New Feature: Process Time Watcher and Killer.

[cyberglobe]

Hello,

I would like to first commend on the excellent program you have here however I still get some ptgui errors.

I have noticed a really important feature that is missing for this program which should be incorporated into Process Tamer.
How about a timeout period for a specific program name to not allow it run more than X amount of minutes.

Example:
I have a virus scan that runs via command line and should terminate within 120 seconds.  The program that spawns this virus scan can not properly terminate the program and leaves it hanging running at full tilt.  I would like to be able to select the program name and set a max CPU time per instance.  Now if it sees that one of the instances is running over the set X amount of seconds/Minutes/hours/days eg: 120 seconds of CPU time, then I would have process tamer kill the instance of the program. 

I hope something like this can be added.

Thanks.

[Hasi]

What do you think aubout http://www.quickmacros.com/features.html ?
Here You can select even CPU wait time or all other things to handle schedules and programs!

[cyberglobe]

Nope that does not help me out since it happens on multiple instances.
This is where Process Tamer would need to manage it.  By querying the process CPU usage time.

[mouser]

this is definitely one of the kinds of things PT could be made to do easily when i add a scripting feature.

[tranglos]

Here's another idea. I've been testing various backup programs recently, and now am looking at a couple of AV offerings. One of the things I'm concerned about is resource usage - memory and CPU.

It is easy enough to check current RAM and CPU usage, but I would love to be able to see a history of RAM and CPU usage for a specific process over several hours, say. This is because if there are any spikes in CPU usage by a process, I am unlikely to catch them as they happen, and sitting in front of the Task Manager for hours with a pencil in hand is a job for software, not humans.

Is it something you would consider implementing, mouser, or do you know of another program that can do this? I don't need any fancy graphs, just numeric values, measured say every second, that I could view and save. What do you say?

Thanks!
marek

[f0dder]

tranglos: wouldn't be very hard coding something like that... of course it would take a slight amount of system resources to monitor the app, but if you poll only each 100ms or something you wouldn't be able to feel the speed hit...

graphing the resource usage is the only "complicated" bit, personally I'd just export the data in .csv format and use excel :]

[tranglos]

tranglos: wouldn't be very hard coding something like that... of course it would take a slight amount of system resources to monitor the app, but if you poll only each 100ms or something you wouldn't be able to feel the speed hit...

-f0dder (November 15, 2007, 06:45 AM)

I should be able to write it myself, except that I am completely unfamiliar with the relevant APIs (what *are* the relevant APIs? :-).

[f0dder]

You can get some info with GetProcesssTimes() and GetProcessIoCounters(). For memory stats, you'll have to make some choices. If you don't particularly care about Win9x, you can use GetProcessMemoryInfo() from PSAPI... otherwise I guess you'll have to use the Performance Monitoring set of APIs, but that isn't very comfortable to work with.

[cyberglobe]

So, will the Process time watcher be added into this program?  If it does, I got $100 donation flying your way.

Just need to add CPU Time monitoring for a process and this will help us manage those pesky dos prompt executables that run rampant without being near the computer to deal with it.  Looks like my software vendor does not want to further fix the problem cause he says to use the Avast plugin version which I do not want to pay the premium for.

All that needs to be added is a new 2 new columns which will set "max cpu time" and "action for exceeding cpu time"

If Max CPU time is at 0:00:00 then it would ignore this setting.
Any other setting would then look at the action for exceeding CPU time.

Action for Exceeding CPU Time should have the following features:
Force Kill
Force Kill then Restart (Services only) "For services that get problematic after running for x amount of days..."
Ignore

[f0dder]

cyberglobe: when you say "DOS prompt executables", do you mean actual DOS programs, or win32 console programs? There's differences between the two, and I'm not sure whether you can query 16bit DOS executables as easily as you can 32bit windows...

[cyberglobe]

I am talking about CLAMSCAN.EXE from www.clamwin.com.  This is a command line executable that is most probably a 32-bit program.
When Clamscan.exe ends up locking up (no clue why cause it is executed via a shell command from our mail server and is not interactive) it ends up sucking up CPU usage.

This is why I would like to see 2 more columns to monitor CPU Time of a process and if it exceeds this time to issue a forced kill command.  I currently have it run at lowest priority but still it ends up overwhelming the system. 

Otherwise, I try to remotely log into the server (which never works cause the CPU is nailed to 100%) and have to travel to my outsourced co-location facility which charges me per visit when it is off peak hours (Free during peak hours).  This is why I would like to see Process tamer to monitor the CPU Time as well since you need to tame that as well for a process and kill it if it ends up being a rogue process, which in this case it is acting like one.

[f0dder]

Ugh, that sounds pretty nasty!

Yes, clamscan should be a 32bit console app, so it would be possible to track normally - but that's a job for mouser to implement

It sounds weird that it pegs down the CPU even if you run the task as low priority, are you sure that the priority setting works, that clamscam doesn't increase it's own priority manually, and that it doesn't start any child process with normal/higher priority?

[cyberglobe]

It sounds weird that it pegs down the CPU even if you run the task as low priority, are you sure that the priority setting works, that clamscam doesn't increase it's own priority manually, and that it doesn't start any child process with normal/higher priority?

Clamscan starts off with normal priority then Process tamer sends it to low priority and it does not spawn any additional child processes.  What eventually happens is the Memory gets chewed up, then the server runs 1000 times slower cause it is now paging to the hard drive.   For each instance of Clamscan, it has to read the virus database, then scan through the file to be scanned.  When you got 30-50 of these processes, you can see how it can snowball.

Could it be possible that process tamer did not have enough time to capture the process and switch the priority?

[f0dder]

Hmm, if you get heavy disk I/O, process priority doesn't matter that much, because the disk I/O itself will be killing you. You say you have 30-50 clamav processes running concurrently? That sounds wrong! :-s

If the memory problem is that one process is leaking, you might be able to fix it with some NT quota stuff, but if it's because you get multiple processes where you shouldn't, then I dunno if it's as easy to fix. And I'm not sure how you set those quotas anyway, just that it should be possible

[cyberglobe]

Well, the issue is that under normal traffic, I get around 5-15 clamscans running at same time. Then when one of the instances of clamscan messes up, the clamscans stack up and goes to 30-up to 180 one time I saw.

I know it won't help with the I/O that much but by being able to watch to see if there is a rogue process, then this would curb the heavy I/O.

I am trying to avoid the purchase of their anti-virus plugin but it seems that I won't be able to avoid it unless Process Tamer incorporates the CPU time watcher too.

The Clamscan randomly bogs up. There is no pattern to when it bogs up.  Sometimes it works for days, sometimes just a few hours.  Right now, I have it set to no more than 30 scan sessions yet if clamscan ends up in that endless loop, my mailserver self crashes itself and resets after 1 minute.  However, the clamscan process is still running in the background at 100% CPU along with other dead clamscans from the previous mail server crash.

Now you see why this is necessary to monitor the CPU Time.
It is a security measure to ensure that my server does not become unresponsive.