shown by default). At the bottom of this tab, a list of all network connections along with details is displayed. The Columns command from the View menu is used to add or remove data columns from this display. This tab can give you a quick heads up if you suspect a network slowdown.

Figure 27.20. The Networking tab shows network traffic activity.

Users Tab

The Users tab shows a list of all active users on this system or connected via the network. From here you can disconnect a network user, log a local user off, or send a user a text message. The Users tab will only be visible if you are not participating in a Windows 2000/Windows Server 2003 Active Directorybased network, or have not disabled Fast User Switching if participating in a workgroup.