Quick Process Monitor Tip

24 Nov 2009
November 24, 2009

Back in the olden days I used to use the Sysinternals tools Filemon and Regmon when diagnosing system issues. Those were replaced years ago by another Sysinternals tool: Process Monitor.

Process Monitor does it all. You can watch file, registry, processes – you name it. It shows what succeeds, what fails and every possible result in between. I’ve used it a lot since it came out (earlier today, in fact!) but I’ll confess that I’ve really struggled with it. Frankly, even with all the filtering options it can absolutely flood you with data.

Today, in a blazing flash of the obvious, I finally figured out how to really filter the events better. You know, sometimes you’re pretty sure you need to find a file level issue and wading through all the registry entries is annoying. I finally realized that I could filter those completely out as well.

Want to show only the file access entries? I know it sounds obvious to say just filter everything else out – well now I know how:

Process Monitor Filter

When creating the filter, “Event Class” is the one to look at. In the example above I’m telling it to exclude (not show) everything that isn’t of an Event Class of “File System”. That way, I’ll only see the file system events.

Obvious in hindsight, but it sure took me a while to suss it out.

Tags: , , ,
3 replies
  1. Andy Parkes says:

    I thought this was built-in functionality?

    On the toolbar (right hand side) there are a series of toggle buttons that let you filter out registry/file system/networking/process events

    By toggling the right buttons you can just show the filesystem activity…or am I missing the point? :-)

    Reply
    • Chris says:

      … Ya know? I’d never even glanced at those buttons until now. Geeze, talk about a blind spot! I’ve been doing everything the hard way with procmon!

      Reply

Leave a Reply

Want to join the discussion?
Feel free to contribute!

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>