Scribd
Upload
607 views13 pages

Process Monitor Tutorial Handout

Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, registry, process, thread, and network activity. It combines features from Filemon and Regmon and adds new capabilities like filtering, event properties, reliable process information, thread stacks, logging, and profiling. Process Monitor runs on Windows 2000 and newer, and allows monitoring file system, registry, process, network, and profiling events to troubleshoot systems and hunt malware.

Uploaded by

BigDom
Copyright
© Attribution Non-Commercial (BY-NC)
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
607 views13 pages

Process Monitor Tutorial Handout

Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, registry, process, thread, and network activity. It combines features from Filemon and Regmon and adds new capabilities like filtering, event properties, reliable process information, thread stacks, logging, and profiling. Process Monitor runs on Windows 2000 and newer, and allows monitoring file system, registry, process, network, and profiling events to troubleshoot systems and hunt malware.

Uploaded by

BigDom
Copyright
© Attribution Non-Commercial (BY-NC)
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

UsingProcessMonitor

ProcessMonitorTutorial Thisinformationwasadaptedfromthehelpfilefortheprogram. ProcessMonitorisanadvancedmonitoringtoolforWindowsthatshowsrealtimefilesystem, Registryandprocess/threadactivity.ItcombinesthefeaturesoftwolegacySysinternals utilities,FilemonandRegmon,andaddsanextensivelistofenhancementsincludingrichand nondestructivefiltering,comprehensiveeventpropertiessuchsessionIDsandusernames, reliableprocessinformation,fullthreadstackswithintegratedsymbolsupportforeach operation,simultaneousloggingtoafile,andmuchmore.Itsuniquelypowerfulfeatureswill makeProcessMonitoracoreutilityinyoursystemtroubleshootingandmalwarehunting toolkit. ProcessMonitorrunsonWindows2000SP4withUpdateRollup1,WindowsXPSP2,Windows Server2003SP1,andWindowsVistaaswellasx64versionsofWindowsXP,WindowsServer 2003andWindowsVista. UsingProcessMonitor

ExecutingProcessMonitorrequireslocalAdministrativegroupmembership.Whenyoulaunch ProcessMonitoritimmediatelystartsmonitoringthreeclassesofoperation:filesystem, Registryandprocess. FileSystem ProcessMonitordisplaysfilesystemactivityforallWindowsfilesystems,includinglocal storageandremotefilesystems.ProcessMonitorautomaticallydetectsthearrivalof newfilesystemdevicesandmonitorsthem.Allfilesystempathsaredisplayedrelative totheusersessioninwhichafilesystemoperationexecutes.Forexample,ifuserAhas

mountedashareasdriveletterZ:,anyaccessestheymaketothatsharewilldisplayin ProcessMonitorasbeingrelativetodriveZ:. Toremovefilesystemoperationsfromthedisplaydeselectthefilesystempushbutton intheProcessMonitortoolbarandtoaddbackfilesystemoperationsdepressthe button. Registry ProcessMonitorlogsallRegistryoperationsanddisplaysRegistrypathsusing conventionalabbreviationsforRegistryrootkeys(e.g.HKEY_LOCAL_MACHINEis representedasHKLM). ToremoveRegistryoperationsfromthedisplaydeselecttheRegistrypushbuttonin theProcessMonitortoolbarandtoaddbackRegistryoperationsdepressthebutton. Process Initsprocess/threadmonitoringsubsystemProcessMonitortracksallprocessand threadcreationandexitoperationsaswellasDLLanddevicedriverloadoperations. ToremoveProcessoperationsfromthedisplaydeselecttheprocesspushbuttoninthe ProcessMonitortoolbarandtoaddbackprocessoperationsdepressthebutton. Network ProcessMonitorusesEventTracingforWindows(ETW)totraceandrecordTCPand UDPactivity.Eachnetworkoperationincludesthesourceanddestinationaddresses,as wellastheamountofdatasentorreceived,butdoesnotincludetheactualdata. ToremoveNetworkoperationsfromthedisplaydeselectthenetworkpushbuttonin theProcessMonitortoolbarandtoaddbacknetworkoperationsdepressthebutton. Profiling ThiseventclasscanbeenabledfromtheOptionsmenu.Whenactive,ProcessMonitor scansalltheactivethreadsinthesystemandgeneratesaprofilingevenforeachone thatrecordsthekernelanduserCPUtimeconsumed,aswellasthenumberofcontext switchesexecuted,bythethreadsinceitspreviousprofilingevent.Note:theSystem processisnotincludedinprofiling.

