{"id":16861,"date":"2010-10-10T00:01:00","date_gmt":"2010-10-10T00:01:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2010\/10\/10\/weekend-scripter-use-powershell-to-compare-two-snapshots-of-running-processes\/"},"modified":"2010-10-10T00:01:00","modified_gmt":"2010-10-10T00:01:00","slug":"weekend-scripter-use-powershell-to-compare-two-snapshots-of-running-processes","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/weekend-scripter-use-powershell-to-compare-two-snapshots-of-running-processes\/","title":{"rendered":"Weekend Scripter: Use PowerShell to Compare Two Snapshots of Running Processes"},"content":{"rendered":"

Summary<\/strong>: Microsoft Scripting Guy Ed Wilson shows how to use Windows PowerShell to compare snapshots of running processes in this step-by-step article.<\/p>\n

 <\/p>\n

Microsoft Scripting Guy Ed Wilson here. The road seems to stretch on indefinitely. Parallel lines of concrete, surrounded by tall dancing pine trees and bordered by freshly mown grass, continue ahead as far as the eye can see. Physics tells us that two parallel lines will continue towards infinity without touching. The person who came up with that idea must have been driving on the interstate between Charlotte, North Carolina and Columbia, South Carolina – easily one of the most boring roads in the United States of America. Don’t get me wrong – I like trees. In fact, I love trees; I just prefer trees with more character than the tall, wispy, stick like Southern Pine tree. Palm trees are my current favorite tree. Give me a place with lots of palm trees, and I am at home. <\/p>\n

Anyway, I am in my usual passenger seat with my laptop plugged into my power inverter and the Windows PowerShell console open in my 64-bit Windows 7 operating system. We are on our way to speak at another SQL Saturday conference. I decided to play around with the compare<\/strong> object. <\/p>\n

The first thing I do is store the process<\/strong> object in a variable. When I am working interactively in the Windows PowerShell console, I quite often use aliases. Just like my real name is not Ed, the real name for the Get-Process<\/strong> cmdlet is Get-Process<\/strong> and not gps<\/strong>. But unlike the command gps<\/strong>, I am not going to tell you what my real name is. <\/p>\n

All Windows PowerShell cmdlets return objects. The objects that I am going to store in the $a<\/strong> variable are all instances of the process<\/strong> class, which is found in the System.Diagnostics<\/strong> .NET Framework namespace. Namespaces group related objects in the .NET Framework. At times, the namespaces make sense, such as system.io<\/strong>. At other times, the names are not so obvious. In our process example, System.Diagnostics.Process<\/strong> tells us both the namespace and the class name. Often this is the way I choose to refer to .NET Framework classes because I must know the namespace in which the class resides. Therefore, if I keep saying System.Diagnostics.Process<\/strong> over and over again, eventually I will remember where that class resides, and the next time I need to use it, I will automatically know where the class is found. Of course I can open up MSDN, search for the class name, and eventually find the class reference documentation, assuming I have access to the Internet. However, in the United States, we do not even have ubiquitous cell phone coverage, much less universal freely accessible wireless network access. Therefore, when on the road, I am on my own. Luckily, Windows PowerShell also has the Get-Member<\/strong> cmdlet that will tell me information about the class and its members. <\/p>\n

I create the $a<\/strong> variable and store the resulting objects from the Get-Process<\/strong> cmdlet in the variable. This is shown here where I use gps<\/strong> (the alias for Get-Process<\/strong>):<\/p>\n

\n

$a = gps<\/span><\/span><\/span><\/p>\n<\/blockquote>\n

Next, I start a copy of Notepad. I do this by typing the word notepad<\/i>. Windows PowerShell sees the word notepad<\/i>, and recognizes that it is not inside a pair of quotation marks, thereby therefore attempting to call a command named notepad<\/strong>. It finds notepad.exe, and launches it. When I have a new process running (notepad.exe), I take another snapshot of all the processes running on the computer by calling the Get-Process<\/strong> cmdlet again. This time, I will store the contents into a new variable called $b<\/strong>. This section of the code is shown here: <\/p>\n

