python 管理windows客户端_Python管理Windows进程

用python获得正在的运行的windows进程的有几种方式:

方式一

通过 PyWin32包对Windows进行处理。

可以通过这个获取系统信息，但仅限于windows系统。

import win32com.client

wmi=win32com.client.GetObject(‘winmgmts:’)

for p in wmi.InstancesOf(‘win32_process’):

print p.Name, p.Properties_(‘ProcessId’), \

int(p.Properties_(‘UserModeTime’).Value)+int(p.Properties_(‘KernelModeTime’).Value)

children=wmi.ExecQuery(‘Select * from win32_process where ParentProcessId=%s’ %p.Properties_(‘ProcessId’))

for child in children:

print ‘\t’,child.Name,child.Properties_(‘ProcessId’), \

int(child.Properties_(‘UserModeTime’).Value)+int(child.Properties_(‘KernelModeTime’).Value)

运行结果：

System Idle Process 0 11055150937500

System Idle Process 0 11055150937500

System 4 14906718750

System 4 14906718750

smss.exe 864 937500

smss.exe 864 937500

csrss.exe 916 1752187500

winlogon.exe 940 72812500

csrss.exe 916 1752187500

winlogon.exe 940 72812500

services.exe 1024 324236406250

lsass.exe 1044 10099062500

services.exe 1024 324236406250

svchost.exe 1236 35468750

svchost.exe 1304 6174687500

svchost.exe 1480 198943593750

svchost.exe 1524 35156250

svchost.exe 1636 1412656250

svchost.exe 1688 494843750

spoolsv.exe 1860 45312500

DhMachineSvc.exe 2040 23593750

jqs.exe 200 11605000000

NTFSWatcher.exe 248 15625000

OmniAddrService.exe 268 86406250

pcas.exe 396 172187500

nssm.exe 696 2968750

TeamViewer_Service.exe 772 172343750

winvnc4.exe 844 78750000

svchost.exe 880 151718750

alg.exe 3208 56093750

lsass.exe 1044 10099062500

svchost.exe 1236 35468750

wmiprvse.exe 5184 2500000

svchost.exe 1304 6174687500

svchost.exe 1480 198943125000

svchost.exe 1524 35156250

svchost.exe 1636 1412656250

svchost.exe 1688 494843750

spoolsv.exe 1860 45312500

DhMachineSvc.exe 2040 23593750

jqs.exe 200 11605000000

GoogleUpdate.exe 208 105312500

NTFSWatcher.exe 248 15625000

OmniAddrService.exe 268 86406250

pcas.exe 396 172187500

nssm.exe 696 2968750

salt-minion.exe 716 79062500

salt-minion.exe 716 79062500

TeamViewer_Service.exe 772 172343750

winvnc4.exe 844 78750000

svchost.exe 880 151718750

explorer.exe 1452 7501250000

TSVNCache.exe 2496 114531250

ctfmon.exe 2540 82343750

chrome.exe 2556 25053125000

RocketDock.exe 2564 411406250

Xshell.exe 5200 12957656250

mstsc.exe 8468 227500000

iexplore.exe 7672 13281250

cmd.exe 9404 312500

sublime_text.exe 8920 131093750

notepad.exe 2248 1718750

TSVNCache.exe 2496 114531250

ctfmon.exe 2540 82343750

chrome.exe 2556 25053125000

chrome.exe 3880 24531250

chrome.exe 3872 52500000

chrome.exe 2020 331093750

chrome.exe 1028 35937500

chrome.exe 196 37187500

chrome.exe 184 55625000

chrome.exe 2736 37656250

chrome.exe 2752 1755781250

chrome.exe 2772 83281250

chrome.exe 2976 258125000

SogouFlash.exe 3580 640468750

SogouCloud.exe 3488 115625000

SGImeGuard.exe 4300 24218750

chrome.exe 3700 40312500

chrome.exe 9148 3741406250

chrome.exe 8496 7201250000

chrome.exe 6840 200312500

SogouSmartInfo.exe 9852 468750

RocketDock.exe 2564 411406250

alg.exe 3208 56093750

chrome.exe 3880 24531250

chrome.exe 3872 52500000

chrome.exe 2020 331093750

chrome.exe 1028 35937500

chrome.exe 196 37187500

chrome.exe 184 55625000

chrome.exe 2736 37656250

chrome.exe 2752 1755781250

chrome.exe 2772 83281250

