Batch to kill (Killer Batch)

[shashank.kaneria]

Hi,

I am working on a batch script which can kill process who use more than 90% of the CPU.

Could anyone help me out...

"My system is connected to 5 other windows system. to take some load from all of them. If any one of the connected system have 100% CPU then my system lost one machine among 5.
So, i just want to kill the processes in the connected system which goes up to 90%, it should not be the system idle process. "

so may be we have to run a batch on all of the systems, which statics of all the process with CPU. Sorts them. Kills the monster process. Occurrence of this check should be done in every 10 seconds(batch will create a self process so we need to worry about, it should work silently).... so we are going to create a "Silent Killer Batch"...

[berserker]

I am working on a batch script which can kill process who use more than 90% of the CPU.

so you have worked on a batch. Where is it?

[Ed Dyreen]

Batch is not very cpu friendly.

Running a process killer on your host or one on each client are both possible.
wmic can connect and query a remote system.

[Endoro]

how to get processes where the processor time is greater 90% AND the name is not "Idle"

Code: Select all

wmic path Win32_PerfFormattedData_PerfProc_Process where "Name != 'Idle' and PercentProcessorTime > 90" get Name,PercentProcessorTime,IDProcess

And the command line 'for loop':

Code: Select all

for /f "tokens=1-3" %a in ('wmic path Win32_PerfFormattedData_PerfProc_Process where "Name != 'Idle' and PercentProcessorTime > 90" get Name^,PercentProcessor
Time^,IDProcess') do @for /f %d in ("%c") do @echo(%a,%b,%d

[penpen]

You should also avoid killing processes of system service type (System, Network Service, local ...):
Your tool then should better send a message to you.

For example svchost.exe can be in any system service type, and on XP since last October (the "bad" autoupdate) it may use 100% cpu load.
Then don't kill it: In such a case you should better find out what the problem is and fix it.
Note: For various reasons the svchost.exe (and other system processes) may cause high cpu loads on other windows versions, too.

penpen

[shashank.kaneria]

[quote="Endoro"]how to get processes where the processor time is greater 90% AND the name is not "Idle"

Code: Select all

wmic path Win32_PerfFormattedData_PerfProc_Process where "Name != 'Idle' and PercentProcessorTime > 90" get Name,PercentProcessorTime,IDProcess

Thanks. But its is not working. I have tried this on one of my remote machine but it haven't killed that svhost which was consuming 98% of my CPU.

even if i modify your script by

Code: Select all

wmic path Win32_PerfFormattedData_PerfProc_Process where "PercentProcessorTime > 0" get Name,PercentProcessorTime,IDProcess

it should show something, but it didn't.

Tasklist is not showing the CPU utilization. It might help us out if it could show.

Thanks for effort.

[shashank.kaneria]

Hi Everyone,
I have worked on that killer batch and reached up to certain level.

Thanks Endoro... Your script worked in my remote machine, i have tried on mu local but because of some reasons it didnt worked.

Code I used is:

Code: Select all

:BEGIN
ECHO OFF
wmic path Win32_PerfFormattedData_PerfProc_Process where "Name!='Idle' and Name!='_Total' and PercentProcessorTime > 90" get IDProcess > a.txt
for /f "delims=" %%a in (a.txt) do set "variable=%a%"
taskkill /PID %variable%
ping 127.0.0.1
GOTO BEGIN

its an infinite loop. The wmic command finds out the process which utilizes CPU more than 90% and gives output to the file 'a.txt'
and the taskkill kills the process.
ping gives the script 3 seconds delay to execute.


BUT.......................

i am facing some issue. About the variables. cant explain over here. Please run above code and do some research and development.

Regards,
Shashank Kaneria

[Endoro]

i am facing some issue. About the variables. cant explain over here.

Why not?

Please run above code and do some research and development.

