Get Process CPU Usage Using WMI

I recently blogged about another method to obtain a process’ CPU usage via Command Line: Get CPU Usage of a Process from Command Line

Here’s a quick command line method for grabbing CPU usage of a process by process id, process name, or caption.

By Process ID

wmic path win32_perfformatteddata_perfproc_process where (IDProcess = '3488') get Name, Caption, PercentProcessorTime, IDProcess /format:list
byprocid

By Process Name

wmic path win32_perfformatteddata_perfproc_process where (Name='iexplore') get Name, Caption, PercentProcessorTime, IDProcess /format:list
byprocname

By Process Name (fuzzy)

wmic path win32_perfformatteddata_perfproc_process where (Name like '%iexp%') get Name, Caption, PercentProcessorTime, IDProcess /format:list
byprocnamefuzzy

Any processes with CPU time over 50%

wmic path win32_perfformatteddata_perfproc_process where (PercentProcessorTime ^> 50) get Name, Caption, PercentProcessorTime, IDProcess /format:list
bycputime

23 thoughts on “Get Process CPU Usage Using WMI

  1. Nehemoth

    Nice Job, I’ve been searching for this a long time and that one of CPU higher than is neat.
    One question tough, do you know if I can search for a specific process with CPU time over 50%?.
    Would be like the merger of 2 querys but I don’t know how to do it.
    Thank you

    Reply
  2. Nehemoth

    Hey thank you for the really fast answer.
    The script works like a charm for me, but one last thing, could be modified so only look to one specific process?, for example the process iexplore
    Thank you

    Reply
  3. Nehemoth

    I guess this is the one
    wmic path win32_perfformatteddata_perfproc_process where (PercentProcessorTime ^> 5 and Name ^ _Total and Name ^ Idle and Name ^ wmiprvse and name=’w3wp’) get Name, PercentProcessorTime, IDProcess /format:list
    πŸ™‚

    Reply
  4. Nehemoth

    But at the end of the day there is a problem.
    For some reason sometimes I get No Instance(s) Available, even when I can see in the task manager that the process is right about my mark, also I just get 100 or 0 instead of the real value which should be between 5 to 50
    Thank you for your help

    Reply
  5. Rich Kreider Post author

    This, for example, will find processes with CPU time over 5% in this example. Replace 5 with the % you would like. Let me know if this works for you.
    Note: This is one long line. Also, looks like there is a problem with this <code> or <pre> tag; It puts a space between the ^< ^> which it shouldn’t so if you copy and paste this it will give you an invalid query. Take the space out from between each of the ^< ^>.

    wmic path win32_perfformatteddata_perfproc_process where (PercentProcessorTime ^> 5 and Name ^< ^> _Total and Name ^< ^> Idle) get Name, Caption, PercentProcessorTime, IDProcess /format:list


    I’m not sure I understand what you ask about searching for a specific process over 50%. Can you elaborate?

    Reply
  6. Rich Kreider Post author
    wmic path win32_perfformatteddata_perfproc_process where (PercentProcessorTime ^> 5 and Name ^< ^> _Total and Name ^< ^> Idle and Name LIKE iexplore%) get Name, Caption, PercentProcessorTime, IDProcess, CreatingProcessID /format:list


    When you look at the results, you’ll see the CreatingProcessID in this now; Each tab runs under it’s own process ID. If you want to get details about the iexplore.exe process itself, you will want to query the PROCESS alias or win32_process path.

    wmic process where (handle = "2788") get /Value

    This will give you details on the actual iexplore.exe process.

    Reply
  7. Rich Kreider Post author

    You could try just logging some entries for the process to CSV format and reviewing them.

    logman create counter w3wp_proc -c Process(w3wp*)% Processor Time
    logman update w3wp_proc -si 10 -f csv -v mmddhhmm

    That will update every 10 seconds. To stop it, just: logman stop w3wp_proc
    Jump into c:perflogs and open up the CSV that will be in there for w3wp_proc. Maybe confirm if that counter isn’t broken by chance.