chrome.exe 2976 258125000

TaobaoProtect.exe 3772 27562812500

conime.exe 388 59218750

SogouFlash.exe 3580 640468750

SogouCloud.exe 3488 115625000

SGImeGuard.exe 4300 24218750

Xshell.exe 5200 12957656250

chrome.exe 3700 40312500

aliwssv.exe 7160 46875000

TM.exe 9144 2396250000

chrome.exe 9148 3741250000

Alipaybsm.exe 9536 73593750

chrome.exe 8496 7199843750

mstsc.exe 8468 227500000

iexplore.exe 7672 13281250

iexplore.exe 7256 148593750

iexplore.exe 7256 148437500

cmd.exe 9404 312500

python.exe 9048 1875000

sublime_text.exe 8920 127968750

plugin_host.exe 9840 32031250

plugin_host.exe 9840 30625000

cmd.exe 6384 156250

python.exe 9048 1875000

notepad.exe 2248 1718750

chrome.exe 6840 200312500

SogouSmartInfo.exe 9852 468750

cmd.exe 6384 156250

python.exe 9584 10312500

python.exe 9584 1093750

wmiprvse.exe 5184 781250

上面的从左到右分别是 进程名，pid,cpu的运行时间

方式二：

import win32pdh, string, win32api

def procids():

#each instance is a process, you can have multiple processes w/same name

junk, instances = win32pdh.EnumObjectItems(None,None,’process’, win32pdh.PERF_DETAIL_WIZARD)

proc_ids=[]

proc_dict={}

for instance in instances:

if instance in proc_dict:

proc_dict[instance] = proc_dict[instance] + 1

else:

proc_dict[instance]=0

for instance, max_instances in proc_dict.items():

for inum in xrange(max_instances+1):

hq = win32pdh.OpenQuery() # initializes the query handle

path = win32pdh.MakeCounterPath( (None,’process’,instance, None, inum,’ID Process’) )

counter_handle=win32pdh.AddCounter(hq, path)

win32pdh.CollectQueryData(hq) #collects data for the counter

type, val = win32pdh.GetFormattedCounterValue(counter_handle, win32pdh.PDH_FMT_LONG)

proc_ids.append((instance,str(val)))

win32pdh.CloseQuery(hq)

proc_ids.sort()

return proc_ids

print procids()

运行结果：

[(u’Alipaybsm’, ‘9536’), (u’DhMachineSvc’, ‘2040’), (u’GoogleUpdate’, ‘208’), (u’Idle’, ‘0’), (u’NTFSWatcher’, ‘248’), (u’OmniAddrService’, ‘268’), (u’RocketDock’, ‘2564’), (u’SGImeGuard’, ‘4300’), (u’SogouCloud’, ‘3488’), (u’SogouFlash’, ‘3580’), (u’SogouSmartInfo’, ‘9852’), (u’System’, ‘4’), (u’TM’, ‘9144’), (u’TSVNCache’, ‘2496’), (u’TaobaoProtect’, ‘3772’), (u’TeamViewer_Service’, ‘772’), (u’Xshell’, ‘5200’), (u’_Total’, ‘0’), (u’alg’, ‘3208’), (u’aliwssv’, ‘7160’), (u’chrome’, ‘1028’), (u’chrome’, ‘184’), (u’chrome’, ‘196’), (u’chrome’, ‘2020’), (u’chrome’, ‘2556’), (u’chrome’, ‘2736’), (u’chrome’, ‘2752’), (u’chrome’, ‘2772’), (u’chrome’, ‘2976’), (u’chrome’, ‘3700’), (u’chrome’, ‘3872’), (u’chrome’, ‘3880’), (u’chrome’, ‘6840’), (u’chrome’, ‘8496’), (u’chrome’, ‘9148’), (u’cmd’, ‘9404’), (u’cmd’, ‘9776’), (u’conime’, ‘388’), (u’csrss’, ‘916’), (u’ctfmon’, ‘2540’), (u’explorer’, ‘1452’), (u’iexplore’, ‘7256’), (u’iexplore’, ‘7672’), (u’jqs’, ‘200’), (u’lsass’, ‘1044’), (u’mstsc’, ‘8468’), (u’notepad’, ‘2248’), (u’nssm’, ‘696’), (u’pcas’, ‘396’), (u’plugin_host’, ‘9840’), (u’python’, ‘3540’), (u’python’, ‘9048’), (u’salt-minion’, ‘716’), (u’services’, ‘1024’), (u’smss’, ‘864’), (u’spoolsv’, ‘1860’), (u’sublime_text’, ‘8920’), (u’svchost’, ‘1236’), (u’svchost’, ‘1304’), (u’svchost’, ‘1480’), (u’svchost’, ‘1524’), (u’svchost’, ‘1636’), (u’svchost’, ‘1688’), (u’svchost’, ‘880’), (u’winlogon’, ‘940’), (u’winvnc4′, ‘844’)]

