Batch File help needed for PsList/PsKill when a process is over a specific age (elapsed time)

Question

I'd like to request some help in creating a Batch file to run on a windows server which will monitor processes which sometimes get "stuck" and linger after they should be killed.

Specifcally, I can see the "age" of a process in the Elapsed Time column of the PsList command http://technet.microsoft.com/en-us/sysinternals/bb896682.aspx

Name                Pid Pri Thd  Hnd   Priv        CPU Time    Elapsed Time
FMSCore            4908   8 146  892 750720     0:01:46.221     4:02:15.907
FMSCore            4780   8 144  943 853060     0:00:42.510     4:02:15.348
FMSCore            3532   8 146  878 553784     0:01:30.262     2:04:56.969
FMSCore            5384   8 147  753  45484     0:00:03.198     0:05:11.267
FMSCore            9548   8 133  608  17408     0:00:00.592     0:00:34.298

The next step, is I only want to kill processes which are older than 4 hours. So I believe we will need to parse the results of my PsList command, extract the last column, parse for hours, and if we find that it's "old enough" we parse out it's PID and kill it.

If we were talking about bash or some other scripting language I think I could figure it out, but for a batch script, I don't know.

recommendations?

(note: I'd be willing to run an autoit script or something else, if needed)

Answer 1

setlocal ENABLEEXTENSIONS DISABLEDELAYEDEXPANSION
FOR /F "tokens=2,10* skip=8 delims=: " %%A IN ('pslist') DO (
    if %%B GEQ 4 echo should kill pid %%A, elapsedhrs=%%B
)

Note that

• skip=8 is to filter out pslist copyright and version info, might be version specific
• Will not work on exe files with spaces in their filename!
• This will also list system processes like smss,winlogon,svchost etc and you should not kill these (So, do not run this as system, might also have problems if run as elevated admin)

If filtering by CPU time is acceptable, a simple built-in command can be used: tasklist /FI "CPUTIME ge 04:00:00"

It is probably better to solve this problem with Windows Scripting Host or Powershell (list processes with WMI, this way you will get actual objects and don't have to deal with strings)

Answer 2

So I actually figured this one out myself - had to use AutoIt and an extra filter to look at the command line arguments for each process, and then looking at each process's elapsed time, and then killing the old ones.

Here's the full post:

http://zeroasterisk.com/2010/07/23/adobe-connect-fmscore-process-killer/

We’ve setup Connect to expire the FMSCore processes after 2 hours, but if someone is still connected to a recording, it will keep the old zombie FMSCore process until that person disconnects.

It often happens that doesn’t work – and there’s seemingly no garbage collection in place to clean up old FMSCore.

So we created a simple AutoIt script which can be compiled to an EXE which works, but it has some dependancies…

The following dependencies / commands must all be in place:

• c:\Windows\system32\pv.exe
• c:\Windows\system32\pslist.exe
• c:\Windows\system32\pskill.exe

How it works

• the script uses pv.exe to find all FMS Core processes which have a command line argument that includes “flvplayerapp” (which is only for recorded courses)
• for each of the returned process ids
• it uses pslist to list details which include the age of the process
• it uses a regex match find the “hours it’s been running”
• if longer than 5 hours (a configurable parameter) it uses pskill to kill the process.

So we set this up on an hourly scheduled task and it handles garbage collection for us.

http://zeroasterisk.com/blog/wp-content/uploads/2010/07/fmscore-killer-source.au3_.txt