ThereareanumberofbasicoptionsthatcontrolbasicProcessMonitoroperation: Capture:UsetheCaptureEventsmenuitemintheFilemenu,capturetoolbarbuttonorCtrl+E hotkeytotoggleProcessMonitor'smonitoring.

Autoscroll:SelectAutoscrollentryintheEditmenu,theautoscrolltoolbarbuttonorCtrl+A hotkeytotoggleProcessMonitor'sautoscrollbehavior,whichcausesittoensurethatthemost recentoperationisvisibleinthedisplay. Clear:ToclearthedisplayofallitemschooseClearDisplayfromtheEditmenuorusetheCtrl+X hotkey. ColumnSelection Youcandragcolumnstorearrangetheirorderandcustomizedthecolumnsdisplayedby choosingSelectColumnsfromtheOptionsmenutoopenthecolumnselectiondialog.Columns thatareavailableforselectioninclude: ApplicationDetails

ProcessNameThenameoftheprocessinwhichaneventoccurred. ImagePathThefullpathoftheimagerunninginaprocess. CommandLineThecommandlineusedtolaunchaprocess. CompanyNameThetextofthecompanynameversionstringembeddedinaprocess imagefile.Thistextisoptionallydefinedbytheapplicationdeveloper. DescriptionThetextoftheproductdescriptionstringembeddedinaprocessimagefile. Thistextisoptionallydefinedbytheapplicationdeveloper. VersionTheproductversionnumberembeddedinaprocessimagefile.Thisinformation isoptionallyspecifiedbytheapplicationdeveloper.

EventDetails

SequenceNumberTheuniquenumberProcessMonitorassignstoanindividualevent. EventClassTheclass(File,Registry,Process)oftheevent. OperationThespecificeventoperation(e.g.Read,RegQueryValue,etc.). Date&TimeBoththedateandthetimeofanoperation. TimeofDayOnlythetimeofanoperation. PathThepathoftheresourcethataneventreferences. DetailAdditionalinformationspecifictoanevent. ResultThestatuscodeofacompletedoperation. RelativeTimeThetimeoftheoperationrelativetoProcessMonitor'sstarttimeorthe lasttimethattheProcessMonitordisplaywascleared. DurationThedurationofanoperationthathascompleted.

ProcessManagement

UserNameThenameoftheuseraccountinwhichtheprocessthatperformedan operationisexecuting.

SessionIDTheWindowssessioninwhichtheprocessthatexecutedanoperationis executing. AuthenticationIDThelogonsessioninwhichtheprocessthatexecutedanoperationis executing. ProcessIDTheProcessID(PID)oftheprocessthatexecutedanoperation. ThreadIDTheThreadID(TID)ofthethreadthatexecutedanoperation. IntegrityLevelTheintegritylevelatwhichtheprocessthatexecutedanoperationis running(WindowsVistaonly). VirtualizedThevirtualizationstatusoftheprocessthatexecutedanoperation(Windows Vistaonly).

EventProperties Youcanaccessthepropertiesforanindividualeventbydoubleclickingontheevent,orby selectingthePropertiesmenuitemfromtheEventmenuorthecontextmenuwhenyouright clickonanevent.TheEventPropertiesdialogconsistsoftheEvent,ProcessandStackpages. Youcanmovetothenextorprecedingdisplayedorhighlightedeventwiththearrowbuttonsat thebottomoftheEventPropertiesdialog.

