Scribd
Upload
208 views13 pages

Process Monitor User Guide

Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, registry, process, thread, and network activity. It combines features from Filemon and Regmon and adds new capabilities like filtering, event properties, reliable process information, thread stacks, logging, and profiling. Process Monitor runs on Windows 2000 and newer, and allows monitoring file system, registry, process, network, and profiling events to troubleshoot systems and hunt malware.

Uploaded by

BigDom
Copyright
© Attribution Non-Commercial (BY-NC)
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
208 views13 pages

Process Monitor User Guide

Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, registry, process, thread, and network activity. It combines features from Filemon and Regmon and adds new capabilities like filtering, event properties, reliable process information, thread stacks, logging, and profiling. Process Monitor runs on Windows 2000 and newer, and allows monitoring file system, registry, process, network, and profiling events to troubleshoot systems and hunt malware.

Uploaded by

BigDom
Copyright
© Attribution Non-Commercial (BY-NC)
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

UsingProcessMonitor

ProcessMonitorTutorial Thisinformationwasadaptedfromthehelpfilefortheprogram. ProcessMonitorisanadvancedmonitoringtoolforWindowsthatshowsrealtimefilesystem, Registryandprocess/[Link] utilities,FilemonandRegmon,andaddsanextensivelistofenhancementsincludingrichand nondestructivefiltering,comprehensiveeventpropertiessuchsessionIDsandusernames, reliableprocessinformation,fullthreadstackswithintegratedsymbolsupportforeach operation,simultaneousloggingtoafile,[Link] makeProcessMonitoracoreutilityinyoursystemtroubleshootingandmalwarehunting toolkit. ProcessMonitorrunsonWindows2000SP4withUpdateRollup1,WindowsXPSP2,Windows Server2003SP1,andWindowsVistaaswellasx64versionsofWindowsXP,WindowsServer 2003andWindowsVista. UsingProcessMonitor

[Link] ProcessMonitoritimmediatelystartsmonitoringthreeclassesofoperation:filesystem, Registryandprocess. FileSystem ProcessMonitordisplaysfilesystemactivityforallWindowsfilesystems,includinglocal [Link] [Link] [Link],ifuserAhas

mountedashareasdriveletterZ:,anyaccessestheymaketothatsharewilldisplayin ProcessMonitorasbeingrelativetodriveZ:. Toremovefilesystemoperationsfromthedisplaydeselectthefilesystempushbutton intheProcessMonitortoolbarandtoaddbackfilesystemoperationsdepressthe button. Registry ProcessMonitorlogsallRegistryoperationsanddisplaysRegistrypathsusing conventionalabbreviationsforRegistryrootkeys(e.g.HKEY_LOCAL_MACHINEis representedasHKLM). ToremoveRegistryoperationsfromthedisplaydeselecttheRegistrypushbuttonin theProcessMonitortoolbarandtoaddbackRegistryoperationsdepressthebutton. Process Initsprocess/threadmonitoringsubsystemProcessMonitortracksallprocessand threadcreationandexitoperationsaswellasDLLanddevicedriverloadoperations. ToremoveProcessoperationsfromthedisplaydeselecttheprocesspushbuttoninthe ProcessMonitortoolbarandtoaddbackprocessoperationsdepressthebutton. Network ProcessMonitorusesEventTracingforWindows(ETW)totraceandrecordTCPand [Link],as wellastheamountofdatasentorreceived,butdoesnotincludetheactualdata. ToremoveNetworkoperationsfromthedisplaydeselectthenetworkpushbuttonin theProcessMonitortoolbarandtoaddbacknetworkoperationsdepressthebutton. Profiling [Link],ProcessMonitor scansalltheactivethreadsinthesystemandgeneratesaprofilingevenforeachone thatrecordsthekernelanduserCPUtimeconsumed,aswellasthenumberofcontext switchesexecuted,[Link]:theSystem processisnotincludedinprofiling.

ThereareanumberofbasicoptionsthatcontrolbasicProcessMonitoroperation: Capture:UsetheCaptureEventsmenuitemintheFilemenu,capturetoolbarbuttonorCtrl+E hotkeytotoggleProcessMonitor'smonitoring.

Autoscroll:SelectAutoscrollentryintheEditmenu,theautoscrolltoolbarbuttonorCtrl+A hotkeytotoggleProcessMonitor'sautoscrollbehavior,whichcausesittoensurethatthemost recentoperationisvisibleinthedisplay. Clear:ToclearthedisplayofallitemschooseClearDisplayfromtheEditmenuorusetheCtrl+X hotkey. ColumnSelection Youcandragcolumnstorearrangetheirorderandcustomizedthecolumnsdisplayedby [Link] thatareavailableforselectioninclude: ApplicationDetails

ProcessNameThenameoftheprocessinwhichaneventoccurred. ImagePathThefullpathoftheimagerunninginaprocess. CommandLineThecommandlineusedtolaunchaprocess. CompanyNameThetextofthecompanynameversionstringembeddedinaprocess [Link]. DescriptionThetextoftheproductdescriptionstringembeddedinaprocessimagefile. Thistextisoptionallydefinedbytheapplicationdeveloper. [Link] isoptionallyspecifiedbytheapplicationdeveloper.

