Hi,

SysInternal (http://www.sysinternals.com)'s PSList utility is able to show processes and application information using the command PSLIST \\COMPUTERNAME /T, which returns a tree like structure of processes (parent processes and (tabbed) child processes.

If this displays correctly the output given looks something like the below.

What I am hoping to do, however, is to parse this output and then echo it back into the script so that it displays only Explorer (a parent process) and everything below (all child processes). If I output the results to a Notepad document (PSLIST \\COMPUTERNAME /T>>temp.txt), it looks as though the formatting is retained.

Is there a way then to load the text document back into the batch script (perhaps with a FOR loop?) starting with the line explorer (the exact line number this appears as might vary from machine to machine) and is there a way to retain the inserted spaces that makes up the hierarchical tree structure?

Thanks a million!

Process information for COMPUTERNAME:

Name Pid Pri Thd Hnd VM WS Priv
Idle 0 0 2 0 0 28 0
System 4 8 82 371 1876 144 0
smss 588 11 3 21 3800 104 172
csrss 636 13 14 638 54256 2548 1868
winlogon 660 13 20 615 63304 5628 9456
services 704 9 16 332 46232 3536 4980
svchost 908 8 16 223 64696 2032 3488
agentsvr 156 8 6 109 28348 644 848
dllhost 1060 8 3 126 41332 1748 1784
naPrdMgr 1976 8 7 126 51900 732 6020
alg 932 8 6 105 33080 668 1180
svchost 972 8 9 469 39560 1900 2552
svchost 1072 8 72 1710 153124 17844 20744
wuauclt1 3816 8 6 113 41056 4184 2836
svchost 1196 8 6 96 32000 980 1600
svchost 1268 8 15 298 42748 2336 3100
spoolsv 1440 8 12 168 52000 3164 5340
DWRCS 1616 8 11 88 37868 300 1608
LSSrvc 1672 8 2 25 12068 112 328
FrameworkService 1708 8 28 429 81528 7784 7452
McScript_InUse 2864 8 5 90 37956 4652 1696
Mcshield 1784 13 32 322 134920 43860 48468
VsTskMgr 1812 8 11 133 39580 352 1060
wdfmgr 1936 8 4 66 14656 240 1520
lsass 716 9 20 523 42516 2236 4444
logon.scr 4060 4 1 12 14252 1504 408
explorer 2164 8 12 489 73072 9460 11136
qttask 684 8 2 37 24784 1052 596
OUTLOOK 1136 8 28 1262 388464 82720 67664
TBMon 1668 8 2 21 26924 220 628
shstat 2404 8 7 66 37456 728 1200
iexplore 2488 8 9 512 124760 5020 17716
iexplore 2504 8 14 517 134268 6236 17428
tfswctrl 2696 8 3 92 33800 252 964
WINWORD 2752 8 5 362 185956 11772 11404
hkcmd 2832 8 2 73 20876 224 660
UpdaterUI 2888 8 6 104 41220 1580 1608
EXCEL 2904 8 5 147 65748 3004 3336
Silk 3088 8 4 210 94788 1880 14832
igfxpers 3116 8 3 84 21844 212 644
AcroRd32 3124 8 6 210 121220 27080 23236
issch 3164 8 1 15 13000 296 296
jusched 3168 8 1 26 17860 100 512
jucheck 1468 8 3 164 40844 248 2436
RTHDCPL 3316 8 4 158 64196 2444 14620
GoogleToolbarNotifier 3400 8 4 192 46832 468 3060
CineTray 3548 6 1 64 42084 392 4428
Silk 3728 8 3 126 69956 7816 11548
iexplore 3872 8 11 573 135728 5060 22140
realsched 2356 8 5 106 35380 216 952
realplay 2876 4 5 142 44300 1044 2192

-Matt- :-

It looks like the output didn't display as I would have liked it to. So here's what the output for PSList looks like (properly) when the command PSLIST \\COMPUTERNAME /T is run:

http://staffweb...

Thanks!

-Matt- :-

Well, if you really wanted to script it, you could use VBScript and WMI to pull the data yourself, but...

SETLOCAL ENABLEDELAYEDEXPANSION
FOR /F "delims=:" %%a IN ('findstr /n "explorer" temp.txt) DO IF "%ParseStart%"=="" SET /A ParseStart=%%a - 1
FOR /F "skip=%ParseStart% delims=" %%a IN (temp.txt) DO @ECHO %%a

Thanks Razor2_3,

A batch script, like the one you provided, is perfect. :-) However, in running this I ran into the error: "The system cannot find the file 'findstr /n "explorer" temp.txt.
delims=" was unexpected at this time."

I renamed the text file with the PSList output to text.txt and have this in the same directory as the batch file with your script above.

-Matt- :-

Ah, found the problem, I was missing a ' before the close parentheses. Works perfectly.

Thank you!

-Matt- :-