- Article
By Mark Russinovich
Published: June 20, 2024
Download Process Monitor (2.9 MB)
Download Procmon for Linux (GitHub)
Run now from Sysinternals Live.
Introduction
Process Monitor is an advanced monitoring tool for Windows that showsreal-time file system, Registry and process/thread activity. It combinesthe features of two legacy Sysinternals utilities, Filemon andRegmon, and adds an extensive list of enhancements including rich andnon-destructive filtering, comprehensive event properties such as sessionIDs and user names, reliable process information, full thread stackswith integrated symbol support for each operation, simultaneous loggingto a file, and much more. Its uniquely powerful features will makeProcess Monitor a core utility in your system troubleshooting andmalware hunting toolkit.
Overview of Process Monitor Capabilities
Process Monitor includes powerful monitoring and filtering capabilities,including:
- More data captured for operation input and output parameters
- Non-destructive filters allow you to set filters without losing data
- Capture of thread stacks for each operation make it possible in manycases to identify the root cause of an operation
- Reliable capture of process details, including image path, commandline, user and session ID
- Configurable and moveable columns for any event property
- Filters can be set for any data field, including fields notconfigured as columns
- Advanced logging architecture scales to tens of millions of capturedevents and gigabytes of log data
- Process tree tool shows relationship of all processes referenced ina trace
- Native log format preserves all data for loading in a differentProcess Monitor instance
- Process tooltip for easy viewing of process image information
- Detail tooltip allows convenient access to formatted data thatdoesn't fit in the column
- Cancellable search
- Boot time logging of all operations
The best way to become familiar with Process Monitor's features is toread through the help file and then visit each of its menu items andoptions on a live system.
Screenshots
Related Links
- Windows Internals Book
Theofficial updates and errata page for the definitive book on Windowsinternals, by Mark Russinovich and David Solomon. - Windows Sysinternals Administrator's Reference
Theofficial guide to the Sysinternals utilities by Mark Russinovich andAaron Margosis, including descriptions of all the tools, theirfeatures, how to use them for troubleshooting, and examplereal-world cases of their use.
Download
Download Process Monitor (2.9 MB)
Run now from Sysinternals Live.
Runs on:
- Client: Windows 10 and higher.
- Server: Windows Server 2012 and higher.
