1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

ProcessMonitor

Discussion in 'Support' started by cgunhouse, Oct 29, 2010.

  1. cgunhouse

    Joined:
    Dec 2, 2008
    Messages:
    209
    Likes Received:
    2
    I was trying out the ProcessMonitor command and it did think that I didn't expect.

    Contents of Test.btm:

    PROCESSMONITOR * STARTED FOREVER start c:\TC\Started.btm
    PROCESSMONITOR * ENDED FOREVER start C:\tc\ended.btm



    Contents of Started.btm:

    @echo off
    echo Process Started
    echo Name: %_processname%
    echo PID: %_processpid%
    echo Count: %_processcount%
    pause
    exit



    Contents of Ended.btm:

    @echo off
    echo Process Ended
    echo Name: %_processname%
    echo PID: %_processpid%
    echo Count: %_processcount%
    pause
    exit


    When I run Test.btm I get a new TCC window popup with the following:


    TCC 12.00.32 Windows XP [Version 5.1.2600]
    Copyright 2010 Rex Conn & JP Software Inc. All Rights Reserved
    Registered to Craig Gunhouse - 1 System License

    Process Started
    Name: smss.exe
    PID: 852
    Count:
    Press any key when ready...


    Which is a process that is already running with a pid of 852 and the value for _processcount is empty. Does "STARTED" on the ProcessMonitor command mean it should watch for a process with than name starting or check for one that is already running?

    From what I coded above, I thought I was monitoring for any new processes starting and any process ending. Am I wrong in my understanding of the syntax of the PROCESSMONITOR command? If I start a new process or kill a process nothing seems to happen.

    Craig
     
  2. rconn

    rconn Administrator
    Staff Member

    Joined:
    May 14, 2008
    Messages:
    9,804
    Likes Received:
    82
    PROCESSMONITOR will trigger the first time if the process is already running. This is WAD, as otherwise there's no way to detect if the new process started just as the PROCESSMONITOR command was being initialized (for example, at system startup).

    However, it's a REALLY bad idea to use "*" as the process name, as at times your system is going to end up triggering PROCESSMONITOR many times per second, and I really don't think you want (1) the overhead, and (2) a few thousand TCC processes popping up.
     
  3. cgunhouse

    Joined:
    Dec 2, 2008
    Messages:
    209
    Likes Received:
    2
    When I ran the code list previously, only the following displayed:

    TCC 12.00.32 Windows XP [Version 5.1.2600]
    Copyright 2010 Rex Conn & JP Software Inc. All Rights Reserved
    Registered to Craig Gunhouse - 1 System License
    Process Started
    Name: smss.exe
    PID: 852
    Count:
    Press any key when ready...


    There was nothing else, none of the few thousand TCC processes you mentioned.

    Craig
     
  4. rconn

    rconn Administrator
    Staff Member

    Joined:
    May 14, 2008
    Messages:
    9,804
    Likes Received:
    82
    Try it with a more rational sample syntax:

    PROCESSMONITOR c:\windows\system32\cmd.exe STARTED FOREVER start Started.btm
    PROCESSMONITOR c:\windows\system32\cmd.exe ENDED FOREVER start ended.btm

    Then start & end CMD.EXE -- you should see both batch files execute.
     

Share This Page