 <\/span><\/span>notepad
 <\/span>$b = gps<\/span><\/span><\/span><\/p><\/blockquote>\n

Now compare the two objects. To compare two objects, use the Compare-Object<\/strong> cmdlet. The reference<\/strong> object is the baseline configuration, and the difference<\/strong> object is the object that has changed. My baseline is stored in the $a<\/strong> variable, and the process snapshot I took after starting Notepad is stored in the $b<\/strong> variable. This command and the associated output are shown here:<\/p>\n

\n

Compare-Object -ReferenceObject $a -DifferenceObject $b
PS C:\\> Compare-Object -ReferenceObject $a -DifferenceObject $b <\/p>\n

InputObject                                       <\/span>SideIndicator
———–                                       <\/span>————-
System.Diagnostics.Process (notepad)              <\/span>=>
System.Diagnostics.Process (sppsvc)               <\/span><= <\/p>\n

PS C:\\><\/span><\/span><\/span><\/p>\n<\/blockquote>\n

The output tells me there was a process called sppsvc<\/strong> that was running in the baseline snapshot, but is not running after I launched Notepad. Let’s explore the differences. To examine the notepad<\/strong> process, I need to retrieve it from the collection of processes that are stored in the $b<\/strong> variable. To do this, I use the Where-Object<\/strong> cmdlet. The alias for Where-Object<\/strong> is the question mark. This can be a bit confusing because in the past the question mark has always been used for help, but it kind of makes sense because we are asking the question, “Where is ________?”. Next, we need to retrieve the object that has a name that is equal to notepad<\/strong>. The name<\/strong> property of the process<\/strong> object was discovered via the Get-Member<\/strong> cmdlet. Unfortunately, the output from the Get-Process<\/strong> cmdlet changes the name<\/strong> property to ProcessName<\/strong>. In fact, many of the column headings that are displayed in the Get-Process<\/strong> output are aliases. This is shown here: <\/p>\n

\n

PS C:\\> $b | Get-Member <\/p>\n

   <\/span>TypeName: System.Diagnostics.Process <\/p>\n

Name                       <\/span>MemberType     <\/span>Definition
—-                       <\/span>———-     <\/span>———-
Handles            <\/span>        <\/span>AliasProperty  <\/span>Handles = Handlecount
Name                       <\/span>AliasProperty  <\/span>Name = ProcessName
NPM                        <\/span>AliasProperty  <\/span>NPM = NonpagedSystemMemorySize
PM                         <\/span>AliasProperty  <\/span>PM = PagedMemorySize
VM            <\/span>             <\/span>AliasProperty  <\/span>VM = VirtualMemorySize
WS                         <\/span>AliasProperty  <\/span>WS = WorkingSet<\/span><\/span><\/span><\/p>\n<\/blockquote>\n

Now to hone in on the notepad<\/strong> process, I pipe the process objects that are stored in the $b<\/strong> variable to the Where-Object <\/strong>cmdlet (the ?<\/strong> is an alias for the Where-Object<\/strong>) and filter out the processes with the name<\/strong> property that is equal to notepad<\/strong>. This command and its results are shown here:<\/p>\n

\n

 <\/span><\/span>PS C:\\> $b | ? { $_.name -eq ‘notepad’ } <\/p>\n

Handles  <\/span>NPM(K)    <\/span>PM(K)      <\/span>WS(K) VM(M)   <\/span>CPU(s)     <\/span>Id ProcessName
——-  <\/span>——    <\/span>—–      <\/span>—– —–   <\/span>——     <\/span>— ———–
     <\/span>66       <\/span>7     <\/span>1428       <\/span>4568    <\/span>62     <\/span>0.03   <\/span>5980 notepad <\/p>\n

PS C:\\><\/span><\/span> <\/p>\n

<\/span><\/p>\n<\/blockquote>\n

On the other side of our Compare-Object<\/strong> results was a process named sppsvc<\/strong>. To dig into it, I use the same basic command that I used for returning the process<\/strong> object for the notepad<\/strong> process. The command is shown here:<\/p>\n

