Troubleshooting PowerShell Processes

[Robert Bollinger]

Hey Guys, 

I have an issue where a single PowerShell process is using 20% of the CPU and up to 10GB of RAM . This causing windows resource exhaustion issues. (RADAR). Looking in the IIS processes, i see that PowerShell and ECP are both slammed (powershell more than ecp). 

Using the IIS logs i am able to find what looks like an offending user, this specific user has 114K items in the log files, calling ECP and PowerShell. 

How can i figure out exactly what commands or processes are being under this powershell session? I know the Process ID and i thought that DebugView would tell me, but Debug logging isnt enabled. 

Is there an easier way to tell what cmdlets the process is running? The user is most likely running an exchange powershell script. 

@Ross Smith IV @Tony Redmond @Joe Schaeffer 

Any ideas guys? this would be right down your alley!!

Thanks, 

Robert 

[#2]

@Robert Bollinger 

Is it a local script on the server or is it a remote script and call a webside what is provided by your IIS?

If it is a local script that search for it (open the taskmanager, configure the command line column) and look for the script path.

Than you can have a look into the script.

If it is a remote script, that may Fiddler is the thing what will help you to see what kind of request comming to your IIS via the remote script.

br,

Nico