Event TheEventpagedisplaysinformationspecifictoanevent,includingitssequencenumber,issuing thread,eventclassandoperation,result,timestamp,andifapplicable,resourcepath.Onlyfile systemandRegistryeventsdefineresourcepaths.ThelowerareaoftheEventpagelistsdetails collectedforaneventthataredependentontheeventoperation.Thedetailsarethesameas shownforaneventintheDetailcolumnofthemaindisplay,buteachdetailisshownona separateline. Process Anevent'sProcesspageshowsinformationabouttheprocessthatexecutedanevent.Along withthedataassociatedwithaprocess'image,suchasthepathandversionstrings,the ProcesspageshowsprocessexecutionattributesliketheprocessID,useraccountinwhichthe processisexecuting,andiftheeventwasgeneratedona64bitWindowssystem,whetherthe processis32bitor64bit.ForprocessesexecutingonWindowsVistasystems,ProcessMonitor showstheintegrityleveloftheprocessandwhetherornotit'svirtualized. Thebottomareaoftheprocesspagedisplaysthelistofimagesloaded,andtheaddressesat whichtheyareloaded,intheprocessatthetimetheeventexecuted.Doubleclickonanimage inthelisttoviewmoreinformationabouttheimage,includingitsversioninformation. Stack TheStackpageshowsthethreadstackofthethreadwhentheeventwasrecorded.Thestack canbeusefulfordeterminingthereasonaneventtookplaceandthecomponentresponsible fortheevent.Kernelmodeframesofastackaredesignatedwiththeletter'K'ontheleftofthe frameandusermodestacks(onlyavailableonlyon32bitsystemspriortoVistaSP1/Windows Server2008)withtheletter'U'.IfProcessMonitorisabletolocatesymbolsforimages referencedinthetraceitwillattempttoresolveaddressestothefunctionsinwhichthey reside.Symbolsresolutioncantaketimeifsymbolsmustberetrievedfromthenetwork,for examplefromtheMicrosoftsymbolserver.UsetheSymbolConfigurationdialog,whichyou accessfromtheOptionsmenu,toconfiguresymbols. IfyouspecifyapathtosourcefilesintheSymbolConfigurationdialog,theStackdialog'sSource buttonwillenableforanyframeforwhichlinenumbersymbolsinformationisavailableand thesourcefileispresentinthepathsyouinclude.ClickingontheSourcebuttonopensatext viewerthathighlightsthesourcecodelinereferenced. Toviewmoreinformationaboutanimagelistedinthestacktraceeitherdoubleclickonthe frameorselecttheframeandpressthePropertiesbuttonbelowthestacktracearea. SelecttheStackmenuentryfromtheEventmenutoopentheEventPropertiesdialogdirectly totheStackpage.

FilteringandHighlighting ProcessMonitoroffersseveralwaystoconfigurefiltersorhighlighting. IncludeandExcludeFilters YoucanspecifyeventattributessuchthatProcessMonitorwillonlydisplayorexcludeevents withmatchingattributevalues.Allfiltersarenondestructive,meaningthattheyaffectonly whicheventsProcessMonitordisplays,nottheunderlyingeventdata. WhenaneventisselectedtheIncludeandExcludesubmenusintheEventmenuallowsyouto easilyaddoneoftheevent'sattributestotheconfiguredIncludeorExcludefilters.For example,toonlyshoweventsexecutedbyaparticularprocessnamechoosetheProcessName entryfromtheIncludesubmenu.Youcanalsoselectmultipleeventsandsimultaneously configureanattributefilterforalloftheuniquevaluescontainedintheselectedevents. ProcessMonitorORstogetherallthefiltersthatarerelatedtoaparticularattributetypeand ANDstogetherfiltersofdifferentattributetypes.Forexample,ifyouspecifiedprocessname includefiltersforNotepad.exeandCmd.exeandapathincludefilterforC:\Windows,Process MonitorwouldonlydisplayeventsoriginatingineitherNotepad.exeorCmd.exethatspecify theC:\Windowsdirectory. MorecomplexfilteringoptionsareavailableintheFilterdialog,whichyouopenbyselecting FilterfromtheToolsmenuorbyclickingontheFiltertoolbarbutton.Afilterentryconsistsof anattributefield(e.g.AuthenticationID,ProcessName,etc.),acomparisonoperation,an attributevalue,andafiltertypeofeitherIncludeorExclude.Forconvenience,ProcessMonitor willautomaticallypopulatetheattributevaluedropdownwithvaluesthatarepresentinthe loadedtracedata,butyoucanenterarbitraryvalues. FilterContextMenu IfyourightclickonaniteminthedisplayProcessMonitordisplaysacontextmenuthatlet's youviewtheitem'spropertiesorconfigureafilterbasedontheitem'sattributes.Further, quickfilterentriesareaddedtothemenuforthevalueofthecolumnonwhichyouclick. DestructiveFiltering Bydefault,ProcessMonitorfiltersapplytothedataitdisplays,notwhatitsaves.Thisallows youtochangefilterstoobtaindifferentviewsofdatawithoutaffectingtheexcludeddata. However,youcanconfigureProcessMonitortodeleteanydatathat'sexcludedbyafilteratthe timethedataiscapturedbytogglingdestructivefilteringmode,whichyoudobychoosingDrop FilteredEventsfromtheFiltermenu.

