Processes COM Input Format sample

This sample COM input format implements an enumerator of processes that are currently running.

The following steps need to be performed in order to use this input format:

  1. Build the sample code. You will have to use different commands depending on your build environment, however, in most cases, you can use NMAKE just by typing:
    NMAKE
    The build process will create a ProcessesInputContext.dll binary.

  2. Register the ProcessesInputContext.dll binary with the following command:
    regsvr32 ProcessesInputContext.dll

  3. To see the fields returned by this input format, execute the following Log Parser command:
    logparser -h -i:COM -iprogid:MSUtil.LogQuery.Sample.Processes


  4. Execute the following Log Parser query to retrieve information about the currently running processes:
    logparser "SELECT * FROM ." -i:COM -iprogid:MSUtil.LogQuery.Sample.Processes
    The query will return:
    ImageName        PID ParentPID Threads
    ---------------- --- --------- -------
    [System Process] 0   0         2
    System           4   0         74
    smss.exe         336 4         2
    csrss.exe        392 336       13
    winlogon.exe     424 336       24
    services.exe     468 424       21
    lsass.exe        480 424       33
    svchost.exe      636 468       12
    svchost.exe      688 468       20
    svchost.exe      772 468       14