killing processes and parsing data file

vanfanel · Post by **vanfanel** » Wed Nov 30, 2005 8:48 pm

I am trying to write a script that checks every 5 minutes for "certain" processes that have been running for more than 30 minutes. I find these processes by using:

tasklist /M EVENTS.DLL /FI "CPUTIME gt 00:30:00" > C:\test.txt

I can figure out the timing aspect but how do I grab the PIDs from the file that I generated since I can then probably kill them by that. I looked at using "Separate" but that didn't seem to work:

Image Name PID Modules
========================= ====== =============================================
OUTLOOK.EXE 2060 events.dll
trillian.exe 2584 events.dll, events.dll

Perhaps there's a much easier solution to my initial problem that I'm missing but either way any help would be appreciated. thanks!

JRL · Post by **JRL** » Wed Nov 30, 2005 9:36 pm

There still might be an easier solution to your initial problem but this short script grabs the PIDs on my computer. Note the first line has a trailing space.

Let>space=
Let>k=3
Label>start
Let>k=k+1
ReadLn>c:\test.txt,%k%,line
If>line=##EOF##,end
Let>kk=0
Label>ReadPID
Let>kk=kk+1
Let>PIDpos=kk+29
Midstr>%line%,%PIDpos%,1,test
If>test=%space%,process,ReadPID
Label>process
Let>PIDpos=%PIDpos%-29
Midstr>%line%,29,%PIDpos%,PID
Let>PID_%k%=%PID%
goto>start
Label>end

Hope this helps,
Dick

vanfanel · Post by **vanfanel** » Wed Nov 30, 2005 10:08 pm

thanks for the reply! That seems to work for most cases however how would you adjust it if the PID was more/less than 4 digits?

Image Name PID Modules
========================= ====== =============================================
wmiprvse.exe 6816 kernel32.dll
notepad.exe 11444 kernel32.dll
bash.exe 3936 kernel32.dll
tasklist.exe 944 kernel32.dll

JRL · Post by **JRL** » Wed Nov 30, 2005 10:12 pm

Number of digits won't matter. It starts at column 30 and keeps looking until it hits a space. The problem would be if the PID does not start at column 30. On my computer, in very limited testing, the PID always began on the 30th column of text.

Kind of wondering where you came up with a 4. The process starts looking at line 4 of the test.txt file. Is that the 4 you're refering to?

vanfanel · Post by **vanfanel** » Wed Nov 30, 2005 10:39 pm

I see. When I run your script I run into problems when the PID is not 4 digits because then it starts on a different column. For instance a 3 digit PID starts at 31 and 5 digit PIDs start at 29.

JRL · Post by **JRL** » Wed Nov 30, 2005 10:40 pm

Just found that out myself. Try this one instead.

Let>space=
Let>k=3
Label>start
Let>k=k+1
ReadLn>c:\test.txt,%k%,line
If>line=##EOF##,end
Let>kk=0
Let>kkk=0
Label>FindPID
Let>kk=kk+1
Let>PIDpos=kk+22
Midstr>%line%,%PIDpos%,1,test
If>test=%space%,FindPID,ReadPID
Label>ReadPID
Let>kkk=kkk+1
Let>PIDlen=kkk+%PIDpos%
Midstr>%line%,%PIDlen%,1,test
If>test=%space%,process,ReadPID
Label>process
Let>PIDlen=%PIDlen%-%PIDpos%
Midstr>%line%,%PIDpos%,%PIDlen%,PID
Let>PID_%k%=%PID%
goto>start
Label>end

This script starts at line 22 and searches until it finds a character that is not a space, then counts positions to locate the PID. Next problem will be that column 22 is too near the beginning and will interfere with the image name. This can be fixed by altering the last number in the 11th line of the script. the "22" there is the start point for the PID search.

Me_again · Post by **Me_again** » Wed Nov 30, 2005 10:55 pm

I can't test it right now but all the image names will have an extension - right? So how about finding the position of the first period on the line, adding 4, and starting the non space search there?

JRL · Post by **JRL** » Wed Nov 30, 2005 11:36 pm

Not all processes have an extension.

OK... same thing only different. The last column of the PID will always be column 33? agree? maybe? who knows for sure? So starting at column 33 and counting backward to find a space then taking the PID from the known position:

Let>space=
Let>k=3
Label>start
Let>k=k+1
ReadLn>c:\test.txt,%k%,line
If>line=##EOF##,end
Let>kk=0
Label>FindPID
Let>kk=kk-1
Let>PIDpos=kk+33
Midstr>%line%,%PIDpos%,1,test
If>test=%space%,ReadPID,FindPID
Label>ReadPID
Let>PIDpos=%PIDpos%+1
Let>PIDlen=33-%PIDpos%
Midstr>%line%,%PIDpos%,%PIDlen%,PID
Let>PID_%k%=%PID%
goto>start
Label>end

Hope this works,
Dick

Me_again · Post by **Me_again** » Thu Dec 01, 2005 5:07 am

Rather than trying to pick a number I think it would be more reliable to search for the begin and end of the PID.

IfFileExists>c:\test.txt,next,end
Label>next
Let>space=
Let>k=2
Label>start
Let>k=k+1
ReadLn>c:\ftps\proctest.txt,%k%,line
If>line=##EOF##,end
Let>kk=0
Label>Step1
Let>kk=kk+1
Midstr>%line%,%kk%,1,test
If>test=%space%,Step2,Step1
Label>Step2
Let>kk=kk+1
Midstr>%line%,%kk%,1,test
If>test%space%,Step3,Step2
Label>Step3
Let>PIDStart=kk
Label>Step4
Let>kk=kk+1
Midstr>%line%,%kk%,1,test
If>test=%space%,Step5,Step4
Label>Step5
Let>PIDLength=%kk%-%PIDStart%
Midstr>%line%,%PIDStart%,PIDLength,PIDnum
MessageModal>%PIDnum%
goto>start
Label>end

JRL · Post by **JRL** » Thu Dec 01, 2005 5:40 am

Good job, I agree... however:

Was just looking at the help for tasklist.exe. You can format the output to be comma delimited. This makes the task absolute and much easier.

The line:
tasklist /M kernel32.DLL /FI "CPUTIME gt 00:30:00" > C:\test.txt

Becomes:
tasklist /M kernel32.DLL /FO "CSV" /FI "CPUTIME gt 00:30:00" > C:\test.txt

The /FO "CSV" puts the output into a comma delimited form looking much like this:

"ImageName","PID","Modules"
"wmiprvse.exe","6816","kernel32.dll"
"notepad.exe","11444","kernel32.dll"
"bash.exe","3936","kernel32.dll"
"tasklist.exe","944","kernel32.dll'

So a script to parse this becomes much simpler:

Let>comma=,
Let>k=2
Label>start
let>k=k+1
ReadLn>C:\test.txt,%k%,line
If>line=##EOF##,end
Separate>line,comma,var
Separate>var_2,",varr
Let>PID%k%=%varr_2%
Goto>start
Label>end

So what do you think?

Post by **Marcus Tettmar** » Thu Dec 01, 2005 8:02 am

Why don't you do the whole thing programmatically:

See if a process is running / get a list of running processes and return process info:
http://www.mjtnet.com/forum/viewtopic.php?t=1652

Terminating running processes:
http://www.mjtnet.com/forum/viewtopic.php?t=1779

vanfanel · Post by **vanfanel** » Thu Dec 01, 2005 4:43 pm

Thanks JRL! I think that did it and it's much simpler.

mtettmar, I only briefly looked at the code but how could I modify that to search for processes using a specific module? Here is my situation:

I have various automated tasks that run on a daily bases. These processes spawn various child processes. In some instances the parent or child process hangs and continues to eat up CPU cycles. I needed a way to kill these hung processes. The only sure way I can identify these processes and specifically the child processes is by searching for specific modules that only they use. I don't know enough of VB but can your VB accomodate that? I'll continue to investigate your solution.

thanks everyone for the help.

JRL · Post by **JRL** » Thu Dec 01, 2005 5:17 pm

vanfanel,
You're welcome and thank you for the tip of running tasklist in a command line. I'm embarassed to say I didn't realize it could be done. Wow the possibilities!!!!

Me_Again,
Thank you for your efforts.

Why don't you do the whole thing programmatically:

Marcus,
I have zero knowledge regarding VB Script. As much as I'd like to take the time to learn it, I've come to accept that it's not likely to happen. What originally attracted me to your fine product was the fact that I could understand it and program with it without much real programming experience. I can't possibly convey to you what a positive effect your software has had on my daily work activities.

I realize that one of the major features/benefits of Macro Scheduler is its ability to run Visual Basic scripts. But I don't have the skills needed to make even simple modifications and have your sample scripts perform tasks that I want done.

I hope this answers your question,
Dick