Uii ... AYE SIR

Code: Select all

@ECHO OFF &SETLOCAL
for /f %%a in ('wmic path Win32_PerfFormattedData_PerfProc_Process where "Name != 'Idle' and PercentProcessorTime > 90" get IDProcess') do (
   for /f %%b in ("%%~a") do taskkill /pid %%~b
)

kind regards

[foxidrive]

Code: Select all

@ECHO OFF &SETLOCAL
for /f %%a in ('wmic path Win32_PerfFormattedData_PerfProc_Process where "Name != 'Idle' and PercentProcessorTime > 90" get IDProcess') do (
   for /f %%b in ("%%~a") do taskkill /pid %%~b
)

kind regards

It is trying to kill "System Idle Process" here.

[Endoro]

It is trying to kill "System Idle Process" here.

I hope not.

.. but after some research and development I come out with:

Code: Select all

@ECHO OFF &SETLOCAL
for /f %%a in ('wmic path Win32_PerfFormattedData_PerfProc_Process where "Name != 'Idle' and PercentProcessorTime > 90" get IDProcess') do (
   for /f %%b in ("%%~a") do if not "%%~b"=="0" taskkill /pid %%~b
)

[penpen]

Thanks. But its is not working. I have tried this on one of my remote machine but it haven't killed that svhost which was consuming 98% of my CPU.

You should reread my above post: http://www.dostips.com/forum/viewtopic.php?p=31489#p31489.

The file svchost.exe is a kind of "super service", accessed from many other services.
Additionally it may crash other svchost.exe processes, as they may coordinating with other svchost.exe processes.
If you close one svchost.exe process, then you cannot predict what is happening:
- you can lose any USB service,
- flash may play without sound,
- automatic update may not work,
- you could loose your (inter)net conectivity,
- ...
If the CPU usage is 100% since ~July/October 2013 patch, then try to disable the automatic update service:
If the 100% svchost process ends after that, then you should fix that issue.
(Or you may live with disabled updates and have to update the machine manually.)

penpen

[Endoro]

You can make as many conditions as you want:

Code: Select all

wmic path Win32_PerfFormattedData_PerfProc_Process where "Name != 'idle' and not Name like '%svchost%' and PercentProcessorTime > 90" get IDProcess

Double the percent in a batch '%%svchost%%'.

[shashank.kaneria]

Uii ... AYE SIR

Thanks Endoro.

Such a nice code, very helpful.

Thanks a ton


Regards,
Shashank

[shashank.kaneria]

Additionally it may crash other svchost.exe processes, as they may coordinating with other svchost.exe processes.

In my scenario,
When we access any remote machine so frequently then the antivirus McAfee agent utilizes the CPU(for check purpose).
it makes the other process (only one svhost of NETWORK) to get up and eat more CPU.
so, either McAfee or corresponding svhost (or both) would work highly on the system.

if CPU is high then connectivity to the remote machine could lost. So their is only one option left to kill one of them or both of them.

I did that manually and found that system started working fine.

I have considered your opinion about the severe problems could happen. Best solution is to do either install new on the system or to contact mcafee support.

I will let you know if i got a good solution instead of Killer Batch.

Regards,
Shashank

[shashank.kaneria]

BRAVO !!! Final it Worked....

Code i am using is:

Code: Select all

 
:BEGIN
@ECHO OFF &SETLOCAL
for /f %%a in ('wmic path Win32_PerfFormattedData_PerfProc_Process where "Name = 'svchost' and PercentProcessorTime > 95" get IDProcess') do (
   for /f %%b in ("%%~a") do taskkill /F /pid %%~b
)
ping 127.0.0.1 -n 6 > nul
for /f %%a in ('wmic path Win32_PerfFormattedData_PerfProc_Process where "Name = 'mcshield' and PercentProcessorTime > 95" get IDProcess') do (
   for /f %%b in ("%%~a") do taskkill /F /pid %%~b
)
ping 127.0.0.1 -n 6 > nul
GOTO BEGIN

it is an infinite loop. and it checks and kills svchost and mcshield in case they go high[tested on iexplore initailly ].

Regards,
Shashank