'=============================================================================
'NAME		: TopProcesses Script
'AUTHOR		: Marcus C. Oh
'DATE		: 7/14/2006
'COMMENT	: Run as a response script to a rule that checks CPU utilization
'		: Bastardized from Microsoft Windows Base OS CPU Overload Script
'		: Lists processes utilizing % value of CPU over threshold
'=============================================================================
Const EVENT_TYPE_SUCCESS = 0
Const EVENT_TYPE_ERROR = 1
Const EVENT_TYPE_WARNING = 2
Const EVENT_TYPE_INFORMATION = 4
Const EVENT_TYPE_AUDITSUCCESS = 8
Const EVENT_TYPE_AUDITFAILURE = 16

Set oWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & ScriptContext.TargetNetbiosComputer & "\root\cimv2")
 
lNumProcessors = GetNumProcessors()
iPercentage = ScriptContext.Parameters.Get("Percentage")
sMessage = ListCriticalProcesses(iPercentage,lNumProcessors)
CreateEvent 40100,EVENT_TYPE_INFORMATION,"Top Processes Script",sMessage

Sub CreateEvent(iEventNumber,iEventType,sEventSource,sEventMessage)
    Set oEvent = ScriptContext.CreateEvent()
    oEvent.EventNumber = iEventNumber
    oEvent.EventType = iEventType 
    oEvent.EventSource = sEventSource
    oEvent.Message = sEventMessage
    ScriptContext.Submit oEvent
End Sub

Function WMIGetObject(ByVal sNamespace)
	Dim oWMI
    Dim e
    Set e = New Error
	On Error Resume Next
	Set oWMI = GetObject(sNamespace)
	e.Save
	On Error Goto 0
	If IsEmpty(oWMI) Then
		ThrowScriptError "Unable to open WMI Namespace '" & sNamespace & "'.  Check to see if the WMI service is enabled and running, and ensure this WMI namespace exists.", e
	End If
	Set WMIGetObject = oWMI
End Function

Function GetNumProcessors()
	Dim oReg, sValue
	Const HKEY_LOCAL_MACHINE = &h80000002
	Const REGPATH_NUMBER_OF_CPUS = "SYSTEM\CurrentControlSet\Control\Session Manager\Environment\"
	Const REGKEY_NUMBER_OF_CPUS = "NUMBER_OF_PROCESSORS"
	Set oReg = WMIGetObject("winmgmts://" & ScriptContext.TargetNetbiosComputer & "/root/default:StdRegProv")
	oReg.GetStringValue HKEY_LOCAL_MACHINE, REGPATH_NUMBER_OF_CPUS, REGKEY_NUMBER_OF_CPUS, sValue
	GetNumProcessors = sValue
End Function

Function ListCriticalProcesses(Percentage,lNumProcessors)
	On Error Resume Next
	Dim oDictionary, oProcesses, oProcess
	Set oDictionary = CreateObject("Scripting.Dictionary")
    Set oProcesses = oWMIService.ExecQuery("SELECT * FROM Win32_PerfRawData_PerfProc_Process")
	For Each oProcess in oProcesses
		oDictionary.Item(oProcess.Name & oProcess.IDProcess & "%") = oProcess.PercentProcessorTime
		oDictionary.Item(oProcess.Name & oProcess.IDProcess & "#") = oProcess.Timestamp_Sys100NS
	Next
	Set oProcesses = Nothing

	ScriptContext.Sleep(500)

	Dim sProcesses, lNumProcesses
	Set oProcesses = oWMIService.ExecQuery("SELECT * FROM Win32_PerfRawData_PerfProc_Process")

	For Each oProcess In oProcesses
		lNumProcesses = lNumProcesses + 1
		Dim fPercentProcessor
		If oDictionary.Exists(oProcess.Name & oProcess.IDProcess & "%") Then
			fPercentProcessor = (oProcess.PercentProcessorTime - CDbl(oDictionary.Item(oProcess.Name & oProcess.IDProcess & "%"))) / _ 
			(oProcess.Timestamp_Sys100NS - CDbl(oDictionary.Item(oProcess.Name & oProcess.IDProcess & "#"))) * 100
			If (fPercentProcessor > (Percentage * lNumProcessors)) And (oProcess.IDProcess <> 0) Then
				sProcesses = sProcesses & oProcess.Name & " (" & oProcess.IDProcess & ") :" & _
				CInt(fPercentProcessor / lNumProcessors) & "%" & VbCrLf
			End If
		End If
	Next
	Set oProcesses = Nothing

	If Len(sProcesses) > 0 Then
		ListCriticalProcesses = "The processes using greater than " & Percentage & "% CPU at present are:" & vbCrLf & _
								sProcesses & VbCrLf & _
								"(There are " & lNumProcesses & " running at this time.)"
	End If
	Set oDictionary = Nothing
End Function

Function ThrowScriptErrorNoAbort(ByVal sMessage, ByVal oErr)
	Dim sErrDescription, sErrNumber
	sErrDescription = oErr.Description
	sErrNumber = oErr.Number
	On Error Resume Next
	Dim oScriptErrorEvent
	Set oScriptErrorEvent = ScriptContext.CreateEvent()
	With oScriptErrorEvent
		.EventNumber = 40000
		.EventType = EVENT_TYPE_ERROR
		.Message = sMessage
		.SetEventParameter """Top Processes"""
		.SetEventParameter sMessage
		.SetEventParameter sErrDescription
		.SetEventParameter sErrNumber
	End With
	ScriptContext.Submit oScriptErrorEvent
	ScriptContext.Echo "ThrowScriptError('" & sMessage & "')"
End Function

Class Error
    Private m_lNumber
    Private m_sSource
    Private m_sDescription
    Private m_sHelpContext
    Private m_sHelpFile
    Public Sub Save()
        m_lNumber = Err.number
        m_sSource = Err.Source
        m_sDescription = Err.Description
        m_sHelpContext = Err.HelpContext
        m_sHelpFile = Err.helpfile
    End Sub
    Public Sub Raise()
        Err.Raise m_lNumber, m_sSource, m_sDescription, m_sHelpFile, m_sHelpContext
    End Sub
    Public Sub Clear()
        m_lNumber = 0
        m_sSource = ""
        m_sDescription = ""
        m_sHelpContext = ""
        m_sHelpFile = ""
    End Sub
    Public Default Property Get Number()
        Number = m_lNumber
    End Property
    Public Property Get Source()
        Source = m_sSource
    End Property
    Public Property Get Description()
        Description = m_sDescription
    End Property
    Public Property Get HelpContext()
        HelpContext = m_sHelpContext
    End Property
    Public Property Get HelpFile()
        HelpFile = m_sHelpFile
    End Property    
End Class