[Finished in 0.3s]

获得 一个进程名，进程Id元组的列表

方式三：

# http://code.activestate.com/recipes/305279/

“””

Enumerates active processes as seen under windows Task Manager on Win NT/2k/XP using PSAPI.dll

(new api for processes) and using ctypes.Use it as you please.

Based on information from http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q175030&ID=KB;EN-US;Q175030

By Eric Koome

email ekoome@yahoo.com

license GPL

“””

from ctypes import *

#PSAPI.DLL

psapi = windll.psapi

#Kernel32.DLL

kernel = windll.kernel32

def EnumProcesses():

arr = c_ulong * 256

lpidProcess= arr()

cb = sizeof(lpidProcess)

cbNeeded = c_ulong()

hModule = c_ulong()

count = c_ulong()

modname = c_buffer(30)

PROCESS_QUERY_INFORMATION = 0x0400

PROCESS_VM_READ = 0x0010

#Call Enumprocesses to get hold of process id’s

psapi.EnumProcesses(byref(lpidProcess),

cb,

byref(cbNeeded))

#Number of processes returned

nReturned = cbNeeded.value/sizeof(c_ulong())

pidProcess = [i for i in lpidProcess][:nReturned]

for pid in pidProcess:

#Get handle to the process based on PID

hProcess = kernel.OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ,

False, pid)

if hProcess:

psapi.EnumProcessModules(hProcess, byref(hModule), sizeof(hModule), byref(count))

psapi.GetModuleBaseNameA(hProcess, hModule.value, modname, sizeof(modname))

print “”.join([ i for i in modname if i != ‘\x00’])

#– Clean up

for i in range(modname._length_):

modname[i]=’\x00′

kernel.CloseHandle(hProcess)

if __name__ == ‘__main__’:

EnumProcesses()

运行结果：

smss.exe

winlogon.exe

services.exe

lsass.exe

svchost.exe

svchost.exe

svchost.exe

spoolsv.exe

DhMachineSvc.exe

jqs.exe

GoogleUpdate.exe

NTFSWatcher.exe

OmniAddrService.exe

pcas.exe

nssm.exe

salt-minion.exe

TeamViewer_Service.exe

WinVNC4.exe

svchost.exe

Explorer.EXE

TSVNCache.exe

ctfmon.exe

chrome.exe

RocketDock.exe

chrome.exe

chrome.exe

chrome.exe

chrome.exe

chrome.exe

chrome.exe

chrome.exe

chrome.exe

chrome.exe

chrome.exe

TaobaoProtect.exe

conime.exe

SogouFlash.exe

SogouCloud.exe

SGImeGuard.exe

Xshell.exe

chrome.exe

aliwssv.exe

TM.exe

chrome.exe

Alipaybsm.exe

chrome.exe

mstsc.exe

iexplore.exe

iexplore.exe

cmd.exe

sublime_text.exe

plugin_host.exe

python.exe

NOTEPAD.EXE

chrome.exe

chrome.exe

SogouSmartInfo.exe

cmd.exe

python.exe

通过交互模式，使用WMI取得进程：

# http://mail.python.org/pipermail/python-win32/2003-December/001482.html

>>> import wmi

>>> processes = wmi.WMI().InstancesOf(‘Win32_Process’)

>>> len(processes)

