Shell – How to get full command and parent process id from powershell

command linepowershell

It is the command I run in powershell

 gwmi win32_process |select ProcessID,ParentProcessID,CommandLine,@{e={$_.GetOwner().User}}

And here is partial listing of the ouput

                            ProcessID                       ParentProcessID CommandLine                          $_.GetOwner().User                  
                        ---------                       --------------- -----------                     ------------------                  
                                0                                     0                                                                          
                                4                                     0                                                                          
                              236                                     4                                      SYSTEM                              
                              332                                   320                                      SYSTEM                              
                              384                                   320 wininit.exe                          SYSTEM                              
                              392                                   376                                      SYSTEM                              
                              420                                   376 winlogon.exe                         SYSTEM                              
                              476                                   384                                      SYSTEM                              
                              484                                   384 C:\Windows\system32\lsass.exe        SYSTEM                              
                              544                                   476 C:\Windows\system32\svchost.exe -... SYSTEM

I want to know how can I obtain the full command line? (not truncated as shown above)

I need to capture the output for processing in a sensu plugin, which is essentially a ruby script

Best Answer

It's just the formatting. The full command line is there in the object but the formatting of the objects when they get converted to strings for printing (the default formatting uses "ft") cuts down the line. If you format differently, with the list formatter, you get the full data in the longer form:

.. your command ... | fl

If you want to use the results in a script, you don't need to care about formatting, just get the property .CommandLine from the objects in the pipeline (and then you can skip the "select" command too).

For getting the text to a Ruby script, you can just explicitly produce the text strings with space-separated fields:

gwmi win32_process | % { "$($_.ProcessID) $($_.ParentProcessID) $($_.GetOwner().User) $($_.CommandLine)" }

To have the default "table" formatter wrap the columns, use:

... | ft -wrap

I don't know a way to just make it display the long lines, I think it's doable by defining a custom formatting view for this object class but I've never done it myself.

Related Question