'==========================================================================
'NAME		: Display Memory Processes
'AUTHOR		: Marcus C. Oh
'DATE		: 7/26/2006
'COMMENT	: Run as a response script to a rule that checks CPU utilization
'		: Lists processes utilizing % value of CPU over threshold
'==========================================================================
Const EVENT_TYPE_SUCCESS = 0
Const EVENT_TYPE_ERROR = 1
Const EVENT_TYPE_WARNING = 2
Const EVENT_TYPE_INFORMATION = 4
Const EVENT_TYPE_AUDITSUCCESS = 8
Const EVENT_TYPE_AUDITFAILURE = 16

Set oWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & ScriptContext.TargetNetbiosComputer & "\root\cimv2")
Set oProcesses = oWMIService.ExecQuery("SELECT * FROM Win32_Process")

Dim aProcess()

x = 0
For Each oProcess In oProcesses
	ReDim Preserve aProcess(2,x)	' ReDim can only update the last dimension
	aProcess(0,x) = oProcess.WorkingSetSize / 1024
	aProcess(1,x) = oProcess.Name
	x = x + 1
Next

y = 0
For j = 0 To x - 1
 	y = y + aProcess(0,j)	' Count up the total memory used
Next

z = Round(y/x)				' Divide total memory used by total processed and round it up

sMessage = "The processes using greater than " & Z & "k of memory are:" & VbCrLf & VbCrLf
For i = 0 To x - 1
	If aProcess(0,i) > z Then
		sMessage = sMessage & aProcess(1,i) & " : " & aProcess(0,i) & VbCrLf
 	End If
Next
sMessage = sMessage & VbCrLf & "(There are " & x & " processes running at this time.)"

CreateEvent 40150,EVENT_TYPE_INFORMATION,"Memory Processes Script",sMessage

Sub CreateEvent(iEventNumber,iEventType,sEventSource,sEventMessage)
    Set oEvent = ScriptContext.CreateEvent()
    oEvent.EventNumber = iEventNumber
    oEvent.EventType = iEventType 
    oEvent.EventSource = sEventSource
    oEvent.Message = sEventMessage
    ScriptContext.Submit oEvent
End Sub