Powershell has many cmdlets that help users perform various tasks. In this post, I will use several commands to collect CPU and memory usage of processes.
Collect Process CPU Usage
Powershell has a Get-Counter cmdlet. This cmdlet let users to obtain metrics of the system. One of the counters that you can use is “\Processor(*)\% Processor Time“. Open your powershell, and run the following command:
Get-Counter '\Process(*)\% Processor Time'
The result looks like:
Timestamp CounterSamples
--------- --------------
12/14/2023 13:34:51 \\desktop-i239dsl\process(idle)\% processor time :
1585.45028754809
\\desktop-i239dsl\process(system)\% processor time :
0
\\desktop-i239dsl\process(secure system)\% processor time :
0
\\desktop-i239dsl\process(registry)\% processor time :
0
\\desktop-i239dsl\process(smss)\% processor time :
0
\\desktop-i239dsl\process(csrss#1)\% processor time :
1.5558884077999
\\desktop-i239dsl\process(csrss)\% processor time :
0
\\desktop-i239dsl\process(wininit)\% processor time :
0
\\desktop-i239dsl\process(winlogon)\% processor time :
0
\\desktop-i239dsl\process(services)\% processor time :
0
\\desktop-i239dsl\process(lsaiso)\% processor time :
0
\\desktop-i239dsl\process(lsass)\% processor time :
0
\\desktop-i239dsl\process(svchost#77)\% processor time :
0
\\desktop-i239dsl\process(fontdrvhost#1)\% processor time :
0
\\desktop-i239dsl\process(fontdrvhost)\% processor time :
0
\\desktop-i239dsl\process(svchost#76)\% processor time :
0
\\desktop-i239dsl\process(svchost#75)\% processor time :
0
\\desktop-i239dsl\process(dwm)\% processor time :
1.5558884077999
\\desktop-i239dsl\process(svchost#74)\% processor time :
0
\\desktop-i239dsl\process(svchost#73)\% processor time :
0
\\desktop-i239dsl\process(svchost#72)\% processor time :
0
\\desktop-i239dsl\process(svchost#71)\% processor time :
0
\\desktop-i239dsl\process(svchost#70)\% processor time :
0
\\desktop-i239dsl\process(svchost#69)\% processor time :
0
\\desktop-i239dsl\process(svchost#68)\% processor time :
0
\\desktop-i239dsl\process(svchost#67)\% processor time :
0
\\desktop-i239dsl\process(svchost#66)\% processor time :
0
\\desktop-i239dsl\process(svchost#65)\% processor time :
0
\\desktop-i239dsl\process(svchost#64)\% processor time :
0
\\desktop-i239dsl\process(svchost#63)\% processor time :
0
\\desktop-i239dsl\process(svchost#62)\% processor time :
0
\\desktop-i239dsl\process(svchost#61)\% processor time :
1.5558884077999
\\desktop-i239dsl\process(nvdisplay.container#1)\% processor time :
0
\\desktop-i239dsl\process(svchost#60)\% processor time :
0
\\desktop-i239dsl\process(dashost)\% processor time :
0
\\desktop-i239dsl\process(svchost#59)\% processor time :
0
\\desktop-i239dsl\process(svchost#58)\% processor time :
0
\\desktop-i239dsl\process(svchost#57)\% processor time :
0
\\desktop-i239dsl\process(svchost#56)\% processor time :
0
\\desktop-i239dsl\process(svchost#55)\% processor time :
0
\\desktop-i239dsl\process(svchost#54)\% processor time :
0
\\desktop-i239dsl\process(svchost#53)\% processor time :
0
\\desktop-i239dsl\process(svchost#52)\% processor time :
0
\\desktop-i239dsl\process(svchost#51)\% processor time :
0
\\desktop-i239dsl\process(svchost#50)\% processor time :
0
\\desktop-i239dsl\process(svchost#49)\% processor time :
0
\\desktop-i239dsl\process(svchost#48)\% processor time :
0
\\desktop-i239dsl\process(nvdisplay.container)\% processor time :
0
\\desktop-i239dsl\process(svchost#47)\% processor time :
0
\\desktop-i239dsl\process(svchost#46)\% processor time :
0
\\desktop-i239dsl\process(svchost#45)\% processor time :
0
\\desktop-i239dsl\process(svchost#44)\% processor time :
0
\\desktop-i239dsl\process(svchost#43)\% processor time :
0
\\desktop-i239dsl\process(spoolsv)\% processor time :
0
\\desktop-i239dsl\process(svchost#42)\% processor time :
0
\\desktop-i239dsl\process(svchost#41)\% processor time :
0
\\desktop-i239dsl\process(svchost#40)\% processor time :
0
\\desktop-i239dsl\process(svchost#39)\% processor time :
0
\\desktop-i239dsl\process(svchost#38)\% processor time :
0
\\desktop-i239dsl\process(svchost#37)\% processor time :
0
