This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(284.8, 46%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EM%3C/text%3E%3C/svg%3E)
Hi, I have been running a vbscript that pipe the tasklist into a file and I will check whether the process wscript.exe running under userA is there by go thru each line and +1 if it matched.
The purpose is to check if there wscript under UserA exceeds the threshold(exceeds 3)
I have scheduled the job under windows scheduler with a interval of 10 mins for this new monitoring script.
I have 2 other scripts for other monitoring of files in certain folders running as well that I have scheduled and been running like for a year.
The new script has been running fine for the past few weeks but then just a few days back, I received email alert trigger by the new script where the tasklist has over 300+ of the wscripte.exe running under userA.
I went into the server and from task manager, indeed I do see many many wscript.exe under userA.
I have to manually kill those processes and so far it looks ok.
Firstly, I do not not which of the 3 jobs is causing the spike in wscript.exe and anyone is able to advise the cause why there can be so many such processes ?
Many tks
Regards
Maxz
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(256, 32%, 34%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMT%3C/text%3E%3C/svg%3E)
While Windows doesn't put much emphasis on process relationships it does track if a child process has a parent. Use Process Explorer to view the process tree and see which of your scheduled tasks is creating all the child processes. If it is a single task then you just need to debug that one.
As to the cause the most common case is your parent process (the scheduled task) isn't properly cleaning up the script process. Since you didn't post that code we cannot guess what you're doing wrong. If it were .NET then I'd say you aren't closing the process handle. Alternatively perhaps the script process is causing an error and your app isn't handling that properly.
Yet another possible cause would be if the script is displaying some sort of prompt (either in error cases or running normally). In this case the process would stall waiting for user input that will never occur. If you have this occurring on a machine with Visual Studio installed then you can attach the debugger to the process and see where it is stuck at.
Hi,
Noted , I will use the process explorer to check.
But am unable to post as I have difficulty in sending from my work pc but this is what the script does
Set A = create object("scripting.filesystemobject")
Set B = A.opentextfile(, for reading)
Do until B.atendofstream
It loops thru the tasklist file and check for matching text and increase counter
Loop
If counter >= 3, then send email
B.close
Wscript.quit()
If script isbthe issue, would I not get the same issue every time ?
Regards
Maxz
This is your monitor script. From my understanding it isn't the one that doesn't seem to be cleaning up, it is the script being run by user A. Since your script runs only once every 10 mins it could easily find 300 processes running if user A is running a script fast enough.
Have you verified this file you're reading is actually correct in that it is probably seeing the processes? Personally I would just query the running processes and rely on that dynamic list. It is possible your file is simply wrong. Doing this in VBS might be painful so personally I'd be using Powershell which would be a lot easier.
As for terminating the process wscript.quit terminates the current script, not a remote one. To terminate a remote process you'd need to use Win32_process or use taskkill on the remote process.
Hi,
On the verification of the tasklist file, yes have verified during the issue that it matched against the task manager processes under userA.
In fact userA has only scheduled 3 jobs all at 10 mins interval.
Will have to use the process explorer to give me more info.
On the powershell, able to provide me any links where it can count a process running under a certain user ? I am unfamiliar with it.
On terminate the remote wscript. I am scheduling all the jobs in the server using userA, would this be considered remote process?
Regards
Maxz
In Powershell I could get the processes for wscript associated with a particular user doing this.
$user = 'mydomain\myuser'
$procs = Get-Process -Name 'wscript' -IncludeUserName | Where-Object { $_.UserName -eq $user }
$procs.length
A remote process is any process other than the current one. My point is that WScript.QUit terminates the script that it is in, not the remote process. In PS to force terminate a remote process you could do something like this:
`$proc.Kill()
Of course this is equivalent to going into Task Manager and terminating it so it could cause problems.