1. | Open Notepad or some other editor.
|
2. | Open the InformativeWMI.vbs script and save it as YourNameDirectedWMI.vbs.
|
3. | Under the list of declared variables, add a new declaration for a variable called vWhere.
|
4. | Insert a new line above the line defining the WMI query.
|
5. | Save and run the script from a command line using CScript.
|
6. | Identify no more than five or six "interesting properties" for inclusion in your new script. I decided to use the following: Name, CommandLine, MaximumWorkingSetSize, QuotaPeakNonPagedPoolUsage, ProcessID, and ThreadCount. I chose CommandLine rather than the executable path because many times, programs will launch with a commandline parameter (or switch), which does not show up in the executable path variable. In addition, when something is running in the svcHost, the command-line parameter enables you to see what is actually running in that service host. Your For Each...Next loop might look something like this code:
For Each objItem In colItems
WScript.Echo "CommandLine: " & objItem.CommandLine
WScript.Echo "PID: " & objItem.ProcessID
WScript.Echo "MaximumWorkingSetSize: " & objItem.MaximumWorkingSetSize
WScript.Echo "QuotaPeakNonPagedPoolUsage: " & _
objItem.QuotaPeakNonPagedPoolUsage
WScript.Echo "ThreadCount: " & objItem.ThreadCount
WScript.Echo " *********************************"
Next
|
7. | Save your work.
|
8. | Above the wmiQuery line, define the vWhere variable to be equal to a Where clause that specifies the number of threads as greater than 10. Make sure you encase the entire Where clause in a set of double quotation marks. In addition, make sure that the number is also encased in single quotation marks. That will entail a '10'" at the end of your Where clause. Your code might look like the following:
vWhere = " where threadCount > '10'"
|
9. | Save your work.
|
10. | Modify the WMI query to utilize the vWhere variable. This is rather simple in that all you need to do is insert a space at the end of the query inside the double quotation marks and then use the ampersand and type the vWhere variable name. The code will look like the following:
wmiQuery = "Select * from Win32_Process " & vWhere
|
11. | Save and run your script in CScript. If it does not run properly, compare your script with the \My Documents\Microsoft Press\VBScriptSBS\ch10\OneStepFurther\DirectedWMI.vbs script.
|
1. | Open Notpad or your favorite script editor.
|
2. | Open the \DirectedWMI.vbs file and save it as YourNameDirectedWMI_Where.vbs.
|
3. | Modify the vWhere clause to include the requirement that the Process ID (PID) is greater than 100. Your completed vWhere line might look like the following:
vWhere = " where threadCount > '10' and ProcessID >100"
|
4. | Save your script and run it in CScript. Notice how many lines of data are returned.
|
5. | Modify the vWhere clause so that the PID must be greater than 1,000. Your code will look like the following:
vWhere = " where threadCount > '10' and ProcessID >1000"
|
6. | Save the script and run it in CScript. Notice how the data set has been trimmed.
|
7. | Now change the thread count so that it is 50. Your code will look like the following:
vWhere = " where threadCount > '50' and ProcessID >1000"
|
8. | How many lines of data are returned now? On my machine there are none.
|
9. | Now you are going to switch operators. Change the and to an or. The line will now look like the following:
vWhere = " where threadCount > '50' or ProcessID >1000"
|
10. | Look through the data that is returned. You will see data in which the thread count is greater than 50, and you will see data in which the process ID is greater than 1,000, but you will probably not see both in a single data set (that is what we did in step 7).
|
11. | Save and run your script. If there are problems, compare your script with the DirectedWMI_Where.vbs script in the One Step Further folder.
|