41

>>> [process.Properties_(‘Name’).Value for process in processes] # get

the process names

[u’System Idle Process’, u’System’, u’SMSS.EXE’, u’CSRSS.EXE’,

u’WINLOGON.EXE’, u’SERVICES.EXE’, u’LSASS.EXE’, u’SVCHOST.EXE’,

u’SVCHOST.EXE’, u’SVCHOST.EXE’, u’SVCHOST.EXE’, u’SPOOLSV.EXE’,

u’ati2evxx.exe’, u’BAsfIpM.exe’, u’defwatch.exe’, u’inetinfo.exe’,

u’mdm.exe’, u’rtvscan.exe’, u’SCARDSVR.EXE’, u’WLTRYSVC.EXE’,

u’BCMWLTRY.EXE’, u’EXPLORER.EXE’, u’Apoint.exe’, u’carpserv.exe’,

u’atiptaxx.exe’, u’quickset.exe’, u’DSentry.exe’, u’Directcd.exe’,

u’vptray.exe’, u’ApntEx.exe’, u’FaxCtrl.exe’, u’digstream.exe’,

u’CTFMON.EXE’, u’wuauclt.exe’, u’IEXPLORE.EXE’, u’Pythonwin.exe’,

u’MMC.EXE’, u’OUTLOOK.EXE’, u’LineMgr.exe’, u’SAPISVR.EXE’,

u’WMIPRVSE.EXE’]

# Here is how to get a single process and get its PID.

>>> p = wmi.WMI().ExecQuery(‘select * from Win32_Process where

Name=”Pythonwin.exe”‘)

>>> [prop.Name for prop in p[0].Properties_] # let’s look at all the

process property names

[u’Caption’, u’CommandLine’, u’CreationClassName’, u’CreationDate’,

u’CSCreationClassName’, u’CSName’, u’Description’, u’ExecutablePath’,

u’ExecutionState’, u’Handle’, u’HandleCount’, u’InstallDate’,

u’KernelModeTime’, u’MaximumWorkingSetSize’, u’MinimumWorkingSetSize’,

u’Name’, u’OSCreationClassName’, u’OSName’, u’OtherOperationCount’,

u’OtherTransferCount’, u’PageFaults’, u’PageFileUsage’,

u’ParentProcessId’, u’PeakPageFileUsage’, u’PeakVirtualSize’,

u’PeakWorkingSetSize’, u’Priority’, u’PrivatePageCount’, u’ProcessId’,

u’QuotaNonPagedPoolUsage’, u’QuotaPagedPoolUsage’,

u’QuotaPeakNonPagedPoolUsage’, u’QuotaPeakPagedPoolUsage’,

u’ReadOperationCount’, u’ReadTransferCount’, u’SessionId’, u’Status’,

u’TerminationDate’, u’ThreadCount’, u’UserModeTime’, u’VirtualSize’,

u’WindowsVersion’, u’WorkingSetSize’, u’WriteOperationCount’,

u’WriteTransferCount’]

>>> p[0].Properties_(‘ProcessId’).Value # get our ProcessId

928

方式四:

此方法可以跨平台，不过需要在安装psutil包.

import os

import psutil

import time

logPath = r’some\path\proclogs’

if not os.path.exists(logPath):

os.mkdir(logPath)

separator = “-” * 80

format = “%7s %7s %12s %12s %30s, %s”

format2 = “%7.4f %7.2f %12s %12s %30s, %s”

while 1:

# psutil.get_process_list() 方法已经废弃，可以使用psutil.process_iter()迭代器

procs = psutil.get_process_list()

procs = sorted(procs, key=lambda proc: proc.name)

logPath = r’some\path\proclogs\procLog%i.log’ % int(time.time())

f = open(logPath, ‘w’)

f.write(separator + “\n”)

f.write(time.ctime() + “\n”)

f.write(format % (“%CPU”, “%MEM”, “VMS”, “RSS”, “NAME”, “PATH”))

f.write(“\n”)

for proc in procs:

cpu_percent = proc.get_cpu_percent()

mem_percent = proc.get_memory_percent()

rss, vms = proc.get_memory_info()

rss = str(rss)

vms = str(vms)

name = proc.name

path = proc.path

f.write(format2 % (cpu_percent, mem_percent, vms, rss, name, path))

f.write(“\n\n”)

f.close()

print “Finished log update!”

time.sleep(300)

print “writing new log data!”

以上实现一个类似top的工具。