If Process Monitor is able to locate symbols for images referenced in the trace it will attempt to resolve addresses to the functions in which they reside. The stack output indicates Kernel-mode calls with a 'K' and User-mode calls with a 'U'. Finally, the Stack tab provides a very basic view of the stack for that event. The Process Tab includes information about the path, the Process ID, the Parent Process ID, the User and relevant DLL files. If you double click on an event in the log you can bring up the property sheet for that event which includes basic information about the event on the first tab. By toggling these buttons on / off, you can choose whether or not to view the Registry Activity, the File System Activity and the Process / Thread activity. In the main toolbar, you'll see this set of buttons. OK, now that you have Process Monitor up and running, let's quickly point out a couple of features on the interface: Process Monitor will start logging automatically Setting up Process Monitor is very easy - there's actually no real setup required!Įxtract the. Troubleshoot Registry issues (access, permissions, etc)Įnable Boot logging to monitor the system from bootĭetermine the registry settings for an application Troubleshoot File System issues (access, permissions, etc) Troubleshoot Application Failures (installs and uninstalls, launch failures etc) Issues we use Process Monitor for include: Process Monitor is one of the most versatile tools to use in troubleshooting. So today we're going to provide a quick overview of Process Monitor and then work through a couple of scenarios. The new version of Process Monitor combines the old Process Monitor tool with the File Monitor (FileMon) and Registry Monitor (RegMon) tools.

, one of the tools we mentioned was Process Monitor.

First published on TECHNET on Jun 01, 2007

Process monitor windows