Psutil, pretty sweet utility.
Well, not really, but that would be funny if it did stand for that.
But the Python system and process utilities is a
cross‑platform library for retrieving information on
running processes and system utilities.
It is our first library we will need to pull down and install
with a pip or your installment method of choice.
At the PyPI website, you can find information on psutil,
download the files,
and find documents and forums to discuss the library and learn
how others are using it to their advantage.
On the readthedocs.io PDF link,
you can get a full detail of the functions included in the library.
Here's a quick look into the material.
As you can see, not only does it talk about the functions,
but also some of the detail of the parameters in those functions,
a truly well‑documented library.
So, what is psutil?
Well,
it is the library that lets you get into the system functions and
processes the seen metrics and other details on the CPU,
memory, disks, network devices, and various other sensors.
I probably don't have to go into too much detail on
how important this can be to you, the ability to not only see processes running,
but be able to find the process by name and pull it
back with all its detail on it.
As an analyst,
you may want to monitor what processes are running on a server and
what network connections those processes are making.
You can then take this baseline and run a script around the clock regularly
and compare the results in order to find unusual activity.
The functions within this library are what we're going
to focus on to gain you your insight.
Net_connections will give you all your open socket connections,
broken out into couples containing all the key pieces of information for each,
including the local port, the remote IP and port,
and the PID that opened the socket.
This is huge when monitoring suspicious software you are testing in a sandbox.
Process will return information on the process that called it,
or if the PID is specified, information on that process.
When used in conjunction with the one‑shot context manager,
you can pull all the details back in one call,
dramatically speeding up your work.
Cpu, disk,
and virtual_memory all pull the metrics on the
various parts of the system specified.
All right, so let's take a look at the psutil.
This is going to basically cover all of our system and process utilities,
as you know, all the metrics and whatever is going on within our systems.
It does require the pip install, so we have to do the pip install to psutil.
That will then give us access to be able to import the psutil that you see here,
which then gives us access to all the functions and
methods and everything below that.
So the first thing we're going to look at is
net_connections and then the users and then the PIDs.
So the net_connection is your network connections,
and I did point out in here under the parameters that I want kind= inet4.
Inet4 says I want all the IPv4 connections,
so this way it doesn't pull back everything,
all my different networking.
And I added the 0 onto the end in the list because I
want to only just pull back one.
It's going to give you every single inet4 connection,
I just need the first one just for demo purposes.
The users is going to pull back all your connected users.
Mine should just have my user.
So if you do have a server that has multiple people logged in,
it will pull back all the users that are currently in there.
And then the PIDs is just all your process IDs of all
the running processes right now.
So let's jump over into a demo of this right now.
We're going to run that, and we're going to see our network and the network ID,
we're going to see the users that are currently logged in, which is just the one
standard user right now, and then all the PIDs.
So let's jump back into the code and we can dive
down a little bit deeper into that.
So let's uncomment this out, and basically what we're going to
look at now is our process iteration. The process iteration
function allows you to select, hey, I want the process ID,
I want the name of that process, and I want the user
name that's running that process.
I can then take that information and I can print all that out on the screen.
That gives you a cleaner list of what is going on.
It's not just process IDs that mean absolutely nothing to you.
This actually dives into a little bit about what is each of those process IDs.
So we see each of these, and now we can take one of those.
So I'm going to take, for example,
we're going to look at the svchost 1948, and back in the code over
here I can even dive even deeper into that now.
So I have psutil.Process that I can put that 1948 into.
I can say give me all the information on this one particular process.
So this one‑shot function then allows me to pull back the name,
CPU time, CPU percentage, the create time,
parent PID, and then also the current status of it.
So when I run this now, I have that full list of all the PIDs
again and then I have this svchost process and all the
information on that particular process.
So it allows you to dive into various processes,
understand who their parents are, understand how this process came about.
So jumping back into the code here,
I'm going to take this a little bit farther now, and we're
going to jump over from looking at processes to looking at
our CPU and our system information.
So we're going to comment out everything here at the
top just to get that out of our way.
What we're going to look at next is the functions that allow us
to look at the CPU times, CPU percentages,
virtual memory, disk usage, more virtual memory,
more disk usage, the partitions, the users, and the boot time.
A whole bunch of functions here.
I'm just going to go ahead and run it, and what you're going to see
here is all that information we just covered.
So what is the CPU percentage of the CPU in use, what is the percentage of
the memory in use, going through the whole nine yards, a lot of good
information about what is going on within your system.
So these types of functions can be used within an analyst role when
you want to kind of monitor various systems. You're starting to get
some alerts and different things popping up on the system, you just
want to pull back all the different processes and what's running on
those systems.
The last piece I want to look at here, pulling processes by name.
So one of the processes that are in there is your winlogon.
So when I do a search now of that winlogon process,
it pulls back just the information on that winlogon process.
This is useful when you're going through this whole process list
and you see a process you're not understanding.
What is this, what is it doing, who are its parents, where'd it come from?
It's a lot of good information that could be used by your networking,
your analysts to research what's going on within your systems.