windows查看進程線程的命令pslist

標籤：moni   red   abort   fresh   ram   nms   border   computer   spl   

pslist是用命令列查看線程；ProcessExplorer是圖形化的查看線程，都在附件中。

1.查看進程

     tasklist 

or  pslist -t

 

Name                             Pid Pri Thd  Hnd      VM      WS    Priv
Idle                               0   0   2    0       0      28       0
  System                           4   8  69 1222    1824     308       0
    smss                         832  11   3   20    3748     408     172
      csrss                      900  13  12  807   72428   16152    2568
      winlogon                   924  13  21  516   61272    4704    8536
        services                 968   9  15  280   22556    4516    1868
          avp                    256   8  36 7185  190528   22332   50308
explorer                        2060   8  16  575  122880   13400   17752
  msnmsgr                       1604   8  33  778  222560   19240   32792
  cmd                           3680   8   1   31   31084    3004    2164
    pslist                      5476  13   2   91   30500    2744    1236
  notepad                       4276   8   1   45   33692    3956    1344
  IEXPLORE                      5184   8  61 2143  403392   31236  105436
  eclipse                       6088   8   1   33   29884    3184     960
    javaw                       4484   8  40 1197  729124  139424  193496
      javaw                     4252   8  11(十一個線程)  310  187820    8080   13908

 

 

2.查看進程中的線程 http://technet.microsoft.com/en-us/sysinternals/bb896682.aspx

 

pslist -dmx 4252

Name                Pid      VM      WS    Priv Priv Pk   Faults   NonP Page
javaw              4252  202224   21848   23968   24476     7927      4   47
 Tid Pri    Cswtch            State     User Time   Kernel Time   Elapsed Time
5428   8      2617     Wait:UserReq  0:00:01.312   0:00:00.515    0:06:41.625
5312  15       614     Wait:UserReq  0:00:00.078   0:00:00.000    0:06:41.484
1380  15         7     Wait:UserReq  0:00:00.000   0:00:00.000    0:06:41.468
2012  10         7     Wait:UserReq  0:00:00.000   0:00:00.000    0:06:41.468
3876   9      1037     Wait:UserReq  0:00:00.046   0:00:00.187    0:06:41.187
5884   9        65     Wait:UserReq  0:00:00.000   0:00:00.015    0:06:41.187
4444  10       236     Wait:UserReq  0:00:00.000   0:00:00.015    0:06:41.171
4564  15        12     Wait:UserReq  0:00:00.000   0:00:00.000    0:06:40.953
4644  15       270     Wait:UserReq  0:00:00.234   0:00:00.015    0:06:40.953
4292   8         5     Wait:UserReq  0:00:00.000   0:00:00.000    0:06:40.953
5964  15      6422   Wait:DelayExec  0:00:00.000   0:00:00.000    0:06:40.937

 

 

Introduction

 

pslist exp	would show statistics for all the processes that start with "exp", which would include Explorer.
-d	Show thread detail.
-m	Show memory detail.
-x	Show processes, memory information and threads.
-t	Show process tree.
-s [n]	Run in task-manager mode, for optional seconds specified. Press Escape to abort.
-r n	Task-manager mode refresh rate in seconds (default is 1).
\\computer	Instead of showing process information for the local system, PsList will show information for the NT/Win2K system specified. Include the -u switch with a username and password to login to the remote system if your security credentials do not permit you to obtain performance counter information from the remote system.
-u	username If you want to kill a process on a remote system and the account you are executing in does not have administrative privileges on the remote system then you must login as an administrator using this command-line option. If you do not include the password with the -p option then PsList will prompt you for the password without echoing your input to the display.
-p	password This option lets you specify the login password on the command line so that you can use PsList from batch files. If you specify an account name and omit the -p option PsList prompts you interactively for a password.
name	Show information about processes that begin with the name specified.
-e	Exact match the process name.
pid	Instead of listing all the running processes in the system, this parameter narrows PsList‘s scan to tthe process that has the specified PID. Thus: pslist 53 would dump statistics for the process with the PID 53.

 

 

How it Works

Like Windows NT/2K‘s built-in PerfMon monitoring tool, PsList uses the Windows NT/2K performance counters to obtain the information it displays. You can find documentation for Windows NT/2K performance counters, including the source code to Windows NT‘s built-in performance monitor, PerfMon, in MSDN.

 

Memory Abbreviation Key

All memory values are displayed in KB.

• Pri: Priority
• Thd: Number of Threads
• Hnd: Number of Handles
• VM: Virtual Memory
• WS: Working Set
• Priv: Private Virtual Memory
• Priv Pk: Private Virtual Memory Peak
• Faults: Page Faults
• NonP: Non-Paged Pool
• Page: Paged Pool
• Cswtch: Context Switches

 

 

以下是非Windows系統本身附帶的外部命令，均存放於光碟片 PE 系統目錄下的 System32 目錄下。 

AUTORAMRESIZER.EXE 自動根據實體記憶體調整虛擬盤大小（PE）。 
CHOICE.EXE DOS 選擇命令支援擴充 
DEVCON.EXE 裝置控制台命令列工具 
FINDPASS.EXE 尋找系統管理員口令的命令列工具（可能有病毒虛警） 
FPORT.EXE TCP/IP與連接埠偵查工具 
HWPnp.exe 重新檢測隨插即用硬體的工具 + 生產力，可啟用移動儲存空間等 
KEYBOARD.EXE 更改鍵盤地區屬性的命令列工具 
KEYDOWN.EXE 檢測鍵盤按鍵的命令列工具 
NC.EXE 大名鼎鼎的網路強力命令列工具！ 
NETCFG.EXE Windows PE 環境的網路設定命令列工具 
PASSWDRENEW.EXE Windows 口令離線修改工具 
PENETCFG.EXE 牛人編寫的 PE 網路環境組態工具 
PSINFO.EXE 本地和遠程系統資訊檢測命令列工具 
PSKILL.EXE 結束本地或遠程進程的命令列工具 
PSLIST.EXE 系統進程查看工具 
PSPASSWD.EXE 更改本地或遠程系統口令命令列工具 
PSSERVICE.EXE 管理系統服務的命令列工具 
PULIST.EXE 系統進程列表查看 
TCPVCON.EXE 查看活動進程的TCP串連狀態 
TFTPD32.EXE 簡單的 TFTP 工具 
WGET.EXE 功能強大的命令列下載工具 
XCACLS.EXE 檔案及目錄存取控制清單的命令列加強工具 
XNVIEW.EXE 袖珍映像查看工具（小巧夠用，不需升級）

 

windows查看進程線程的命令pslist