Process:getProcess

Method

Purpose

This method (on Microsoft Windows) returns information about a specified process.

Remarks

If the argument field is empty, data is returned for all processes running on the system.

Test any regular expressions you plan to use in rulebases. Use them interactively first, to ensure they return the desired results.

The methods Performance:Process and Process:getProcess can seem similar, but return different data. Performance:Process returns all Instances of Process Object from the Performance Data Helper (PDH) library. Invoking Performance:process without any arguments retrieves all Process instances in effect at that point in time. Invoking Process:getProcess without any arguments returns all currently running processes from the PSAPI.lib. This method only lists processes that have the right to access this library. Do not confuse these methods.

Type

Synchronous, IMPACT_INFO.

Arguments

 

Name

Type

Description

Process Name

String

Name of process instance. Empty argument returns information for all processes.

Returns

 

Name

Type

Description

Process Name

String

Name of process instance

ID Process

Integer

Process ID for current process. Table is indexed on ID Process

Parent Process ID

Integer

Parent process ID of the current process

Command

String

Command line arguments

CPU Time

Integer

Total amount of time the process has spent in User Mode plus Kernel Mode (in milliseconds).

Class

String

Process priority class

User Name

String

Account name for the process

Mem Usage

Integer

Memory usage in kilobytes (working set size)

Peak Working SetSize

Integer

Peak working set size in kilobytes

Page File Usage

Integer

Page File usage in kilobytes

Page Fault Count

Integer

Page Fault count

Start Time

Integer

The number of seconds since the process started