IncludeProcessfromWindow Thetoolbarincludesabuttonshapedlikeatargetthatyoucandragoffanddropontoa windowtocauseProcessMonitortoaddtheprocessIDoftheprocessthatownsthewindow totheIncludefilter. Basicvs.AdvancedMode TheFiltermenu'sEnableAdvancedOutputmenuitemcontrolswhetherProcessMonitoris operatinginBasicorAdvancedMode.WheninBasicmodeProcessMonitorconfiguresbuiltin filterstoexcludesystemrelatedactivityfromthedisplayandusesintuitivenamesforinternal filesystemoperations.Forexample,ProcessMonitorshowstheinternalIRP_MJ_READ operationasReadwheninBasicmode.Basicmodemakesoutputeasiertoreadandomits eventsusuallynotrelevantforapplicationtroubleshooting. SavingandLoadingFilters OnceyouhaveconfiguredafilteryoucansaveitusingtheSaveFiltersmenuitemintheTools menu.ProcessMonitoraddsfiltersyousavetotheLoadFiltermenuforeasyaccessandyou canchangetheorderinwhichthefiltersdisplayinthemenuusingtheOrganizeFiltersdialog thatyouopenwithOrganizeFiltersintheToolsmenu.YoucanusetheOrganizeFilterdialogto renamesavedfiltersaswellastoeasilyexportfilterstoaformatthatyoucanthenreimport usingtheOrganizeFilterdialogonothersystems. Highlighting ProcessMonitorshighlightingfiltersenableyoutospecifyeventattributesthatcauseanevent tobeshownwithahighlightcolor.TheHighlightsubmenuintheEventmenuprovidesquick accessfordefininghighlightfilterentriesandtheHighlightmenuentryintheToolsmenuopens theHighlightFilterdialog,whichoperatessimilarlytotheInclude/ExcludeFilterdialog. TheProcessTree TheProcessTreemenuentryintheToolsmenuopenstheProcessTreedialog,whichdisplays alloftheprocessesreferencedintheloadedtraceinahierarchythatreflectstheirparentchild relationships.Processeswiththesameparentaresortedaccordingtotheirstarttime. Processesthatarealignedalongtheleftsideofthewindowhaveparentprocessesthatdidnot executeanyeventinthetrace. WhenyouselectaprocessinthetreeasubsetofthedataProcessMonitorhasobtainedabout theprocess,suchasitsimagepath,useraccount,andstarttime,showsinthebottomofthe dialog.ToviewmoreinformationaboutaprocessyoucanclickontheGoToEventbutton, whichresultsinProcessMonitorlocatingandselectingthefirstvisibleiteminthetrace

executedbytheprocess.Notethatfilterscanpreventthisoperationfromsucceedingby excludingfromthedisplayallofthespecifiedprocess'events. TraceSummaryTools ProcessMonitorincludesanumberofdialogsthatallowyoutoperformsimpledataminingon theeventscollectedinatrace. SystemDetails ProcessMonitorcapturessomeinformationaboutthesystemonwhichitcollectsatrace, includingthemachinename,thesystemrootpath,andwhethertheOSis32bitor64bit.You canaccessthisinformation,whichProcessMonitorstoresinlogfiles,fromtheSystemDetails dialogintheToolsmenu. UniqueValues TheUniqueValuesdialog,whichyouopenusingthecorrespondingmenuentryintheTools menu,letsyouseetheuniquevaluesforeachofthedifferentattributevaluesdefinedfor eventsinatrace.Forexample,ifyouwantquicklyseeallthepathsreferencedinthetrace, choosePathintheselectionentry. DoubleclickingonadisplayedvalueorclickingontheFilterbuttonaddsanincludefilterforthe currentlyselectedvalue. CountOccurrences OpentheCountOccurrencesdialogfromtheToolsmenu.Itdisplaystheuniquevaluesseenina tracefortheattributetypeyouspecifyalongwiththenumberoftimesinthetraceanevent containedthevalue. ProcessSummary Thisdialogsummarizestheprocessesseeninthetrace,includingtheirprocessID,imagename, andcommandline. FileSummary TheFileSummarydialoglistseachuniquefilesystempathpresentinthefilteredtrace,the amountoftimespentperformingI/Otothefile,totalnumberofeventsthatreferencedthe path,andthecountofindividualoperationtypes.