\\desktop-i239dsl\process(svchost#36)\% processor time :
0
\\desktop-i239dsl\process(svchost#35)\% processor time :
0
\\desktop-i239dsl\process(svchost#34)\% processor time :
0
\\desktop-i239dsl\process(svchost#33)\% processor time :
0
\\desktop-i239dsl\process(rtkbtmanserv)\% processor time :
0
\\desktop-i239dsl\process(svchost#32)\% processor time :
0
\\desktop-i239dsl\process(svchost#31)\% processor time :
0
\\desktop-i239dsl\process(armsvc)\% processor time :
0
\\desktop-i239dsl\process(rtkauduservice64#1)\% processor time :
0
\\desktop-i239dsl\process(msmpeng)\% processor time :
0
\\desktop-i239dsl\process(svchost#30)\% processor time :
0
\\desktop-i239dsl\process(svchost#29)\% processor time :
0
\\desktop-i239dsl\process(svchost#28)\% processor time :
0
\\desktop-i239dsl\process(svchost#27)\% processor time :
0
\\desktop-i239dsl\process(svchost#26)\% processor time :
0
\\desktop-i239dsl\process(svchost#25)\% processor time :
0
\\desktop-i239dsl\process(svchost#24)\% processor time :
0
\\desktop-i239dsl\process(svchost#23)\% processor time :
0
\\desktop-i239dsl\process(nissrv)\% processor time :
0
\\desktop-i239dsl\process(svchost#22)\% processor time :
0
\\desktop-i239dsl\process(svchost#21)\% processor time :
0
\\desktop-i239dsl\process(sihost)\% processor time :
0
\\desktop-i239dsl\process(svchost#20)\% processor time :
0
\\desktop-i239dsl\process(svchost#19)\% processor time :
0
\\desktop-i239dsl\process(svchost#18)\% processor time :
0
\\desktop-i239dsl\process(taskhostw)\% processor time :
0
\\desktop-i239dsl\process(svchost#17)\% processor time :
0
\\desktop-i239dsl\process(ctfmon)\% processor time :
0
\\desktop-i239dsl\process(svchost#16)\% processor time :
0
\\desktop-i239dsl\process(chsime)\% processor time :
0
\\desktop-i239dsl\process(explorer)\% processor time :
0
\\desktop-i239dsl\process(svchost#15)\% processor time :
0
\\desktop-i239dsl\process(svchost#14)\% processor time :
0
\\desktop-i239dsl\process(tsvncache)\% processor time :
0
\\desktop-i239dsl\process(startmenuexperiencehost)\% processor time :
0
\\desktop-i239dsl\process(runtimebroker#3)\% processor time :
0
\\desktop-i239dsl\process(runtimebroker#2)\% processor time :
0
\\desktop-i239dsl\process(lockapp)\% processor time :
0
\\desktop-i239dsl\process(runtimebroker#1)\% processor time :
0
\\desktop-i239dsl\process(textinputhost)\% processor time :
0
\\desktop-i239dsl\process(svchost#13)\% processor time :
0
\\desktop-i239dsl\process(securityhealthsystray)\% processor time :
0
\\desktop-i239dsl\process(rtkauduservice64)\% processor time :
0
\\desktop-i239dsl\process(securityhealthservice)\% processor time :
0
\\desktop-i239dsl\process(ttpmenu)\% processor time :
0
\\desktop-i239dsl\process(svchost#12)\% processor time :
0
\\desktop-i239dsl\process(searchapp)\% processor time :
0
\\desktop-i239dsl\process(svchost#11)\% processor time :
0
\\desktop-i239dsl\process(svchost#10)\% processor time :
0
\\desktop-i239dsl\process(googlecrashhandler)\% processor time :
0
\\desktop-i239dsl\process(googlecrashhandler64)\% processor time :
0
\\desktop-i239dsl\process(sgrmbroker)\% processor time :
0
\\desktop-i239dsl\process(svchost#9)\% processor time :
0
\\desktop-i239dsl\process(mousocoreworker)\% processor time :
0
\\desktop-i239dsl\process(svchost#8)\% processor time :
0
\\desktop-i239dsl\process(svchost#7)\% processor time :
0
\\desktop-i239dsl\process(svchost#6)\% processor time :
0
\\desktop-i239dsl\process(svchost#5)\% processor time :
0
\\desktop-i239dsl\process(svchost#4)\% processor time :
0
\\desktop-i239dsl\process(svchost#3)\% processor time :
0
\\desktop-i239dsl\process(musnotifyicon)\% processor time :
0
\\desktop-i239dsl\process(useroobebroker)\% processor time :
0
\\desktop-i239dsl\process(msedge#13)\% processor time :
0
\\desktop-i239dsl\process(msedge#12)\% processor time :
0
\\desktop-i239dsl\process(msedge#11)\% processor time :
0
\\desktop-i239dsl\process(msedge#10)\% processor time :
0
\\desktop-i239dsl\process(msedge#9)\% processor time :
0
\\desktop-i239dsl\process(msedge#8)\% processor time :
0
\\desktop-i239dsl\process(msedge#7)\% processor time :
0
\\desktop-i239dsl\process(msedge#6)\% processor time :
