Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How do you typically identify processes in windows' task manager when trouble shooting a problematic system?

It's easy enough to get a list of tasks via the task manager but how do you determine which ones should stay and which are candidates for removal?

share|improve this question

6 Answers 6

up vote 11 down vote accepted

I typically use a combination of two tools when I doing this.

First Process Explorer, which is basically Task Manager on crack. I really don't know why Micorsoft doesn't just replace one for the other. this application will tell what processes are running, whether they are a sub process of another, who the owner of the process is, what files are in use by that process, the time in which it started, its path, etc. There is very little that this tool won't tell you from a basic level. It even has built-in Google searching for looking up further info on the internet about a process.

Second is the Process Explorers close cousin, Process Monitor. Process Monitor is similar to process explorer, only it shows you much more verbose information about what a process is doing. This tool will show what files and registry keys a process is try read/delete/modify, what is being written to registry/file system whenever changes are made. Because this one is so much more verbose, I have to warn you with caution that if you are trying to use it on a older/weaker computer as it may crash the system do to system overload. You can however apply filters to help limit the amount of input which comes out of it, which is probably the preferred way since this tool really shows you too much when the view is not filtered to hide whatever is not related to your troubleshooting.

share|improve this answer
    
i think process explorer would give a normal windows user an information-overload induced epileptic fit. That's why MS doesn't replace it. –  Nick Kavadias May 5 '09 at 15:10
    
They could have easily made it an advanced mode like they do on a calculator; Basic / Scientific –  mrTomahawk May 5 '09 at 15:50
    
Luckily there is an option in Process Explorer to replace task manager. Too bad it opens slow sometimes. –  Terry May 5 '09 at 15:51

If you type in the names of the executables into google, you'll typically get some pages detailing what those processes belong to.

From that you can decide what belongs and what doesn't.

share|improve this answer
    
The only problem with this is that many viruses and trojans will run under the same names as commonly known exe, spoofing you into thinking that it is actually something else running. –  mrTomahawk May 5 '09 at 14:31
1  
The question was not asking about viruses. Using task manager as an antivirus is fairly naive. –  Kevin Laity May 5 '09 at 14:42

Start with anything using a lot of memory or CPU time.

share|improve this answer
  1. Google
  2. Hijackthis take the log to Hijackthis.de
  3. Process Monitor
  4. Process Explorer this has a host of information including if it's packed
share|improve this answer
1  
Isn't download.com a breeding ground for suspect software? I'm trying to clean a system not build up it's immune system. –  Todd Smith May 5 '09 at 17:31
1  
I have ever only had one malicious file from there and it was removed in an hour. I have pointed the link to filehippo.com instead. It's actually a good piece of software. –  Terry May 5 '09 at 18:49

The nice thing about Windows problem solving is that someone somewhere will have come across the problem you have and it'll be searchable via Google - so just search for "what is xxx" and I'm sure you'll find even the least popular windows code listed lots of times.

share|improve this answer

For any new server, take time to work out what happens during normal use. Only then will you be able to identify what's not right.

Most server-affecting issues are visible on the Performance tab, so start there and then drill down. Alternatively, start at the top of the Application and System event logs. Until you become familiar with them, you may have to Google these to determine if they're extraordinary.

As a general rule, most failing processes will not be in %systemroot%\system32, except dllhost.exe (which hosts IIS objects). It's better to trace the problem than guess it from the process, so map network usage and locked files to processes using Process Explorer. If that's impossible, become familiar with these:

netstat -ano
netstat -e
tasklist
openfiles

These have the advantage of working over telnet/psexec. If you find something has gone mad, try to use the services tab to stop the related service before killing the process. And never close handles, no matter how tempting it is.

Also, don't neglect Performance Monitor. It takes a little more work than other sources, but will allow you to start logging candidates if you missed the spike.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.