    Reply
    1. JMAD

      Rick Great blog here it has been very helpful.
      Do you know how I would be able to automatically terminate the process that the query returns?
      thank you,

      Reply
      1. Rich Kreider Post author

        Setup your query to return the handles (I just use a quick filter ‘name’ instead of processor usage)

        wmic process where (name like "chrome%") get handle /format:list

        Returns the handles and if you know the handle…

        wmic process where (handle = "2964") call terminate

        You could implement that into a batch script.

        Reply
  8. Zee

    So I’ve been trying to figure out how to determine process cpu utilization…and I cannot get an accurate number. When querying as you specified (as well as other sites), I cannot accurately get % CPU utilization of a process on a multi-processor OS. For example, if the process is using more than 25% of a 4-core server, the query only returns 100. Here is the query string: Select * from Win32_PerfFormattedData_PerfProc_Process where Name=’sqlservr’. Again, if the process is using a good portion of processor, it always says 100….I don’t understand why. Any thoughts?

    Reply
    1. Steve

      I wish I had seen your response sooner. I am running into the same issue. Most of the processes are reporting either 0 or 100%.

      Reply
    2. Rich Kreider Post author

      It may be possible to modify this somewhat to get the desired results if it’s not what you’re looking for:
      See: http://www.techish.net/windows/get-cpu-usage-of-a-process-from-command-line

      And: http://stackoverflow.com/questions/69332/tracking-cpu-and-memory-usage-per-process/10515335#10515335
      I had posted that earlier in May of this year.
      Process(_Total)% Processor Time will be N*100 (where N is the number of CPUs) because it adds up the CPU usage of each process,including the idle process.
      Process(…)% Processor Time can go up to N*100 (where N is the number of CPUs) because it adds up the CPU usage of the requested process across all the CPUs.
      Processor(…)% Processor Time can go up to 100 because it is the CPU usage of the requested CPU.
      Processor(_Total)% Processor Time can go up to 100 because it is the average CPU usage across all CPUs
      I think this gets beyond the scope of WMI/WMIC and would be better suited in either powershell or some other scripting/programming language possibly to be able to programmatically get the per-cpu/core usage stats. If someone knows, let me know then. =)

      Reply
      1. Steve

        Thanks for the prompt and thorough response. I am actually writing my script in PowerShell. When I resolve the issue and if my results are applicable to this thread, I will post my solution. Thanks again.

        Reply
  9. sabir

    Can you let me know how can i pull all processes with CPU and memory utilization remotely from a PC in column wise with WMIC?

    Reply
  10. Rich Kreider Post author

    Hi sabir,
    You can use wmic /node:COMPUTERNAME to get to the remote computer.
    Thanks,
    Rich

    Reply
  11. butool

    when i run this
    wmic path win32_perfformatteddata_perfproc_process where (IDProcess = ‘3488β€˜) get Name, Caption, PercentProcessorTime, IDProcess /format:list
    it showing error as invalid query

    Reply
    1. Rich Kreider Post author

      Butool,
      I fixed the formatting of the command. If you look at the quotes, they are invalid (a formatting issue on WordPress side when I originally posted the article.
      Try with the following:
      Notice the difference:
      β€˜3488β€˜ vs '3488'

      wmic path win32_perfformatteddata_perfproc_process where (IDProcess = '3488') get Name, Caption, PercentProcessorTime, IDProcess /format:list

      Sorry about that, I’ve fixed all the commands in this article!

      Reply
    1. Rich Kreider Post author

      Use something like the following to get the Process ID. You can then use that Process ID and construct the query above to get performance metrics.

      wmic path win32_service where (name= 'bits') get processid
      Reply
    2. Rich Kreider Post author

      A more complete example, using bits as the service name…

      @echo off
      for /f skip=2 tokens=2 delims=, %%A in ('wmic path win32_service WHERE name='bits' get processid/format:csv') DO SET pid=%%A
      wmic path win32_perfformatteddata_perfproc_process where (IDProcess = '%pid%') get Name, Caption, PercentProcessorTime, IDProcess /format:csv
      
      Reply

Leave a Reply

Your email address will not be published. Required fields are marked *