我正在尝试执行进程内存使用情况监视器。
以下是代码:
$Poll = 120
$query = "Select * from CIM_InstanceModification within $Poll where TargetInstance ISA 'Win32_Process' AND TargetInstance.WorkingSetSize>=$(500MB)"
$action={
#create a log file
$logPath= "C:\Users\phant\Documents\Powershell\LOGS\MEM.txt"
"[$(Get-Date)] Computername = $($_.SourceEventArgs.NewEvent.SourceInstance.CSName)" | Out-File -FilePath $logPath -Append -Encoding ascii
"[$(Get-Date)] Process = $($_.SourceEventArgs.NewEvent.SourceInstance.Name)" | Out-File -FilePath $logPath -Append -Encoding ascii
"[$(Get-Date)] Command = $($_.SourceEventArgs.NewEvent.SourceInstance.Commandline)" | Out-File -FilePath $logPath -Append -Encoding ascii
"[$(Get-Date)] PID = $($_.SourceEventArgs.NewEvent.SourceInstance.ProcessID)" | Out-File -FilePath $logPath -Append -Encoding ascii
"[$(Get-Date)] WS(MB) = $([math]::Round($_.SourceEventArgs.NewEvent.SourceInstance.WorkingSetSize/1MB,2))" | Out-File -FilePath $logPath -Append -Encoding ascii
"[$(Get-Date)] $('*' * 60)" | Out-File -FilePath $logPath -Append -Encoding ascii
#create a popup
$wsh = New-Object -ComObject Wscript.shell
$Title = "$(Get-Date) High Memory Alert"
$msg = @"
Process = $($Event.SourceEventArgs.NewEvent.SourceInstance.Name)
PID = $($Event.SourceEventArgs.NewEvent.SourceInstance.ProcessID)
WS(MB) = $([math]::Round($Event.SourceEventArgs.NewEvent.SourceInstance.WorkingSetSize/1MB,2))
"@
#timeout in seconds. Use -1 to require a user to click OK.
$Timeout = 10
$wsh.Popup($msg,$TimeOut,$Title,16+32)
}
Register-CimIndicationEvent -Query $query -SourceIdentifier "HighProcessMemory" -Action $action
我尝试使用__InstanceModificationEvent代替CIM_InstanceModification。我得到了相同的值,NULL。
当我在powershell控制台中尝试时,出现此错误:
$Poll = 120
$query = "Select * from CIM_InstModification within $Poll where TargetInstance ISA 'Win32_Process' AND TargetInstance.WorkingSetSize>=$(500MB)"
Get-WmiObject -Query $query
Get-WmiObject : Consulta invalid "Select * from CIM_InstModification within 120 where TargetInstance ISA 'Win32_Process' AND TargetInstance.WorkingSetSize>=524288000"
line:1 character:1
+ Get-WmiObject -Query $query
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidArgument: (:) [Get-WmiObject], ManagementException
+ FullyQualifiedErrorId : GetWMIManagementException,Microsoft.PowerShell.Commands.GetWmiObjectCommand
总是当我使用“WITHIN”子句时,查询不起作用。 CIM_InstModification和__InstanceModifcationEvent都与它兼容。那有什么不对?有人有想法吗?
谢谢!