[Autogenerated] Let's now take a look at tools that can show job information.
Let's start with Process Explorer.
So, process Explorer has a particular color for jobs as well,
which is not shown by default, let's make it visible.
So we'll go to configure colors.
There's a color here for jobs which is this brownish color.
If I click OK,
you'll notice that we get some brownish color here
appearing in various processes.
So every time when you see a process that has this brownish color,
it means this process is definitely part of some job.
So if you click any one of these processes, here's an example for some teams.
Process there's a tab called job.
This is again a contextual tab that only shows up if the
process is indeed part of the job,
You can see here that this particular process is
part of the job that has a name.
The fact that the job has a name, just like many other kernel objects.
Just means that it can be more easily located by name by
using a function such as open job object,
but otherwise it doesn't really matter in terms of the capabilities of the job.
So this job has a pretty kind of weird name perhaps,
but it is a name nonetheless.
And then we have currently a few processes here.
In fact,
there are quite a few processes here and apparently there are no
particular limits that are set on this job.
They're just part of uh, of this job as a unit.
So you might be wondering why is the point?
What's the point of having these processes in a job in the first place?
And this is a legitimate question.
So, one answer could be because of accounting information,
as I mentioned already,
it's very easy to get that n counting information by
extracting that from the job itself,
rather than trying to query every process individually.
The other thing I should mention is that the process Explorer
currently doesn't show all possible limits and so there may be actual
limits here that are simply not being shown,
but we'll see that when we look at the kernel,
debugger and perhaps not the tool that I'll show you,
which is my own system explore that does provide more details.
The next version of process Explorer once again,
has these things fixed and will show modern or newer limits that
have been available since Windows eight and later,
let's look at some other job perhaps something a bit more interesting.
So, here's a process that I was looking for called W my pr BSC,
but apparently it's not shown here.
And this is one of the worker processes for W my W my or Windows Major
instrumentation is a fairly well known mechanism in Windows that exposes
lots of administrative um controlling functionality using a uniform
mechanism that can be applied or can be used by scripting engines such as
vB script or today PowerShell Now,
the W M I P R V S E processes are the worker processes for the w my service.
And currently there are no such processes because they're created
and destroyed as required based on W my activity.
So currently there doesn't seem to be lots of activity here.
Let me open a terminal here by pressing Windows X and getting something here.
So if I try to run some partial command like W my Sorry,
get W my object,
maybe we'll be able to follow some w my activity to occur and w
my pr BSC instances will start to appear.
So for example, if you want to list the list of processes in the system,
we can do something like this and maybe one of these processes will appear.
Indeed it did.
So if I open that top, that is a bit more interesting job to look at.
You can see it also has a name which again it's not really necessary,
but it is probably convenient for the W my service or
some other infrastructure in Windows.
Currently there's just one process and the idea here is that the more activity
you have in terms of w my the more processes will be created.
But notice the limit here says that the active process
is limited to 32 no more than that.
So even if the system is bombarded with w my activity either internally or
coming from some group policy or some administrator from the outside
because w my can also work across the network.
Then still there are some limits to prevent the system from spending too
much or too many resources on w my activity which might hinder or make
the user's normal work feel a bit sluggish.
So you can see that the w my service,
that is the one controlling this job has set several limits,
such as the active processes.
The job memory to be no more than one gigabyte of memory.
The process memory limit is limited to half a gigabyte.
So this kind of shows you the things that you can do
and it's a very easy thing to do.
So it's very declarative on the part of a developer.
Someone that wants to apply these limits and the kernel,
the executive need to kind of make that work appropriately.
So that's another example and a very common one for setting limits
that are more interesting than something very simple.
And you can see that again, others might be part of a job.
Here's a job for the terminal itself, for instance,
it has a two processes in the job with no specific limits,
at least not the ones that process Explorer can show and so on.
But notice that in some cases the brownish color might
not be the highest priority one, but it is a very high priority color.
So you typically see that for processes that are part of jobs.
So here's another process which is part of a particular job and
that job also has happens to have a name.
This is definitely seems to be fairly common,
but it's actually more common to find jobs that are not named.
Here's a job here,
that process Explorer itself is part of and it's the only one that
is part of this job and this job is unnamed,
has no name and that's fine.
Breakaway.
Okay.
By the way,
means that it is possible for process created within this job to break
away from the job and created outside of the job.
And this makes sense because Process Explorer allows us to
create processes just like the run dialog here,
we can do file run and we don't expect the created
process to be part of the job.
That process Explorer is part of.
We expect that to be outside of any job if possible.
That kind of makes sense to have that kind of limit,
which is in fact the kind of the opposite of limit actually
allowing us to do something specifically.
So this is Process Explorer and we can look at the system,
explore the two we've seen already in previous modules now.
Important system Explorer, they're a bit more details you can, you can show.
So first there are colors here as well,
we can also add the color for jobs if you so desire.
There's also these attributes here that show job in case
that the process is part of the job, you can see some of them are here.
Here's the M S.
Team's job here.
This particular process and there's a button here for job
and you get a bit more details here.
Such as the basic information of the active number of processes.
There is a total processes.
Total processes means the number of processes that existed
in the job from the inception of the job.
So this number never goes down, it only goes up.
Even if a process gets terminated.
For whatever reason, that number doesn't go down.
The active processes is changing based on the number of live process in the job.
But total processes always goes up.
Gives you a sense of how many processes were created within this job.
You can see also the total user kernel CPU time that is being
measured as part of the accounting information provided by the
job terminated processes indicates how many processes within this
job have terminated abruptly,
maybe due to a limit violation or to do to summon
handled exception in the I O chunk here,
you can see the I.
O.
Statistics for processes within this job again from the jobs inception.
So a bit more things you can see here also,
there's indication here this is in fact application silo
will deal with silos in the next module.
The kill button allows us to terminate all the processes in the
job by calling the API terminate job object.
So this is just a nice city that have added to this dialogue.
Looking at other processes such as w my pr BSC as before.
You can see here that the job also shows the same kind of
limits as we've seen with Process Explorer.
This tool does support other limits that are not shown by the current version.
Process Explorer limits that were created in Windows
eight and later versions of Windows.
And see an example of that later on.
Next, we'll look at jobs in the kernel debugger