0
\\desktop-i239dsl\process(msedge#5)\% processor time :
10.8912188545993
\\desktop-i239dsl\process(msedge#4)\% processor time :
0
\\desktop-i239dsl\process(runtimebroker)\% processor time :
0
\\desktop-i239dsl\process(dllhost)\% processor time :
0
\\desktop-i239dsl\process(powershell#1)\% processor time :
0
\\desktop-i239dsl\process(conhost#1)\% processor time :
0
\\desktop-i239dsl\process(msedge#3)\% processor time :
0
\\desktop-i239dsl\process(msedge#2)\% processor time :
4.66766522339969
\\desktop-i239dsl\process(msedge#1)\% processor time :
0
\\desktop-i239dsl\process(svchost#2)\% processor time :
0
\\desktop-i239dsl\process(svchost#1)\% processor time :
0
\\desktop-i239dsl\process(powershell)\% processor time :
1.5558884077999
\\desktop-i239dsl\process(conhost)\% processor time :
0
\\desktop-i239dsl\process(wmiapsrv)\% processor time :
0
\\desktop-i239dsl\process(notepad++)\% processor time :
0
\\desktop-i239dsl\process(msedge)\% processor time :
0
\\desktop-i239dsl\process(svchost)\% processor time :
0
\\desktop-i239dsl\process(audiodg)\% processor time :
0
\\desktop-i239dsl\process(_total)\% processor time :
1607.23272525729
You can find that the timestamp is just when the user ran this command. What we need is just the CounterSamples part. So with following command, the CounterSamples part is extracted.
(Get-Counter '\Process(*)\% Processor Time').CounterSamplesThis gives a list of all processes with CPU usages. But it is too many for performance monitoring. Therefore, I will restrict the results to those having nonzero CPU usages. This is done with the following command.
(Get-Counter '\Process(*)\% Processor Time').CounterSamples | Where-Object {$_.CookedValue -gt 0}This results in something like the following:
Path InstanceName CookedValue
---- ------------ -----------
\\desktop-i239dsl\process(idle)\% processor time idle 1582.2080773409
\\desktop-i239dsl\process(svchost#61)\% processor time svchost 3.11765138392296
\\desktop-i239dsl\process(msedge#5)\% processor time msedge 4.67647707588443
\\desktop-i239dsl\process(msedge#2)\% processor time msedge 3.11765138392296
\\desktop-i239dsl\process(svchost#1)\% processor time svchost 1.55882569196148
\\desktop-i239dsl\process(_total)\% processor time _total 1594.67868287659
The CookedValue column is the “percentage” of CPU use. You can find that the values can be greater than 100. This is because it adds multiple cores. On my PC, there are 16 cores, so it sums to about 1600.
Collect Process Memory Usage
To get memory usage, another cmdlet Get-Process is useful. It goes like as below:
Get-Process | Where-Object {$_.CPU -gt 0} | Format-Table -Property Name, WSHere, like in the previous section, I used the Where-Object cmdlet to restrict the result to active processes only. And because Get-Process can give a long list of properties of every process, I restrict to two fields. Name is the name of the process. WS is is the working set memory in KB. The output goes like the following:
Name WS
---- --
ChsIME 7901184
conhost 16814080
conhost 17293312
ctfmon 21581824
dllhost 13258752
explorer 207691776
LockApp 61153280
msedge 20189184
msedge 289972224
msedge 17846272
msedge 29536256
msedge 47423488
msedge 106610688
msedge 123375616
msedge 125349888
msedge 168783872
msedge 128581632
msedge 191397888
msedge 104919040
msedge 21688320
msedge 120528896
msedge 8261632
MusNotifyIcon 14864384
notepad++ 30425088
powershell 98615296
powershell 101376000
RtkAudUService64 9863168
RuntimeBroker 28770304
RuntimeBroker 24854528
RuntimeBroker 41598976
RuntimeBroker 32833536
SearchApp 266919936
SecurityHealthSystray 9510912
sihost 29876224
StartMenuExperienceHost 73383936
svchost 13090816
svchost 25026560
svchost 33251328
svchost 8740864
svchost 22769664
taskhostw 18632704
TextInputHost 53374976
TSVNCache 9928704
ttpmenu 12865536
UserOOBEBroker 10113024
Summary
This article, I mentioned two ways for collecting CPU and memory usages, respectively. These outputs can be treated as input data matrices for producing higher level summaries like identifying usage pattern or bottleneck, etc.
Wish this helpful!