Processes COM Input Format sample
This sample COM input format implements an enumerator of processes that are currently running.
The following steps need to be performed in order to use this input format:
- Build the sample code. You will have to use different commands depending on your build environment, however, in most cases, you can use NMAKE just by typing:
NMAKE
The build process will create a ProcessesInputContext.dll binary.
- Register the ProcessesInputContext.dll binary with the following command:
regsvr32 ProcessesInputContext.dll
- To see the fields returned by this input format, execute the following Log Parser command:
logparser -h -i:COM -iprogid:MSUtil.LogQuery.Sample.Processes
- Execute the following Log Parser query to retrieve information about the currently running processes:
logparser "SELECT * FROM ." -i:COM -iprogid:MSUtil.LogQuery.Sample.Processes
The query will return:
ImageName PID ParentPID Threads
---------------- --- --------- -------
[System Process] 0 0 2
System 4 0 74
smss.exe 336 4 2
csrss.exe 392 336 13
winlogon.exe 424 336 24
services.exe 468 424 21
lsass.exe 480 424 33
svchost.exe 636 468 12
svchost.exe 688 468 20
svchost.exe 772 468 14