Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- 'I got this code from this post:
- 'http://www.petri.co.il/forums/showthread.php?t=53689
- option explicit
- Const PROCESS = "EWBIC.exe"
- Const MEM_LIMIT_KB = 511999
- Const SERVICE_NAME = "IC Service" '! make sure to use the service name here not the displayname of the service
- Dim objSWbemObject, strComputer
- Dim objSWbemServices, objSWbemEventSource
- Dim objProcess, iPID, iMem
- strComputer = "."
- Set objSWbemServices = GetObject("winmgmts:" _
- & "{impersonationLevel=impersonate}!\\" _
- & strComputer & "\root\cimv2")
- ' Enable the SeDebugPrivilege privilege to terminate
- ' processes running under a different security context.
- objSWbemServices.Security_.ImpersonationLevel = 3
- objSWbemServices.Security_.privileges. _
- addasstring "SeDebugPrivilege", True
- Set objSWbemEventSource = objSWbemServices.ExecNotificationQuery( _
- "SELECT * FROM __InstanceModificationEvent WITHIN 60 Where (" & _
- "TargetInstance ISA 'Win32_Process' AND " & _
- "TargetInstance.Name='" & PROCESS & "' AND " & _
- "TargetInstance.WorkingSetSize > " & MEM_LIMIT_KB *1024 & ")")
- On Error Resume Next
- Do: Set objSWbemObject = objSWbemEventSource.NextEvent()
- Select Case objSWbemObject.TargetInstance.Path_.Class
- Case "Win32_Process"
- wscript.sleep 10000 ' wait 10 seconds then re-check mem usage by this process
- For Each objProcess in getobject("winmgmts://").instancesof(_
- "Win32_Process Where Name = '" & PROCESS & "' AND WorkingSetSize > " & MEM_LIMIT_KB *1024)
- iPID = objProcess.Processid
- iMem = objProcess.WorkingSetSize /1024
- objProcess.Terminate() ' optional
- call notifyMe (iPID, iMem)
- ' stop/start service (do not use its displayname here)
- With objSWbemServices.Get("Win32_Service.Name='" & SERVICE_NAME & "'")
- .StopService()
- wscript.sleep 10000 ' wait 10 seconds
- .StartService()
- wscript.sleep 10000 ' wait 10 seconds
- End With
- Next
- End Select
- Loop
- Sub notifyMe (PID, Mem)
- With CreateObject("WScript.Shell")
- .popup PROCESS & " [ID " & PID & "] terminated " _
- & "because its memory usage was: " & Mem & " kb", _
- 5, strComputer & " Event", 0+64
- End With
- End Sub
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement