How to kill a windows process running longer than

Question

I basically need to achieve two things,

1. Find all "firefox.exe" processes running on a windows server
2. Kill the ones that have been running longer than 30 mins

I have bits and pieces, but not sure how to integrate all of it to make it working as a windows service.

What I have so far -

1) Way to find all running firefox process

wmic process get name,creationdate, processid | findstr firefox

2) Way to kill a process based on PID

taskkill /PID 827

What else is left?

• Calculate based on creationdate, which PID is running for longer than 30 mins
• Use the taskkill command to sequentially kill all the PIDs that fit the above criteria
• set this is a service (this I can probably figure out)

Answer 1

I believe you're doing some sort of test automation and there are a lot of hanging firefoxes, so in order to kill ALL those who run more than half and hour, do:

foreach ($process in Get-Process firefox*){If((New-TimeSpan -Start $process.StartTime).TotalHours -gt 0.5) {Stop-Process $process.Id -Force}}

It's actually what we're doing.

Answer 2

It's easy to think, "You can't do that in .bat". I know that was my first reaction. The problem is you need date manipulation which is not directly supported and is non-trivial. But then Ritchie Lawrence comes to the rescue, having done all the hard work of writing the necessary date functions.

The WMI Process class provides CreationDate in UTC format. Win32_OperatingSystem LocalDateTime gives us the current time in UTC format. We need to subtract the maximum lifetime (30 minutes in your case) from LocalDataTime to get the CutOffTime. Then we can use that to filter Process, and finally call terminate (instead of taskkill). Rather than findstr, I use a WMI where filter (which is much faster).

The following code seems to work. As this is KILLING TASKS, you should test this for yourself.

Note: if "%%p" GEQ "0" is used to filter out the 'blank' line at the end of the results of wmic which is not empty but contains a newline character. As we're expecting a number, this seemed a simple and effective test (though maybe there's a better way to handle this).

@echo off
setlocal ENABLEDELAYEDEXPANSION ENABLEEXTENSIONS

set MaxRunningMinutes=30
set ProcessName=firefox.exe

for /f "usebackq skip=1" %%t in (
  `wmic.exe path Win32_OperatingSystem get LocalDateTime`) do (
    if "%%t" GEQ "0" set T=%%t)

rem echo !T!
rem echo !T:~,4!/!T:~4,2!/!T:~6,2! !T:~8,2!:!T:~10,2!:!T:~12,2!
rem echo !T:~15,-4! !T:~-4!

set fsec=!T:~15,-4!
set tzone=!T:~-4!

call :DateToSecs !T:~,4! !T:~4,2! !T:~6,2! !T:~8,2! !T:~10,2! !T:~12,2! UNIX_TIME
rem echo !UNIX_TIME!

set /a CutOffTime=UNIX_TIME-MaxRunningMinutes*60
rem echo !CutOffTime!

call :SecsToDate !CutOffTime! yy mm dd hh nn ss
rem echo !yy!/!mm!/!dd! !hh!:!nn!:!ss!
set UTC=!yy!!mm!!dd!!hh!!nn!!ss!.!fsec!!tzone!
rem echo !UTC!

wmic process where "name='%ProcessName%' AND CreationDate<'%UTC%'" call terminate

rem * Alternate kill method. May be useful if /F flag is needed to
rem * to forcefully terminate the process. (Add the /F flag to
rem * taskill cmd if needed.)

rem for /f "usebackq skip=1" %%p in (
rem   `wmic process where "name='%ProcessName%' AND CreationDate<'%UTC%'" get processid`) do (
rem   if "%%p" GEQ "0" taskkill /PID %%p)

goto :EOF

rem From: http://www.commandline.co.uk/lib/treeview/index.php
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:DateToSecs %yy% %mm% %dd% %hh% %nn% %ss% secs
::
:: By:   Ritchie Lawrence, updated 2002-08-13. Version 1.1
::
:: Func: Returns number of seconds elapsed since 1st January 1970 00:00:00
::       for a given calendar date and time of day. For NT4/2000/XP/2003.
::
:: Args: %1 year to convert, 2 or 4 digit (by val)
::       %2 month to convert, 1/01 to 12, leading zero ok (by val)
::       %3 day of month to convert, 1/01 to 31, leading zero ok (by val)
::       %4 hours to convert, 1/01 to 12 for 12hr times (minutes must be
::          suffixed by 'a' or 'p', 0/00 to 23 for 24hr clock (by val)
::       %5 mins to convert, 00-59 only, suffixed by a/p if 12hr (by val)
::       %6 secs to convert, 0-59 or 00-59 (by val)
::       %7 var to receive number of elapsed seconds (by ref)
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

