Scribd
Upload
37 views5 pages

Analyzing Slow Boot with Process Monitor

The document discusses using Process Monitor to diagnose slow Windows boot problems. It describes how to enable boot logging in Process Monitor to monitor processes during startup. The summary shows how to filter the Process Monitor log to find processes that take over 10 seconds, and analyze the process tree to identify specific slow processes, drivers, or services causing boot time issues.

Uploaded by

neevu
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
37 views5 pages

Analyzing Slow Boot with Process Monitor

The document discusses using Process Monitor to diagnose slow Windows boot problems. It describes how to enable boot logging in Process Monitor to monitor processes during startup. The summary shows how to filter the Process Monitor log to find processes that take over 10 seconds, and analyze the process tree to identify specific slow processes, drivers, or services causing boot time issues.

Uploaded by

neevu
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd

Using Process Monitor to Solve a Slow Boot

Problems
To diagnose the reasons of slow Windows boot, there is a number of quite powerful tools and
techniques of log analysis that allow performing the detailed debugging of all steps of system
boot and start of services (xperf/xbootmgr from Windows Performance Toolkit / Analyzer).
But their use can cause some troubles, especially, for a beginning system administrator. In
this article we’ll show how to easily and quickly detect, which apps, services and drivers
work slow during the system start, thus increasing the total boot time.

Certainly, all Windows system administrators should be familiar with Process Monitor from
from the Sysinternals system utilities kit. Process Monitor allows monitoring the activities of
running processes, access to the file system and the registry in real time. One of the little-
known Process Monitor features is the opportunity to enable monitoring of processes started
during Windows startup.

To diagnose the boot stage, Process Monitor creates a separate service in HKLM\SYSTEM\
CurrentControlSet\Services section of the registry. This service loads the boot mode driver
[Link] that starts after [Link] is launched and logs the activity of all processes
run during system boot and user logon.

1. Download and unpack the archive containing Process Monitor


([Link]
2. Run [Link] with the administrator privileges
3. Select Enable Boot Logging in the Options menu
4. In the next window, select Generate thread profiling events -> Every second. In
this mode, procmon driver will capture the state of all processes every

second
5. Restart your computer and wait till your desktop appears
6. [Link] will log all events until a user starts Process Monitor. After that the
boot logging mode is disabled
7. In Process Monitor window, accept the offer to save the collected data to a file.

Note. If you don’t stop Process Monitor, the temporary log file %windir%\[Link] will
eventually take up all free space on the system drive.

12. Select the directory you want to save the file to and wait till it is saved. In my case,
three files: Bootlog .pml, [Link] and [Link] with the total size 700
MB appeared in the target directory.
13. In ProcMon window, click the header of the table, then click Select Columns and
enable the display of the Duration column

14. Create a new filter in the Filter menu.


15. Select Duration as the parameter of the filter, more than as the filter condition and
specify the value 10.

16. Thus, in the list of processes you will have only the processes that spend more that 10
seconds to perform some operations. (I have chosen 10 seconds to make the example
more demonstrative).

17. To analyze the boot process, you can also use Tools ->Process Tree feature that
displays all processes as a graphic tree containing the information about the
beginning, duration and completion of each
process.

You just have to analyze the list of processes you have got (if necessary, you can carry out
further analysis of the problem process having enabled the filter by the name of the
executable file), match processes and services, apps or drivers, and optimize your system.

As a rule, this type of analysis helps to detect slow processes, infected programs (first of all,
you should analyze the children processes of [Link]), make a decision on
uninstallation/update of the problem software or driver, disable some services or change the
type of their start (delayed or manual start), remove some apps from Autostart. Often
antivirus software and other resource-consuming software get into this list.

Common questions

Powered by AI

Familiarity with tools like Process Monitor is crucial for system administrators as it equips them with diagnostic capabilities to effectively identify and resolve system boot issues. By understanding detailed boot activities and potential bottlenecks, administrators can make informed decisions to enhance system performance and reliability .

Process Monitor allows administrators to track detailed service start-up activities, revealing process dependencies and duration times. This diagnostic capability helps determine whether specific services are unnecessary or should be scheduled for delayed start, directly contributing to faster, more efficient system boots while optimizing service performance .

To troubleshoot slow Windows boot times with Process Monitor, start by downloading and unpacking the Process Monitor archive, then run 'procmon.exe' with administrator privileges. Next, enable boot logging in the options menu and select 'Generate thread profiling events -> Every second'. Restart the computer, and after logging in, Process Monitor will prompt you to save the collected boot data to a file. You can then filter the logged processes, analyzing those that take more than 10 seconds to operate, using the 'Duration' filter. For in-depth analysis, use the 'Process Tree' feature to visualize the process structure and make informed decisions about optimizing or removing problematic software or processes .

During the system boot, Process Monitor creates a service in the registry under HKLM\SYSTEM\CurrentControlSet\Services and uses procmon23.sys boot mode driver. This driver starts after Winload.exe and logs activity of all processes until the Process Monitor application is initiated. The logs are temporarily stored in %windir%\procmon.pmb until further analysis .

Process Monitor can identify infected programs affecting boot speed by analyzing child processes of 'Winlogon.exe', as these often reveal anomalies linked to malware. By closely examining these processes, one can ascertain if they are legitimate or require mitigation actions such as uninstalling/updating affected software or drivers .

Filtering process durations over a certain threshold allows focusing on processes that significantly contribute to prolonged boot times, thus pinpointing potential bottlenecks. The default time threshold suggested is 10 seconds, as it effectively highlights processes that may require optimization or removal for more efficient boot performance .

To prevent system drive space issues, users should ensure to discontinue Process Monitor after logging and save relevant data promptly, since the temporary log file %windir%\procmon.pmb can eventually occupy all available free space if not managed properly .

After identifying slow processes, a system administrator should examine the necessity of these processes, considering actions like uninstalling or updating problematic software, adjusting services to a delayed or manual start, and removing redundant startup applications to enhance boot performance .

Antivirus software often appears on lists of resource-consuming applications during boot analysis. Although essential for security, they can contribute to longer boot times due to their extensive scanning and monitoring processes at startup .

The 'Process Tree' feature is particularly useful for visualizing and analyzing dependencies among processes during boot. It provides a graphical representation showing the initiation, duration, and completion of each process, helping in assessing which child or related processes may be causing delays or issues, and allows for more informed decision-making regarding system optimization .

You might also like