Process Monitor – Microsoft’s official real-time process monitor and manager

This article is the original content of AppNee. All rights reserved. To repost or reproduce, please make a footnote with our article link!

Process Monitor is an advanced Windows OS and application monitoring tool (equivalent of Filemon + Regmon), specially designed for system troubleshooting and malware hunting for experienced users. It’s released in the excellent Windows Sysinternals, and offered by Microsoft TechNet, so its accuracy and reliability are needless to say.

As a system process real-time monitoring tool, in general, Process Monitor not only combines all features of the two classic and powerful tools: Filemon + Regmon (of which Filemon is dedicated to monitoring any file operation process in system, and Regmon is used to monitor the reading/writing of registry), and also appends an extensive list of enhancements – please see the “Key Features” list for detail!

So, with help of Process Monitor or similar system core level monitoring tools, users can thoroughly monitor and record the operations to any file/registry performed by any visible/invisible program in system at the same time, and finally through their reading/writing changes to get help for diagnosis of system failure or capture of malware, viruses or trojans, etc.

// Key Features //

  • More data captured for operation input and output parameters
  • Non-destructive filters allow you to set filters without losing data
  • Capture of thread stacks for each operation make it possible in many cases to identify the root cause of an operation
  • Reliable capture of process details, including image path, command line, user and session ID
  • Configurable and moveable columns for any event property
  • Filters can be set for any data field, including fields not configured as columns
  • Advanced logging architecture scales to tens of millions of captured events and gigabytes of log data
  • Process tree tool shows relationship of all processes referenced in a trace
  • Native log format preserves all data for loading in a different Process Monitor instance
  • Process tooltip for easy viewing of process image information
  • Detail tooltip allows convenient access to formatted data that doesn’t fit in the column
  • Cancellable search
  • Boot time logging of all operations

// Download URLs //

Direct Fast Link Page (945 KB | Homepage)