setlocal ENABLEEXTENSIONS
set yy=%1&set mm=%2&set dd=%3&set hh=%4&set nn=%5&set ss=%6
if 1%yy% LSS 200 if 1%yy% LSS 170 (set yy=20%yy%) else (set yy=19%yy%)
set /a dd=100%dd%%%100,mm=100%mm%%%100
set /a z=14-mm,z/=12,y=yy+4800-z,m=mm+12*z-3,j=153*m+2
set /a j=j/5+dd+y*365+y/4-y/100+y/400-2472633
if 1%hh% LSS 20 set hh=0%hh%
if {%nn:~2,1%} EQU {p} if "%hh%" NEQ "12" set hh=1%hh%&set/a hh-=88
if {%nn:~2,1%} EQU {a} if "%hh%" EQU "12" set hh=00
if {%nn:~2,1%} GEQ {a} set nn=%nn:~0,2%
set /a hh=100%hh%%%100,nn=100%nn%%%100,ss=100%ss%%%100
set /a j=j*86400+hh*3600+nn*60+ss
endlocal&set %7=%j%&goto :EOF
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:SecsToDate %secs% yy mm dd hh nn ss
::
:: By:   Ritchie Lawrence, updated 2002-07-24. Version 1.1
::
:: Func: Returns a calendar date and time of day from the number of
::       elapsed seconds since 1st January 1970 00:00:00. For
::       NT4/2000/XP/2003.
::
:: Args: %1 seconds used to create calendar date and time of day (by val)
::       %2 var to receive year, 4 digits for all typical dates (by ref)
::       %3 var to receive month, 2 digits, 01 to 12 (by ref)
::       %4 var to receive day of month, 2 digits, 01 to 31 (by ref)
::       %5 var to receive hours, 2 digits, 00 to 23 (by ref)
::       %6 var to receive minutes, 2 digits, 00 to 59 (by ref)
::       %7 var to receive seconds, 2 digits, 00 to 59 (by ref)
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
setlocal ENABLEEXTENSIONS
set /a i=%1,ss=i%%60,i/=60,nn=i%%60,i/=60,hh=i%%24,dd=i/24,i/=24
set /a a=i+2472632,b=4*a+3,b/=146097,c=-b*146097,c/=4,c+=a
set /a d=4*c+3,d/=1461,e=-1461*d,e/=4,e+=c,m=5*e+2,m/=153,dd=153*m+2,dd/=5
set /a dd=-dd+e+1,mm=-m/10,mm*=12,mm+=m+3,yy=b*100+d-4800+m/10
(if %mm% LSS 10 set mm=0%mm%)&(if %dd% LSS 10 set dd=0%dd%)
(if %hh% LSS 10 set hh=0%hh%)&(if %nn% LSS 10 set nn=0%nn%)
if %ss% LSS 10 set ss=0%ss%
endlocal&set %7=%ss%&set %6=%nn%&set %5=%hh%&^
set %4=%dd%&set %3=%mm%&set %2=%yy%&goto :EOF
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

Using Powershell

The original question was tagged with "batch-file" so I gave the Windows bat answer first. But I wanted to mention killing a named process that has been running longer than 30 minutes is trivial to do with Powershell:

Get-Process firefox | 
    Where StartTime -lt (Get-Date).AddMinutes(-30) | 
    Stop-Process -Force

Again this is KILLING TASKS so please be careful. If you're not familiar with Powershell here's the breakdown of the one liner:

1. Use the Get-Process cmdlet to get the processes that are running on the local computer. Here the name of the process, firefox is passed in. If needed a list of names can be passed, and wildcards can be used.
2. The process objects returned by Get-Process are piped to Where to filter on the StartTime property. The Get-Date cmdlet is used to get the current date and time as a DateTime type. The AddMinutes method is called to add -30 minutes, returning a DateTime that represents 30 minutes ago. The -lt operator (technically, in this context, it's a switch parameter), specifies the Less-than operation.
3. The filtered process objects returned by Where are piped to the Stop-Process cmdlet. The -Force parameter is used to prevent the confirmation prompt.

Above I've used the simplified Where syntax introduced in Powershell 3. If you require Powershell 2 compatibility (which is the latest version that runs on Windows XP), then this syntax is required:

Get-Process firefox | 
    Where { $_.StartTime -lt (Get-Date).AddMinutes(-30) } | 
    Stop-Process -Force

Here the curly braces enclose a ScriptBlock. $_ is used to explicitly reference the current object.