What is a "Job" (child process thing) in Windows, and when to use it?

Question

Using Process Explorer (procexp.exe), especially with Google Chrome, child processes are called a Job. Same with Internet Explorer 8, but I noticed it first with Chrome.

1. What is a Job
2. What should I know about these things?
3. Why would (you|one) use them?
4. What scenarios should they be used?
5. What APIs are used.

I know the questions is a bit clumsy, please try and look past that. Thanks in advance.

I'm using WinXP by the way.

Answer 1

Instead of answer, read this, for start. It has the most basic answers to your questions.

http://www.malware.org/teaching/win32Slides/Lesson%209%20-%20Jobs%20and%20Thread%20Intro.pptx

Answer 2

Ad 1/2. A job is a process with a job object assigned. They're used to manage groups of processes. One job object can have multiple process, but a process can be assigned to only one job object. You can also set several limits for the jobs, documented here.

Ad 5. CreateJobObject, AssignProcessToJobObject, SetInformationJobObject, TerminateJobObject, and few more, listed here.

Answer 3

A Job under Process Explorer refers to Win32 Jobs. More information about this feature can be found here.

So,

1. What is a Job? As above.

2. What should I know about these things? If a job fails or becomes unstable, all processes it manages will become unstable or crash immediately.

3. Why would (you|one) use them? They are interesting tools if my application/system fires up several processes. I can centralize certain tasks in one job and attach all processes to it. Like gracefully terminate all processes, manage their working sets, etc.

4. What scenarios should they be used? Never did anything worthed using them. But as above. In applications or complex systems that fire up several processes. Under Chrome, for instance (since this is where you are seeing a job), it is quite possible the job is managing each process that is fired when you open a new tab.

5. What APIs are used? The Win32 API