You can use the tasklist command to check memory usage of processes.
1. Basic Usage
You can view the memory usage per process by opening a command prompt and running the tasklist command.
CMD> tasklist
Image Name PID Session Name Session# Mem Usage
========================= ======== ================ =========== ============
System Idle Process 0 Services 0 8 K
System 4 Services 0 140 K
Registry 196 Services 0 94,732 K
smss.exe 604 Services 0 1,296 K
csrss.exe 840 Services 0 6,388 K
wininit.exe 924 Services 0 7,132 K
csrss.exe 932 Console 1 7,088 K
services.exe 996 Services 0 10,720 K
lsass.exe 1012 Services 0 27,564 K
winlogon.exe 812 Console 1 12,840 K
svchost.exe 1124 Services 0 32,992 K
WUDFHost.exe 1152 Services 0 7,056 K
fontdrvhost.exe 1172 Services 0 4,496 K
fontdrvhost.exe 1180 Console 1 13,348 K
svchost.exe 1296 Services 0 16,856 K
<Omit>If you want to analyze with Excel, output in CSV format by like tasklist /fo csv.
CMD> tasklist /fo csv
"Image Name","PID","Session Name","Session#","Mem Usage"
"System Idle Process","0","Services","0","8 K"
"System","4","Services","0","140 K"
"Registry","196","Services","0","94,732 K"
"smss.exe","604","Services","0","1,296 K"
"csrss.exe","840","Services","0","6,384 K"
"wininit.exe","924","Services","0","7,132 K"
"csrss.exe","932","Console","1","7,064 K"
"services.exe","996","Services","0","10,704 K"
"lsass.exe","1012","Services","0","27,556 K"
"winlogon.exe","812","Console","1","12,840 K"
"svchost.exe","1124","Services","0","33,000 K"
"WUDFHost.exe","1152","Services","0","7,056 K"
"fontdrvhost.exe","1172","Services","0","4,496 K"
"fontdrvhost.exe","1180","Console","1","13,348 K"
"svchost.exe","1296","Services","0","16,836 K"
"svchost.exe","1332","Services","0","11,644 K"
"dwm.exe","1400","Console","1","148,088 K"
<Omit>Use tasklist /svc /fo csv to find out which service a process is associated with. Even processes that host services like svchost.exe can be tied to services by PID to see which service is consuming how much memory.
CMD> tasklist /svc
Image Name PID Services
========================= ======== ============================================
System Idle Process 0 N/A
System 4 N/A
Registry 196 N/A
smss.exe 604 N/A
csrss.exe 840 N/A
wininit.exe 924 N/A
csrss.exe 932 N/A
services.exe 996 N/A
lsass.exe 1012 EFS, KeyIso, SamSs, VaultSvc
winlogon.exe 812 N/A
svchost.exe 1124 BrokerInfrastructure, DcomLaunch, PlugPlay,
Power, SystemEventsBroker
WUDFHost.exe 1152 N/A
fontdrvhost.exe 1172 N/A
fontdrvhost.exe 1180 N/A
svchost.exe 1296 RpcEptMapper, RpcSs
svchost.exe 1332 LSM
<Omit>2. Other Options
1. Sort Ascending by Process Name
You can sort by process name in ascending order with tasklist | sort .
CMD> tasklist | sort
========================= ======== ================ =========== ============
AggregatorHost.exe 6020 Services 0 5,816 K
ApplicationFrameHost.exe 15896 Console 1 43,464 K
armsvc.exe 4164 Services 0 7,200 K
CalculatorApp.exe 14660 Console 1 86,116 K
chrome.exe 536 Console 1 46,436 K
chrome.exe 676 Console 1 79,388 K
cmd.exe 18688 Console 1 5,204 K
conhost.exe 14884 Console 1 17,204 K
conhost.exe 18056 Console 1 25,948 K
csrss.exe 840 Services 0 6,388 K
csrss.exe 932 Console 1 7,044 K
ctfmon.exe 7164 Console 1 22,612 K
dllhost.exe 9156 Console 1 17,492 K
<Omit>2. Sort Descending by Process Name
You can sort by process name in ascending order with tasklist | sort /R.
CMD> tasklist | sort /R
ZeroConfigService.exe 4408 Services 0 18,216 K
WUDFHost.exe 1152 Services 0 7,056 K
WMIRegistrationService.ex 4188 Services 0 14,160 K
WmiPrvSE.exe 14948 Services 0 9,896 K
WmiPrvSE.exe 5772 Services 0 13,864 K
winlogon.exe 812 Console 1 12,852 K
wininit.exe 924 Services 0 7,132 K
Widgets.exe 8312 Console 1 13,104 K
vmware-usbarbitrator64.ex 4308 Services 0 12,608 K
vmware-authd.exe 4300 Services 0 15,784 K
vmnetdhcp.exe 4328 Services 0 6,204 K
vmnat.exe 4264 Services 0 7,676 K
UserOOBEBroker.exe 11456 Console 1 9,720 K
unsecapp.exe 5672 Services 0 7,576 K
ThinkPadKBSvc.exe 4216 Services 0 7,372 K
<Omit>3. Show processes that use memory more than XX
tasklist /fi “memusage gt xxxx” will display the processes that use more than XX memory. By the way, “gt” stands for “grater than”. For example, to extract processes that use more than 100 MB (102,400 KB) of memory use:
CMD> tasklist /fi "memusage gt 102400"
Image Name PID Session Name Session# Mem Usage
========================= ======== ================ =========== ============
dwm.exe 1400 Console 1 149,144 K
MsMpEng.exe 4320 Services 0 198,236 K
explorer.exe 7204 Console 1 224,972 K
SearchHost.exe 8496 Console 1 236,908 K
PhoneExperienceHost.exe 10708 Console 1 140,504 K
TextInputHost.exe 6544 Console 1 145,656 K
OneDrive.exe 12296 Console 1 114,756 K
chrome.exe 12792 Console 1 330,496 K
chrome.exe 12712 Console 1 328,480 K
chrome.exe 14672 Console 1 134,672 K
PfuSshImgProc.exe 16812 Console 1 145,020 K
PfuSshImgProc.exe 14544 Console 1 145,184 K
PfuSshImgProc.exe 9416 Console 1 145,184 K
chrome.exe 12188 Console 1 180,452 K
EXCEL.EXE 16356 Console 1 195,404 K
PfuSshImgProc.exe 18980 Console 1 145,392 K
PfuSshImgProc.exe 19124 Console 1 145,460 K
<Omit>4. Sort by Memory Usage
There is no option to sort by memory usage. It is certain to output in CSV format with tasklist /fo csv, paste it into Excel, and sort it.
Comments