[CMD] tasklist : 동작중인 프로세스 확인

Tasklist command

by SRINI

In Windows, we can get the list of processes running on the system from command prompt also. We can use ‘tasklist‘ command for this purpose.
Using this command we can selectively list the processes based on criteria like the memory space used, running time, image file name, services running in the process etc. Below you can find the syntax and examples for various cases.

Get the list of all the process running on the system

tasklist

Get the list of process using memory space greater than certain value.

tasklist /fi "memusage gt memorysize"

Memory size should be specified in KB
For example, to get the list of processes occupying more than 30MB of memory, we can run the below command.

tasklist /fi "memusage gt 30000"

Find the list of processes launched by a user

tasklist /fi "username eq userName"

Find the memory usage of a specific process

tasklist /fi "pid eq processId"

Example:

c:\>tasklist /fi "pid eq 6544"
Image Name                     PID Session Name        Session#    Mem Usage
========================= ======== ================ =========== ============
WmiPrvSE.exe                  6544 Services                   0      8,936 K

Find the list of not responding processes

tasklist /fi "status eq not responding"

example:

c:\>tasklist /fi "status eq not responding"
Image Name                     PID Session Name        Session#    Mem Usage
========================= ======== ================ =========== ============
rundll32.exe                  3916 Console                    1      7,028 K

Get the list of services running in a process

tasklist /svc /fi "pid eq processId"

Example:

c:\>tasklist /svc /fi "pid eq 624"
Image Name                     PID Services
========================= ======== ============================================
lsass.exe                      624 EFS, KeyIso, Netlogon, ProtectedStorage,
                                   SamSs, VaultSvc
c:\>

Get list of processes running for more than certain time

tasklist /fi "cputime gt hh:mm:ss"

example:
Get the list of processes that have been running from more than an hour and 20 minutes.

c:\>tasklist /fi "cputime gt 01:20:00"
Image Name                     PID Session Name        Session#    Mem Usage
========================= ======== ================ =========== ============
System Idle Process              0 Services                   0         24 K
SynTPEnh.exe                  4152 Console                    1      8,080 K
firefox.exe                   1740 Console                    1    857,536 K
c:\>

Find processes that are running a specified image file:

tasklist /fi "imagename eq imageName"

Example:

c:\>tasklist /fi "imagename eq firefox.exe"
Image Name                     PID Session Name        Session#    Mem Usage
========================= ======== ================ =========== ============
firefox.exe                   1740 Console                    1    812,160 K
c:\>

Find the process running a specific service

tasklist /fi "services eq serviceName"

example:

c:\>tasklist /fi "services eq webclient"

Image Name                     PID Session Name        Session#    Mem Usage
========================= ======== ================ =========== ============
svchost.exe                   1052 Services                   0     20,204 K
c:\>

Related Posts:
How to kill a process from windows command line.

cmd에서 tasklist는 "서비스를 포함하여 현재 실행 중인 모든 작업을 표시합니다." 라고 설명하고 있습니다.

COMMAND INPUT : tasklist

1. 이미지 이름(프로세스 이름)

2. PID(프로세스 아이디)

3. 세션 이름(서비스/콘솔)

4. 세션#(비활성화(0), 활성화(1))

5. 메모리 사용(메모리 사용량)

COMMAND INPUT : tasklist /V

/V : 자세한 작업 정보를 표시합니다.

1. 이미지 이름(프로세스 이름)

2. PID(프로세스 아이디)

3. 세션 이름(서비스/콘솔)

4. 세션#(비활성화(0), 활성화(1))

5. 메모리 사용(메모리 사용량)

6. 상태(?, 실행 중)

7. 사용자 이름

8. CPU 시간(프로세스 활성화된 시간)

9. 창 제목

COMMAND INPUT : tastklist /V /FO CSV

COMMAND INPUT(FILE SAVE) : tasklist /V /FO CSV > tasklist.csv

/FO : 형식 출력 형식을 지정합니다.

    (사용할 수 있는 값 : "TABLE", "LIST", "CSV")

< CSV >

< LIST >

< TABLE >

COMMAND INPUT : tasklist /svc

/svc : 각 프로세스에 호스트된 서비스를 표시합니다.

1. 이미지 이름(프로세스 이름)

2. PID(프로세스 아이디)

3. 서비스

출처: http://asiatica-aramid.tistory.com/30 [Investigate and write! :D]