2295: Collecting Process Monitor Log

Translate to:

What is Process Monitor

Process Monitor is an advanced monitoring tool that shows real-time file system, registry and process activity. It combines the features of two legacy Sysinternals utilities, Filemon and Regmon, and adds a number of other enhancements.

Process Monitor can be used to track system and software activity to troubleshoot some of product issues, especially when it is necessary to track what particular application or process accesses a file or a registry key.

The main Process Monitor window lists all system operations along with their exact time, process name, ID and the result for each single operation:

To access advanced information on any single operation right-click on the operation line and choose Properties:

When analyzing a Process Monitor log, it is recommended to filter out entries. For example you can right click on Successes under Results, and exclude it. You can also filter out Processes and generally any field you like.

How to collect a Process Monitor log

Whenever it is necessary to get information on the exact process/application that changes or creates a file/registry key or accesses a path on the local drive, please do the following:

  1. Download Process Monitor from Windows Sysinternals page, extract and run it:

  2. Reproduce the issue without closing the utility;
  3. Click File ->Save in the main Process Monitor window:

  4. Note the path where the log file is saved, so that you will be able to find it:

  5. Select All events and save the log file in the PML format:

  6. Please make sure to copy the logfile.PML into a ZIP file, as it becomes significantly smaller:

How to run Process Monitor on schedule

You can create a scheduled task to start and to stop Process Monitor using Windows Task Scheduler.

To start Process Monitor on schedule:

  1. Download Process Monitor from Windows Sysinternals page and extract it.
  2. Go to Control Panel -> Administrative Tools and open Task Scheduler.
  3. Click Task Scheduler Library.
  4. Under Actions, click Create Basic Task.
  5. Provide a name for the task (for example, Start Process Monitor) and click Next.
  6. In When do you want the task to start, click One time (or select a frequency depending on the nature of your issue).
  7. Enter the time when you want the task to be run and click Next.
  8. In What action do you want the task to perform, select Start a program and click Next.
  9. Browse for the Process Monitor executable (procmon.exe). Add these arguments:
    /accepteula /quiet /BackingFile <log path>
    where <log path> is the pat to the resulting log file (for example C:\log.pml)
    Make sure you have enough disk space where you are saving the log file.
  10. Click Next.
  11. Check the Open the Properties dialog for this task when I click finish check box and click on Finish.
  12. The properties dialog is shown. Click Change User or Group, select SYSTEM, and click OK.

Now you need to create a task that stops Process Monitor in a while:

  1. Open the Task Scheduler again.
  2. Create a new basic task.
  3. Provide a name for the task, for example Stop Process Monitor.
  4. In When do you want the task to start, click One time (or select a frequency depending on the nature of your issue).
  5. Enter the time when you want the task to be stopped (for example, 5 minutes after starting Process Monitor) and click Next.
  6. In What action do you want the task to perform, select Start a program and click Next.
  7. Browse for the Process Monitor executable (procmon.exe). Add this argument:
    /terminate
  8. Click Next.
  9. Check the Open the Properties dialog for this task when I click finish check box and click on Finish.
  10. The properties dialog is shown. Click Change User or Group, select SYSTEM, and click OK.

More information

The latest version of the Process Monitor utility is always available at Microsoft TechNet Sysinternals Download Page.

Process Monitor can be run on Windows 2000 SP4, Windows XP SP2, Windows Server 2003 SP1, Windows Vista, Windows Server 2008, Windows 7 as well as x64 versions of Windows XP, Windows Server 2003 SP1, Windows Vista, Windows Server 2008, Windows 7.

You can open PML files only with the Process Monitor itself.

Tags: 

You are reporting a typo in the following text:
Simply click the "Send typo report" button to complete the report. You can also include a comment.
CAPTCHA
This question is for testing whether or not you are a human visitor and to prevent automated spam submissions.
2 + 18 =
Solve this simple math problem and enter the result. E.g. for 1+3, enter 4.