Question

有没有办法通过使用CMD或VBS在Windows下使用其PID值获取正在运行的应用程序的开始时间（包含日期），总运行时间和位置？如果是这样，怎么样？提前谢谢。

Answer 1

您可以使用VBScript查询Win32_Process WMI类，以获取进程的可执行路径和开始时间。持续时间可以从开始时间得出：

pid = 23

Set wmi = GetObject("winmgmts://./root/cimv2")
Set convert = CreateObject("WbemScripting.SWbemDateTime")

qry = "SELECT * FROM Win32_Process WHERE ProcessId = " & pid
For Each p In wmi.ExecQuery(qry)
  If IsNull(p.CreationDate) Then
    'leave start time and duration empty if CreationDate can't be read
    startTime = ""
    duration  = ""
  Else
    'convert start time from a string yyyyMMddHHmmss.ffffff±zzz to a date
    convert.Value = p.CreationDate
    startTime = convert.GetVarDate(True)

    'calculate duration in minutes
    duration  = DateDiff("n", startTime, Now)
  End If
  WScript.Echo startTime & vbTab & duration & vbTab & p.ExecutablePath
Next

请注意，您需要SeDebugPrivilege权限（管理员默认使用它）才能查看其他用户进程的可执行路径。如果没有该特权，p.ExecutablePath对于未在当前用户的上下文中运行的进程将为Null。

Answer 2

不是这样（时间路径可用）。

您可以监控流程的启动和退出并自行计算。

因此Tasklist /v为您提供包含路径的命令行。

VBS也是如此。

Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")

Set colItems = objWMIService.ExecQuery("Select * From Win32_Process")

For Each objItem in colItems
    msgbox objItem.ProcessID & " " & objItem.Caption
Next

这是一个监视进程启动和退出的VBS脚本。

Set WshShell = WScript.CreateObject("WScript.Shell")
Set objWMIService = GetObject("winmgmts:\\.\root\CIMV2") 
Set objEvents = objWMIService.ExecNotificationQuery _
    ("SELECT * FROM Win32_ProcessTrace")

Do
    Set objReceivedEvent = objEvents.NextEvent
    msgbox objReceivedEvent.ProcessName
Loop

没有StartTime

class Win32_Process : CIM_Process
{
  string Caption;
  string CommandLine;
  string CreationClassName;
  datetime CreationDate;
  string CSCreationClassName;
  string CSName;
  string Description;
  string ExecutablePath;
  uint16 ExecutionState;
  string Handle;
  uint32 HandleCount;
  datetime InstallDate;
  uint64 KernelModeTime;
  uint32 MaximumWorkingSetSize;
  uint32 MinimumWorkingSetSize;
  string Name;
  string OSCreationClassName;
  string OSName;
  uint64 OtherOperationCount;
  uint64 OtherTransferCount;
  uint32 PageFaults;
  uint32 PageFileUsage;
  uint32 ParentProcessId;
  uint32 PeakPageFileUsage;
  uint64 PeakVirtualSize;
  uint32 PeakWorkingSetSize;
  uint32 Priority;
  uint64 PrivatePageCount;
  uint32 ProcessId;
  uint32 QuotaNonPagedPoolUsage;
  uint32 QuotaPagedPoolUsage;
  uint32 QuotaPeakNonPagedPoolUsage;
  uint32 QuotaPeakPagedPoolUsage;
  uint64 ReadOperationCount;
  uint64 ReadTransferCount;
  uint32 SessionId;
  string Status;
  datetime TerminationDate;
  uint32 ThreadCount;
  uint64 UserModeTime;
  uint64 VirtualSize;
  string WindowsVersion;
  uint64 WorkingSetSize;
  uint64 WriteOperationCount;
  uint64 WriteTransferCount;
};

开始时间，运行持续时间＆amp; PID在Windows中的应用位置

2 个答案: