what is tasklist command "PID no."

[Yogesh123]

In tasklist command,
we are getting the PID no. against each process, if there is a process called Excel.exe and if i open 5 sessions of excel, tasklist gives me 5 entries of excel.exe with 5 different PID no's,

So the question is Can i make use of PID no's to find out that which one is older or newer process? & Can i correlate that which PID no. is associated with which session?

Thank in advance!

[Salmon Trout]

PID stands for "Process ID". Use the /v switch with tasklist to get verbose output, which will include window title and user details.

[ghostdog74]

So the question is Can i make use of PID no's to find out that which one is older or newer process?

NO.

& Can i correlate that which PID no. is associated with which session?

don't understand

to have better programming control over the things you do, try using vbscript.(natively)
this vbscript terminates the latest (newest process) of the same type

Code: [Select]

Set objFS=CreateObject("Scripting.FileSystemObject")
Set objArgs = WScript.Arguments
strProcess = objArgs(0)
strComputer = "."
Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colProcessList = objWMIService.ExecQuery("Select * from Win32_Process Where Name = '"&strProcess&"'")
t=0
For Each objProcess in colProcessList
    s = Replace( objProcess.CreationDate ,".","")
    s = Replace( objProcess.CreationDate ,"+","")
    If s > t Then
    t=s
    strLatestPid = objProcess.ProcessID
    End If   
Next
WScript.Echo "latest: " & t , strLatestPid
Set colProcess = objWMIService.ExecQuery("Select * from Win32_Process where ProcessId =" & strLatestPid)
For Each objProcess in colProcess
    objProcess.Terminate()
Next

to use it on the command line type

Code: [Select]

c:\test> cscript //nologo killbill.vbs "notepad.exe"
i leave it to you to find the oldest if you are interested.

[billrich]

Quote from: Yogesh123 on Today at 04:09:14 AM
"So the question is Can I make use of PID no's to find out that which one is older or newer process?"

NO, you cannot  make use of PID no's to find out that which one is older or newer process?"

How does Casper know: "You cannot  make use of PID no's to find out that which one is older or newer process?"

p.s.  The smaller the PID number,  The older the process?

[Sidewinder]

p.s.  The smaller the PID number,  The older the process?

You might think that, but you would be wrong. A simple script that selects all the instances of the svchost along with the PID and the creation date will show PID numbers are assigned rather haphazardly.

==========================================
Computer: LAPTOP
==========================================
CreationDate: 12/11/2009 7:24:55 AM
Name: svchost.exe
ProcessId: 900

CreationDate: 12/11/2009 7:24:56 AM
Name: svchost.exe
ProcessId: 968

CreationDate: 12/11/2009 7:24:56 AM
Name: svchost.exe
ProcessId: 1084

CreationDate: 12/11/2009 7:24:57 AM
Name: svchost.exe
ProcessId: 1136

CreationDate: 12/11/2009 7:24:58 AM
Name: svchost.exe
ProcessId: 1296

CreationDate: 12/11/2009 7:25:03 AM
Name: svchost.exe
ProcessId: 1892

CreationDate: 12/11/2009 7:25:07 AM
Name: svchost.exe
ProcessId: 436

You'll notice that the last instance of svchost which was assigned the lowest PID. I wouldn't count on a correlation between the PID and the age of the process. Better to use the creation date and calculate the age.

 

[Salmon Trout]

How does Casper know: "You cannot  make use of PID no's to find out that which one is older or newer process?"

Why does billrich the tosser post RUBBISH?

[billrich]

Quote from: billrich on Today at 11:24:51 AM
How does Casper know: "You cannot  make use of PID No's to find out that which one is older or newer process?"

Quote from Billrich:
"p.s.  The smaller the PID number,  The older the process?"

You might think that, but you would be wrong. A simple script that selects all the instances of the svchost along with the PID and the creation date will show PID numbers are assigned rather haphazardly.

Sidewinder:

Thanks  for your post and explanation of PIDs.  Some of the negative posters are confused and vindictive.

[ghostdog74]

How does Casper know: "You cannot  make use of PID no's to find out that which one is older or newer process?"

I know it can't because i have been doing sysadmin + IT security for years and i know how PIDs behave. That's why i say NO. if you do not know or are unconvinced, you can try out for yourself , couldn't you?

[BC_Programmer]

hahaha

"smaller Pids are older"

hilarious assumption, especially considering the ProcessID and Process Handle are essentially memory pointers, and therefore subject to memory allocation rules, which are pretty haphazard in themselves. You cannot, for example, know at any one point where in memory a structure will be allocated any more then you can predict the ordering of the allocations based on the time they are performed. Especially on account of the fact that memory is allocated and reallocated quite often; to say that "the lower Pids are older" is like saying that the files at the beginning of a disk are the oldest ones.