Retrieves timing information for the specified process.

Syntax

BOOL GetProcessTimes(  [in]  HANDLE     hProcess,  [out] LPFILETIME lpCreationTime,  [out] LPFILETIME lpExitTime,  [out] LPFILETIME lpKernelTime,  [out] LPFILETIME lpUserTime);

Parameters

[in] hProcess

A handle to the process whose timing information is sought. The handle must have thePROCESS_QUERY_INFORMATION orPROCESS_QUERY_LIMITED_INFORMATION access right. For more information, seeProcess Security and Access Rights.

Windows Server 2003 and Windows XP:  The handle must have thePROCESS_QUERY_INFORMATION access right.

[out] lpCreationTime

A pointer to aFILETIME structure that receives the creation time of the process.

[out] lpExitTime

A pointer to aFILETIME structure that receives the exit time of the process. If the process has not exited, the content of this structure is undefined.

[out] lpKernelTime

A pointer to aFILETIME structure that receives the amount of time that the process has executed in kernel mode. The time that each of the threads of the process has executed in kernel mode is determined, and then all of those times are summed together to obtain this value.

[out] lpUserTime

A pointer to aFILETIME structure that receives the amount of time that the process has executed in user mode. The time that each of the threads of the process has executed in user mode is determined, and then all of those times are summed together to obtain this value. Note that this value can exceed the amount of real time elapsed (betweenlpCreationTime andlpExitTime) if the process executes across multiple CPU cores.

Return value

If the function succeeds, the return value is nonzero.

If the function fails, the return value is zero. To get extended error information, callGetLastError.

Remarks

All times are expressed usingFILETIME data structures. Such a structure contains two 32-bit values that combine to form a 64-bit count of 100-nanosecond time units.

Process creation and exit times are points in time expressed as the amount of time that has elapsed since midnight on January 1, 1601 at Greenwich, England. There are several functions that an application can use to convert such values to more generally useful forms.

Process kernel mode and user mode times are amounts of time. For example, if a process has spent one second in kernel mode, this function will fill theFILETIME structure specified bylpKernelTime with a 64-bit value of ten million. That is the number of 100-nanosecond units in one second.

To retrieve the number of CPU clock cycles used by the threads of the process, use theQueryProcessCycleTime function.

Requirements

See also

FILETIME

FileTimeToDosDateTime

FileTimeToLocalFileTime

FileTimeToSystemTime

Process and Thread Functions

Processes