Tuesday, April 6, 2010

Command line utility in Linux and Windows operating system

Kill Processes from Command Prompt
Killing processes in Command Prompt provides much more control and the ability to end multiple processes at once.
All of this is possible with the TaskKill command. First, let's cover the basics. You can kill a process by the process ID (PID) or by image name (EXE filename).
Open up an Administrative level Command Prompt and run tasklist to see all of the running processes:
C:\>tasklist

Image Name PID Session Name Mem Usage
========================= ======== ================ ============
firefox.exe 26356 Console 139,352 K
regedit.exe 24244 Console 9,768 K
cmd.exe 18664 Console 2,380 K
conhost.exe 2528 Console 7,852 K
notepad.exe 17364 Console 7,892 K
notepad.exe 24696 Console 22,028 K
notepad.exe 25304 Console 5,852 K
explorer.exe 2864 Console 72,232 K
In the example above you can see the image name and the PID for each process. If you want to kill the firefox process run:
C:\>Taskkill /IM firefox.exe /F

Or

C:\>Taskkill /PID 26356 /F
The /f flag is kills the process forcefully. Failure to use the /F flag will result in nothing happening in some cases. One example is whenever I want to kill the explorer.exe process I have to use the /F flag or else the process just does not terminate.
If you have multiple instances of an image open such as multiple firefox.exe processes, running the taskkill /IM firefox.exe command will kill all instances. When you specify the PID only the specific instane of firefox will be terminated.
The real powers of taskkill are the filtering options that allow you to use the following variables and operators.
Variables:
· STATUS
· IMAGENAME
· PID
· SESSION
· CPUTIME
· MEMUSAGE
· USERNAME
· MODULES
· SERVICES
· WINDOWTITLE
Operators:
· eq (equals)
· ne (not equal)
· gt (greater than)
· lt (less than)
· ge (greater than or equal)
· le (less than or equal)
"*" is the wildcard.
You can use the variables and operators with the /FI filtering flag. For example, let's say you want to end all processes that have a window title that starts with "Internet":
C:\>taskkill /FI "WINDOWTITLE eq Internet*" /F
How about killing all processes running under the Steve account:
C:\>taskkill /FI "USERNAME eq Steve" /F
It is also possible to kill a process running on a remote computer with taskkill. Just run the following to kill notepad.exe on a remote computer called SteveDesktop:
C:\>taskkill /S SteveDesktop /U RemoteAccountName /P RemoteAccountPassword /IM notepad.exe /F

To learn more about taskkill run it with the /? Command just like any other Windows command.
What is svchost.exe?
First appearing in XP, svchost.exe hosts multiple services within one process. This allows the Operator save memory by reducing process overhead by cutting down on the number of processes that need to be running.
Every system service such as Windows Update, Event Log, Terminal Services, Audio Service, etc. runs within svchost.exe. Depending on the access the services need, they are grouped together and are run in a number of processes which explains why you see so many in Task Manager running under different accounts such as System, Local Service and Network Service.
Identifying what services are running is different depending on the version of Windows you have.
Windows XP
In Windows XP at a command prompt run:
tasklist /svc

The tasklist utility will show you what processes are running under each svchost.exe process.
Windows Vista and Windows 7
Task manager in Windows Vista and Windows 7 has been enhanced so you can easily see what services are running inside a host process such as svchost.exe.
Click on the Start Button, type in taskmgr and hit Enter. When task manager loads, click on the Processes tab and click Show processes from all users to see all of the svchost.exe processes. Then, right click on a svchost.exe process and select Go to Service(s). You will be taken to the Services tab with all services running in that process highlighted.
All Versions of Windows
Microsoft Sysinternals has a great free utility called Process Explorer that is like a task manager on steroids. It works on all versions of Windows and allows you to easily see services running inside of svchost.exe. Download Process Explorer here. Once you have it running right click on any process and select Properties. Then click on the Services tab and you will see all processes running inside the host process.

Improve Multi-Tasking with Virtual Desktops
After you download Sysinternals Desktops and run it you will see a new icon in the system tray that looks like 4 blocks. If you click on the icon you will see a preview of what you have open on each desktop
You can also right click on the systray icon and select Options where you can set the various shortcut keys you can use to switch between desktops.
Convert FAT32 To NTFS
To change from FAT 32 to NTFS file system for more stability, security and less fragmentation, open the command prompt and type:
Convert C: /FS:NTFS
"C" being the drive you wish to convert. Make sure there is a space between the C: and the foward slash (/). Once you press enter it will ask you for confirmation and press Y. Then press Y and enter once more to reboot.. This also works for Windows XP Home.

No comments: