Monitoring Threads

Microsoft® Windows® 2000 Scripting Guide

« Previous | Next »   

For routine day-to-day monitoring, there is usually little reason to have a detailed list of threads and their associated properties. Computers create and delete thousands of threads during the course of a day, and few of these creations or deletions are meaningful to anyone but the developer who wrote the software.

However, when you are troubleshooting problems with an application, tracking the individual threads for a process allows you to identify when threads are created and when (or if) they are destroyed. Because threads that are created but not destroyed cause memory leaks, tracking individual threads can be useful information for support technicians. Likewise, identifying thread priorities can help pinpoint threads that, by running at an abnormally high priority, are preempting CPU cycles needed by other threads and other processes.

For occasions such as this, you can use the Win32_Thread class to return information about all the threads on a computer. Some of the more useful properties of the Win32_Thread class are shown in Table 14.2.

Table 14.2   Win32_Thread Properties

Property	Description
ElapsedTime	Total execution time, in milliseconds, allotted to this thread since its creation.
Handle	Identifier assigned by the operating system to the thread.
KernelModeTime	Kernel-mode time used by the thread, in 100-nanosecond increments.
Priority	Dynamic priority of the thread. Each thread has a dynamic priority that the scheduler uses to determine which thread to execute. Initially, a thread s dynamic priority is the same as its base priority. The operating system can raise and lower the dynamic priority to ensure that the computer remains responsive (guaranteeing that no threads are starved for processor time).
PriorityBase	Current base priority of a thread. The operating system can raise the thread s dynamic priority above the base priority if the thread is handling user input, or lower it toward the base priority as needed. The PriorityBase property can have a value between 0 and 31.
ProcessHandle	Process ID for the process that spawned the thread. This is the only way to tie an individual thread to its parent process.
ThreadState	Current execution state for the thread. Values include: 1 Initialized 2 Ready 3 Running 4 Standby 5 Terminated 6 Waiting 7 Transition 8 Unknown
UserModeTime	User-mode time used by the thread, in 100-nanosecond increments.

As implied in the preceding table, the Win32_Thread class does not report the name of the process under which each thread runs. Instead, it reports the ID of the process under which the thread runs. To return the name of a process and a list of all its threads, your script must:

1. Connect to the Win32_Process class and return the list of processes and their process IDs.
2. Temporarily store this information in an array or Dictionary object.
3. For each process ID, return the list of threads for that process, and then display the process name and the list of threads.

Scripting Steps

Listing 14.9 contains a script that monitors the threads running on a computer. To carry out this task, the script must perform the following steps:

1. Create a Dictionary object that is used to store process names and IDs.
2. Create a variable to specify the computer name.
3. Use a GetObject call to connect to the WMI namespace root\cimv2 on the computer, and set the impersonation level to "impersonate."
4. Use the ExecQuery method to query the Win32_Process class. This returns a collection consisting of all the processes running on the computer.
5. For each process in the collection, add the process ID and process name to the Dictionary. As a result, the Dictionary will contain entries such as these:

   Clisvcl.exe   564

   Crss.exe   168

   Explorer.exe   1728

6. Use the ExecQuery method to retrieve the list of running threads from the Win32_Thread class. This returns a collection consisting of all the threads running on the computer.
7. For each thread in the collection, retrieve the ProcessHandle.

   The ProcessHandle represents the process ID of the process that created the thread. This is used to identify the threads that belong to each process. Because the process IDs are stored in the Dictionary as integers, the VBScript function CInt is used to ensure that the ProcessHandle is stored in the variable intProcessID as an integer.

8. Use the variable intProcessName to query the Dictionary and return the name of the process corresponding to that process ID.

   This step is required because the Win32_Thread class maintains only the ID of the process that created the thread; it does not maintain information about the name of the process. Including this step allows you to determine the threads that are running under processes such as Winword.exe rather than threads that are running under a process ID such as 599.

9. Echo the name of the process, the process ID, the thread ID, and the current thread state.

Listing 14.9   Monitoring Threads

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 

Set objDictionary = CreateObject("Scripting.Dictionary") strComputer = "." Set objWMIService = GetObject("winmgmts:" _     & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") Set colProcesses = objWMIService.ExecQuery _     ("SELECT * FROM Win32_Process") For Each objProcess in colProcesses     objDictionary.Add objProcess.ProcessID, objProcess.Name Next Set colThreads = objWMIService.ExecQuery _     ("SELECT * FROM Win32_Thread") For Each objThread in colThreads     intProcessID = CInt(objThread.ProcessHandle)     strProcessName = objDictionary.Item(intProcessID)     Wscript.Echo strProcessName & VbTab & objThread.ProcessHandle & _         VbTab & objThread.Handle & VbTab & objThread.ThreadState Next

---

 Send us your feedback

« Previous | Next »