RegistrySummary TheRegistrySummarydialoglistseachuniqueRegistrypathpresentinthefilteredtrace,the amountoftimespentperformingI/OtotheRegistrypath,totalnumberofeventsthat referencedthepath,andthecountofindividualoperationtypes. NetworkSummary TheNetworkSummarydialoglistseachuniquedestinationIPaddresspresentinthefiltered traceandthenumberdifferenttypesofevents,includingsendsandreceives,toeachaddress. StackSummary UsetheStackSummarydialogtoseeindividualinstancesofstacktracesforeachprocess, includingthenumberoftimesthestacktraceoccursandthetotaltimespentineventsthat sharethesametrace. Options AnumberofsettingsintheOptionsmenumodifyProcessMonitor'sbehavior. AlwaysonTop SelectingthisoptioncausestheProcessMonitorwindowtoremainontopofotherwindows. Font ThisoptionopensafontselectiondialogwhereyoucanchosethefontProcessMonitoruses foritsdisplay. HighlightColors ChosethisentrytoopenadialogtopickthetextandbackgroundcolorsProcessMonitoruses forentriesthatmatchtheconfiguredhighlightfilters. ConfigureSymbols ProcessMonitorcanusesymbolinformation,ifavailable,toshowfunctionsreferencedon eventstacks.YoucanfindinformationonconfiguringsymbolsontheMicrosoftDebugging ToolsforWindowswebpage.

HistoryDepth ProcessMonitorwatchescommittedmemoryusageandturnsitselfoffwhenvirtualmemory runslow,buttheHistoryDepthdialoglet'syoulimitthenumberofentriesitkeepssothatyou canleaveProcessMonitorrunningforlongperiodsandensurethatitalwayskeepsthemost recentevents. ProfilingEvents Usethismenuentrytoopenthethreadprofilingconfigurationdialog,whereyouenablethread profilingandtherateatwhichthreadprofilingeventsgenerate.Whenthreadprofilingis enabled,ProcessMonitorcapturesthreadstacktracesandCPUutilizationthatyoucanuseto identifythesourceofCPUrelatedperformanceissues. EnableBootLogging UsethisoptiontoconfigureProcessMonitorbootlogging. SavingandLogging FileFormats YoucanusetheSaveentryintheFilemenutosaveProcessMonitordatainnative(PML), commadelimitedvalue(CSV),orXMLformats.ThePMLformatpreservesallofthedata capturedsothatyoucanreloaditbackintoProcessMonitoronthesamesystemoradifferent one.CSVfilesareusefulforimportingintoExcelorotherdataanalysisapplications.Finally,XML emitsXMLformatteddatathatcanbeparsedbytoolsthatmanipulateXML. Logging Bydefault,ProcessMonitorusesvirtualmemorytostorecaptureddata.UsetheBackingFiles dialog,whichyouaccessfromtheFilemenu,toconfigureProcessMonitortostorecaptured datainfilesondisk.EnablingthisoptionhasProcessMonitorlogdatatothediskinitsnative PMLformatasitcapturesit. TheBackingFilesdialogalsodisplaysdiagnosticinformation,includingthenumberofevents captured,processesdefinedandthecapturethread'sloadstatus. BootLogging ProcessMonitorcanlogactivityfromapointveryearlyinthebootprocessduringthe initializationofbootstartdevicedrivers.ConfigureProcessMonitortologthenextbootby selectingEnableBootLoggingfromtheOptionsmenu.ProcessMonitor'sdriverwilllogactivity

atthenextbootintoafileinthe%Windir%directoryandwillcontinueloggingthroughthe shutdownoruntilyourunProcessMonitoragain.Thus,ifyoudon'trunProcessMonitorduring abootsessionyouwillcaptureatraceoftheentireboottoshutdowncycle. WhenyourunProcessMonitoritlookstoseeifapreviousbootloghasbeengenerated,andif so,asksyouwhereyouwanttoplacetheprocessedbootlogoutputfile.ProcessMonitor displaysthetraceafterithasfinishedtranslatingit.ToseeactivityfromtheSystemprocess, whichistheonlyprocessearlyinaboot,selectEnableAdvancedOutputfromtheOptions menu. Ifyouconfigurebootloggingandthesystemcrashesearlyinthebootyoucandeactivateboot loggingbychoosingtheLastKnownGoodoptionfromtheWindowsbootmenu(whichyou accessbypressingF8duringtheboot). Note:networkevents,whicharebasedonETW(EventTracingforWindows),arenotavailable inbootlogs. ImportingandExportingConfiguration OnceyouhaveconfiguredafilteryoucansaveitusingtheSaveFiltersmenuitemintheTools menu.ProcessMonitoraddsfiltersyousavetotheLoadFiltermenuforeasyaccessandyou canchangetheorderinwhichthefiltersdisplayinthemenuusingtheOrganizeFiltersdialog thatyouopenwithOrganizeFiltersintheToolsmenu.YoucanusetheOrganizeFilterdialogto renamesavedfiltersaswellastoeasilyexportfilterstoaformatthatyoucanthenreimport usingtheOrganizeFilterdialogonothersystems. YoucanalsoexportProcessMonitor'sentireconfiguration,includingfilters,columnselection, columnorderandsize,logfilesettings,anddebughelpfilepathconfiguration,toaProcess MonitorConfigurationfile(.PMC)usingtheExportConfigurationmenuentryintheFilemenu. UsetheFilemenu'sImportConfigurationentrytoloadasavedconfigurationfile. CommandLineOptions ProcessMonitorsupportsseveralcommandlineoptions: /Openlog<savedPMLlogfile> DirectsProcessMonitortoopenandloadthespecifiedlogfile. /Backingfile<logfilename> HasProcessMonitorcreateandusethespecifiedfilenameastheloggingfile. /Pagingfile

Saveeventstothepagingfile. /Noconnect WhenthisflagispresentProcessMonitordoesnotautomaticallystartloggingactivity. /Nofilter Clearsthefilteratstartup. /AcceptEula AutomaticallyacceptsthelicenseandbypassestheEULAdialog. /Profiling Enablesthethreadprofilingeventclass. /Minimized StartsProcessMonitorwithitswindowminimizedtothetaskbar. /WaitForIdle WaitforaninstanceofProcessMonitortobecomeready. /Terminate TerminateallinstancesofProcessMonitorandexit. /Quiet Don'tconfirmfiltersettingsonstartup. /Run32 Usesthisswitchtorunthe32bitversionofProcessMonitoron64bitWindowstoopenlogs generatedon32bitsystems /HookRegistry Thisswitch,whichisavailableonlyon32bitVistaandServer2008,hasProcessMonitoruse systemcallhookinginsteadoftheRegistrycallbackmechanismtomonitorRegistryactivity, whichenablesittoseeSoftgridvirtualRegistryoperationsontheseoperatingsystems.This

optionmustbeusedthefirsttimethatProcessMonitorisrunonasystemandshouldonlybe usedtotroubleshootSoftGridapplications. /SaveAs,/SaveAs1,/SaveAs2 Usetheseswitcheswiththe/OpenLogswitchtohaveProcessMonitorexportalogfileinto CSV,XML,orPMLformat.The/SaveAs1optionincludesstackinformationforexporttoXML formatandthe/SaveAs2optionaddssymbolinformation. ScriptingProcessMonitor YoucanuseProcessMonitorcommandlineoptionstodriveitwithabatchfile.Hereishow yourbatchfileshouldlooktocaptureatraceofnotepad.exe'sexecution: setPM=C:\sysint\procmon.exe start%PM%/quiet/minimized/backingfileC:\temp\notepad.pml %PM%/waitforidle notepad.exe %PM%/terminate ThefirstinvocationofProcessMonitorusingstartensuresthattheprocessdetachesfromthe consolewindow,whichallowsittorunconcurrentlywiththelatercommands.Thesecond invocationwith/WaitForIdlecausesthebatchfiletopauseuntilthefirstinstanceisupand runningandactivelycapturingevents.Thefinalinvocationwith/Terminatetellsthefirst instancetostopcapturing,commitanyoutstandingdatatothebackingfileandexitcleanly.

