Powershell script to list running processes and CPU utilization using Get-Counter is not returning all processes

Viewed 67

I found the following PS command to list running processes sorted by CPU utilization:

Get-Counter -ErrorAction SilentlyContinue '\Process(*)\% Processor Time' | 
    Select-Object -ExpandProperty countersamples | 
    Select-Object -Property instancename, cookedvalue | 
    ? {$_.instanceName -notmatch "^(idle|_total|system)$"} | 
    Sort-Object -Property cookedvalue -Descending | 
    Select-Object -First 10 | 
    ft InstanceName,@{L='CPU';E={($_.Cookedvalue/100/$env:NUMBER_OF_PROCESSORS).toString('P')}} -AutoSize

Below is the output, which appears it could be accurate, however while this ran my Antimalware Service Executable was using about 8% CPU. Why is this not showing up in the PowerShell output?

InstanceName          CPU
------------          ---
msmpeng               0.39%
slack                 0.19%
taskmgr               0.19%
pwsh                  0.10%
todo                  0.10%
dwm                   0.10%
system                0.00%
creative cloud helper 0.00%
adobe desktop service 0.00%
adobeipcbroker        0.00%

Edit: The answer here gives similar results. Here is my adaptation of the answer (so it outputs it to a table instead of CSV)

$Cores = (Get-WmiObject -class win32_processor -Property numberOfCores).numberOfCores;
$LogicalProcessors = (Get-WmiObject –class Win32_processor -Property NumberOfLogicalProcessors).NumberOfLogicalProcessors;
$TotalMemory = (get-ciminstance -class "cim_physicalmemory" | % {$_.Capacity})

get-process -IncludeUserName | select @{Name="Time"; Expression={(get-date(get-date).ToUniversalTime() -uformat "%s")}},`
  ID,  StartTime,  Handles,WorkingSet, PeakPagedMemorySize,  PrivateMemorySize, VirtualMemorySize,`
   @{Name="Total_RAM"; Expression={ ($TotalMemory )}},`
  CPU,
   @{Name='CPU_Usage'; Expression = { $TotalSec = (New-TimeSpan -Start $_.StartTime).TotalSeconds
     [Math]::Round( ($_.CPU * 100 / $TotalSec) /$LogicalProcessors, 2) }},`
   @{Name="Cores"; Expression={ ($Cores )}},`
   @{Name="Logical_Cores"; Expression={ ($LogicalProcessors )}},`
 UserName, ProcessName, Path | Sort-Object -Property CPU -Descending | Format-Table -Property ProcessName, CPU | Select -First 10

And here are the results:

ProcessName                                          CPU 
-----------                                          --- 
SearchIndexer                                 2898.21875 
MsMpEng                                        1395.9375 
System                                              1045 
MsSense                                       612.359375 
explorer                                      507.296875     
OneDrive                                      467.296875 
OUTLOOK                                       362.765625 
SenseNdr                                        355.8125

After some tests, these results are actually worse. I ran a CPU intensive App and it shows up with the first (original) method, but it shows 1.5% even though Task Manager shows 25%. The second method, from the other SO answer, does not show the process at all.

0 Answers
Related