Introduction
| Processes are a fundamental component of the Windows operating system. Anything you do on a system, whether it is deleting a file, starting a service, or writing text in Notepad, has a process behind it. Since processes are so important, it is critical that administrators understand how to manage, monitor, and troubleshoot them. Processes use system resources, such as CPU and memory, in order to run. But not all processes are created equal. Some use more resources than others and often you'll run into situations where you need to identify processes that are using more resources than they should, which may make it difficult for other processes to do work. Processes also frequently open files, DLLs, and Registry keys and values. These resources are known as handles and often when a process has one open, no other process can modify or delete the resource. This can make it problematic if you need, for example, to rename a file that a process has locked. In Appendix E, I include a list of the default processes used in Windows. There are several processes that start by default whenever a Windows server boots. Any applications you've installed that run at system startup will also have one or more processes running, all without you doing a thing. It is for this reason that you need to be able to create, query, suspend, and terminate processes on demand or else it is very easy for you to lose control over how your system performs. In this chapter, I'll review how to identify process-related issues and cover many of the process-related tasks you should be familiar with. Now you may not need to use some of these tasks, but it is important to understand what is possible so if you run into a certain situation where, for example, you need to suspend a process, you know how to do it. Using a Graphical User InterfaceWhen it comes to the GUI, there are only two tools you need to be familiar with to manage processes. Task Manager (taskmgr.exe) is a native Windows tool that lets you view and kill any running applications or processes, and lets you view the performance of processes including CPU and memory utilization. Task Manager was updated in Windows Server 2003 to include a new Networking tab and Users tab. The Networking tab lets you view the current network activity of the system (although it doesn't show network information by process). The Users tab lets you see which users are currently logged on and lets you disconnect or log them off.
The other tool is Process Explorer (procexp.exe) from Sysinternals, and it is very similar to Task Manager except it provides much more process management functionality. It lets you view all the associated handles and DLLs of a process and even lets you search for specific processes, handles, and DLLs. Neither tool lets you manage processes on a remote server. To do that, you'll need to use one of the available command-line tools, of which there are many. Using a Command-Line InterfaceThere are several process-related command-line tools, many of them from Sysinternals. Windows 2000 didn't provide any good process management utilities natively, but there were a few in the Resource Kit. In Windows XP and Windows Server 2003, Microsoft added the tasklist and taskkill utilities, which are installed with Windows and are very powerful. For advanced process manipulation and query tools, look no farther than Sysinternals. See Table 6-1 for a complete list of command-line tools used in this chapter along with where they can be found and what Recipes they are used in.
Using VBScriptThe Win32_Process WMI class represents individual processes and is the only class I use extensively in this chapter. With it, you can create, terminate, and set the priority of a process. Additionally, you can get very detailed information about each process using the properties of Win32_Process objects. For your convenience, I've included the complete list of methods and properties available with Win32_Process in Table 6-2 and Table 6-3.
Another process-related WMI class that may be of interest to you is Win32_ProcessStartup. While I don't cover it in this book, you may find it useful if you need control over how processes are created. You can pass an instance of the Win32_ProcessStartup class as a parameter when you invoke the Win32_Process.Create method. It allows you to specify various window settings and the priority of the new process. Search for Win32_ProcessStartup at http://msdn.microsoft.com/ for more information. |
EAN: 2147483647
Pages: 380