Process:getProcess
Method
Purpose
This method (on Microsoft Windows) returns information about a specified process.
Remarks
If the argument field is empty, data is returned for all processes running on the system.
Test any regular expressions you plan to use in rulebases. Use them interactively first, to ensure they return the desired results.
The methods Performance:Process
and Process:getProcess
can seem similar, but return different data. Performance:Process
returns all Instances of Process Object from the Performance Data Helper (PDH) library. Invoking Performance:process
without any arguments retrieves all Process instances in effect at that point in time. Invoking Process:getProcess
without any arguments returns all currently running processes from the PSAPI.lib
. This method only lists processes that have the right to access this library. Do not confuse these methods.
Type
Synchronous, IMPACT_INFO
.
Arguments
Name |
Type |
Description |
Process Name |
String |
Name of process instance. Empty argument returns information for all processes. |
Returns
Name |
Type |
Description |
Process Name |
String |
Name of process instance |
ID Process |
Integer |
Process ID for current process. Table is indexed on ID Process |
Parent Process ID |
Integer |
Parent process ID of the current process |
Command |
String |
Command line arguments |
CPU Time |
Integer |
Total amount of time the process has spent in User Mode plus Kernel Mode (in milliseconds). |
Class |
String |
Process priority class |
User Name |
String |
Account name for the process |
Mem Usage |
Integer |
Memory usage in kilobytes (working set size) |
Peak Working SetSize |
Integer |
Peak working set size in kilobytes |
Page File Usage |
Integer |
Page File usage in kilobytes |
Page Fault Count |
Integer |
Page Fault count |
Start Time |
Integer |
The number of seconds since the process started |