\n

PS C:\\> $a | ? { $_.name -eq ‘sppsvc’ } <\/p>\n

Handles  <\/span>NPM(K)    <\/span>PM(K)      <\/span>WS(K) VM(M)   <\/span>CPU(s)     <\/span>Id ProcessName
——-  <\/span>——    <\/span>—–      <\/span>—– —–   <\/span>——     <\/span>— ———–
    <\/span>163       <\/span>8     <\/span>2680       <\/span>4996    <\/span>40            <\/span>4012 sppsvc <\/p>\n

PS C:\\><\/span><\/span><\/span><\/p>\n<\/blockquote>\n

More information can be returned from a process object than just the seven default properties shown above. To see all the properties and their associated values, I pipe the resulting object to the Format-List<\/strong> cmdlet and choose all the properties (fl *<\/strong> is the alias for this command). The command is shown here: <\/p>\n

\n

$a | ? { $_.name -eq ‘sppsvc’ } | fl *<\/span><\/span><\/span><\/p>\n<\/blockquote>\n

The output is rather long, and to conserve space I have included the screen shot shown in the following image.<\/p>\n

\"Image<\/a><\/p>\n

One property that is a little unique is the Startinfo<\/strong> property. It does not contain a string or an integer; rather, it contains another object. I use the command seen here to view the Startinfo<\/strong> information. <\/p>\n

\n

PS C:\\> ($a | ? { $_.name -eq ‘sppsvc’ }).Startinfo <\/p>\n

Verb                    <\/span>:
Arguments               <\/span>:
CreateNoWindow          <\/span>: False
EnvironmentVariables    <\/span>: {temp, processor_revision, processor_level, logonserver…}
RedirectStandardInput   <\/span>: False
RedirectStandardOutput  <\/span>: False
RedirectStandardError   <\/span>: False
StandardErrorEncoding   <\/span>:
StandardOutputEncoding  <\/span>:
UseShellExecute         <\/span>: True
Verbs                   <\/span>: {}
UserName                <\/span>:
Password                <\/span>:
Domain                  <\/span>:
LoadUserProfile         <\/span>: False
FileName                <\/span>:
WorkingDirectory        <\/span>:
ErrorDialog             <\/span>: False
ErrorDialogParentHandle : 0
WindowStyle             <\/span>: Normal <\/p>\n

PS C:\\><\/span><\/span><\/span><\/p>\n

 <\/span><\/span><\/span><\/p>\n<\/blockquote>\n

We are pulling into Columbia, South Carolina. I need to hibernate my laptop so that I can prepare to evacuate the motor vehicle. Join me tomorrow for another Weekend Scripter article. <\/p>\n

We would love for you follow us on Twitter<\/a> and Facebook<\/a>. If you have any questions, send email to us at scripter@microsoft.com<\/a>, or post your questions on the Official Scripting Guys Forum<\/a>. See you tomorrow. Until then, peace.<\/p>\n

 <\/p>\n

Ed Wilson and Craig Liebendorfer, Scripting Guys<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"

Summary: Microsoft Scripting Guy Ed Wilson shows how to use Windows PowerShell to compare snapshots of running processes in this step-by-step article.   Microsoft Scripting Guy Ed Wilson here. The road seems to stretch on indefinitely. Parallel lines of concrete, surrounded by tall dancing pine trees and bordered by freshly mown grass, continue ahead as […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[51,31,87,3,4,61,45],"class_list":["post-16861","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-getting-started","tag-operating-system","tag-processes","tag-scripting-guy","tag-scripting-techniques","tag-weekend-scripter","tag-windows-powershell"],"acf":[],"blog_post_summary":"

Summary: Microsoft Scripting Guy Ed Wilson shows how to use Windows PowerShell to compare snapshots of running processes in this step-by-step article.   Microsoft Scripting Guy Ed Wilson here. The road seems to stretch on indefinitely. Parallel lines of concrete, surrounded by tall dancing pine trees and bordered by freshly mown grass, continue ahead as […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/16861","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=16861"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/16861\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=16861"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=16861"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=16861"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}