Sysinternals PsTools


Most UNIX operating systems ship with a command-line tool called "ps" (or something equivalent) that administrators use to view detailed information about process CPU and memory usage. Windows NT/2K comes with no such tool natively, but you can obtain similar tools with the Windows NT Workstation or Server Resource Kits. The tools in the Resource Kits, pstat and pmon, show you different types of information, and will only display data regarding the processes on the system on which you run the tools.

PsList is utility that shows you a combination of the information obtainable individually with pmon and pstat. You can view process CPU and memory information, or thread statistics. What makes PsList more powerful than the Resource Kit tools is that you can view process and thread statistics on a remote computer.


Copy PsList onto your executable path and type "pslist".


The default behavior of PsList is to show CPU-oriented information for all the processes that are currently running on the local system. The information listed for each process includes the time the process has executed, the amount of time the process has executed in kernel and user modes, and the amount of physical memory that the OS has assigned the process. Command-line switches allow you to view memory-oriented process information, thread statistics, or all three types of data.

usage: pslist [-?] [-d] [-m] [-x][-t][-s [n] [-r n]  [\\computer [-u username] [-p password]] [[-e] name | pid]



This switch has PsList show statistics for all active threads on the system, grouping threads with their owning process.



This switch has PsList show memory-oriented information for each process, rather than the default of CPU-oriented information.



With this switch PsList shows CPU, memory and thread information for each of the processes specified.



Show process tree.


-s [n]

Run in task-manager mode, for optional seconds specified.

Press Escape to abort.


-r n

Task-manager mode refresh rate in seconds (default is 1).



Specifies optional user name for login to remote computer.



Specifies optional password for user name. If you omit this you will be prompted to enter a hidden password.



Instead of listing all the running processes in the system, this parameter narrows PsList's scan to those processes that begin with the name process. Thus:

pslist exp

would statistics for all the processes that start with "exp", which would include Explorer.



Use the -e switch if you want the process name to be treated as an exact match instead of a partial match.



Instead of listing all the running processes in the system, this parameter narrows PsList's scan to the process that has the specified PID. Thus:

pslist 53

would dump statistics for the process with the PID 53.