Common questions

Powered by AI

Process Monitor uses Event Tracing for Windows (ETW) to monitor TCP and UDP network activity, capturing source/destination addresses and data transfer amounts. While this provides valuable information about network traffic, the main limitation is that it does not capture the actual data content being transmitted. This restricts its utility to analyzing traffic patterns rather than the data itself, potentially limiting its effectiveness in situations where data payloads are crucial for troubleshooting or security analysis .

Process Monitor tracks all process and thread creation and exit operations, as well as DLL and device driver loads. It records detailed attributes including process ID, thread ID, user and session IDs, and tracks whether the process is running in 32-bit or 64-bit mode on 64-bit systems. For Windows Vista systems, it also tracks the integrity and virtualization status of processes. The tool's ability to provide detailed process/thread information aids in understanding and diagnosing system behaviors and malfunctions .

Process Monitor's profiling feature scans active threads and records their kernel and user CPU time along with context switches since the previous profiling event. This allows analysts to identify CPU-related performance issues by indicating which threads and processes consume the most CPU resources. Profiling data enables a detailed examination of how system resources are used over time, aiding in the optimization of application performance and system resource management .

Process Monitor is an advanced monitoring utility for Windows, providing real-time file system, Registry, and process/thread activity monitoring. It combines features from earlier utilities such as Filemon and Regmon with enhancements like rich filtering and comprehensive event properties. It offers reliable process information, full thread stacks, and network monitoring through Event Tracing for Windows (ETW). Additionally, it supports simultaneous logging and profiling of CPU usage, which are essential for troubleshooting system issues and detecting malware activities .

The basic mode of Process Monitor simplifies its output by using intuitive names for file system operations and excluding system-related activity, making it user-friendly for application troubleshooting. This mode omits less relevant events, reducing noise for users focused on specific application behavior. Advanced mode, however, provides more comprehensive data, displaying all system activities, which is crucial for in-depth technical analysis and diagnosing complex operational issues. The choice between these modes impacts data interpretation by determining the breadth and granularity of available information .

The native PML format in Process Monitor preserves all captured data with full detail, allowing for comprehensive analysis and reloading on any system with Process Monitor installed, which is ideal for in-depth investigation and collaborative troubleshooting. In contrast, CSV is beneficial for importing data into spreadsheet applications like Excel for data manipulation and analysis, albeit with potential data loss in terms of detail. XML offers structured data suitable for integration with systems supporting XML data, aiding in automation and data mining tasks. Each format serves different analytical purposes, balancing granularity against ease of sharing and cross-application compatibility .

Process Monitor facilitates stack analysis by showing the thread stack details for each recorded event. It distinguishes between kernel-mode and user-mode frames, resolving function addresses if symbol information is available. Stack analysis is significant as it aids in identifying the cause of an event and the responsible components. It is particularly useful for debugging and performance diagnostics, helping to pinpoint bottlenecks and faults in program execution .

Symbol resolution in Process Monitor enhances stack trace analysis by converting raw addresses into human-readable function names, offering detailed insights into execution flow. It assists users in understanding which functions are involved in specific events or errors. Users can configure symbol resolution through Process Monitor's symbol configuration option, which involves setting the path to debugging tools that can resolve symbols, thereby increasing the precision of event analysis .

Enabling boot logging in Process Monitor allows it to capture activity from early in the boot process, including initialization of boot-start drivers, and continues through to shutdown. This comprehensive logging is vital for diagnosing system startup issues because it enables the capture of events that might lead to early boot failures or delays. The complete boot-to-shutdown logs provide insights into system behavior that might not be visible from typical operational logs. However, network events, based on Event Tracing for Windows, are not captured in boot logs, which may limit network-related diagnostics .

Process Monitor allows non-destructive filtering, meaning that while filters change the data view, the excluded data is not removed from the log. This feature enables users to apply various filters to decide which data to display for targeted troubleshooting without losing any information. Filters can be saved and organized for reuse, facilitating efficient analysis of recurring issues. Advanced filtering includes highlighting specific events, configuring destructive filters, and using quick-filters for contextual filtering. These filtering capabilities help analysts focus on relevant data, simplifying the identification and understanding of operational anomalies .

You might also like