EventDetails

SequenceNumberTheuniquenumberProcessMonitorassignstoanindividualevent. EventClassTheclass(File,Registry,Process)oftheevent. OperationThespecificeventoperation([Link],RegQueryValue,etc.). Date&TimeBoththedateandthetimeofanoperation. TimeofDayOnlythetimeofanoperation. PathThepathoftheresourcethataneventreferences. DetailAdditionalinformationspecifictoanevent. ResultThestatuscodeofacompletedoperation. RelativeTimeThetimeoftheoperationrelativetoProcessMonitor'sstarttimeorthe lasttimethattheProcessMonitordisplaywascleared. DurationThedurationofanoperationthathascompleted.

ProcessManagement

UserNameThenameoftheuseraccountinwhichtheprocessthatperformedan operationisexecuting.

SessionIDTheWindowssessioninwhichtheprocessthatexecutedanoperationis executing. AuthenticationIDThelogonsessioninwhichtheprocessthatexecutedanoperationis executing. ProcessIDTheProcessID(PID)oftheprocessthatexecutedanoperation. ThreadIDTheThreadID(TID)ofthethreadthatexecutedanoperation. IntegrityLevelTheintegritylevelatwhichtheprocessthatexecutedanoperationis running(WindowsVistaonly). VirtualizedThevirtualizationstatusoftheprocessthatexecutedanoperation(Windows Vistaonly).

EventProperties Youcanaccessthepropertiesforanindividualeventbydoubleclickingontheevent,orby selectingthePropertiesmenuitemfromtheEventmenuorthecontextmenuwhenyouright [Link],ProcessandStackpages. Youcanmovetothenextorprecedingdisplayedorhighlightedeventwiththearrowbuttonsat thebottomoftheEventPropertiesdialog.

Event TheEventpagedisplaysinformationspecifictoanevent,includingitssequencenumber,issuing thread,eventclassandoperation,result,timestamp,andifapplicable,[Link] [Link] [Link] shownforaneventintheDetailcolumnofthemaindisplay,buteachdetailisshownona separateline. Process Anevent'[Link] withthedataassociatedwithaprocess'image,suchasthepathandversionstrings,the ProcesspageshowsprocessexecutionattributesliketheprocessID,useraccountinwhichthe processisexecuting,andiftheeventwasgeneratedona64bitWindowssystem,whetherthe [Link],ProcessMonitor showstheintegrityleveloftheprocessandwhetherornotit'svirtualized. Thebottomareaoftheprocesspagedisplaysthelistofimagesloaded,andtheaddressesat whichtheyareloaded,[Link] inthelisttoviewmoreinformationabouttheimage,includingitsversioninformation. Stack [Link] canbeusefulfordeterminingthereasonaneventtookplaceandthecomponentresponsible [Link]'K'ontheleftofthe frameandusermodestacks(onlyavailableonlyon32bitsystemspriortoVistaSP1/Windows Server2008)withtheletter'U'.IfProcessMonitorisabletolocatesymbolsforimages referencedinthetraceitwillattempttoresolveaddressestothefunctionsinwhichthey [Link],for [Link],whichyou accessfromtheOptionsmenu,toconfiguresymbols. IfyouspecifyapathtosourcefilesintheSymbolConfigurationdialog,theStackdialog'sSource buttonwillenableforanyframeforwhichlinenumbersymbolsinformationisavailableand [Link] viewerthathighlightsthesourcecodelinereferenced. Toviewmoreinformationaboutanimagelistedinthestacktraceeitherdoubleclickonthe frameorselecttheframeandpressthePropertiesbuttonbelowthestacktracearea. SelecttheStackmenuentryfromtheEventmenutoopentheEventPropertiesdialogdirectly totheStackpage.

FilteringandHighlighting ProcessMonitoroffersseveralwaystoconfigurefiltersorhighlighting. IncludeandExcludeFilters YoucanspecifyeventattributessuchthatProcessMonitorwillonlydisplayorexcludeevents [Link],meaningthattheyaffectonly whicheventsProcessMonitordisplays,nottheunderlyingeventdata. WhenaneventisselectedtheIncludeandExcludesubmenusintheEventmenuallowsyouto easilyaddoneoftheevent'[Link] example,toonlyshoweventsexecutedbyaparticularprocessnamechoosetheProcessName [Link] configureanattributefilterforalloftheuniquevaluescontainedintheselectedevents. ProcessMonitorORstogetherallthefiltersthatarerelatedtoaparticularattributetypeand [Link],ifyouspecifiedprocessname [Link]:\Windows,Process [Link] theC:\Windowsdirectory. MorecomplexfilteringoptionsareavailableintheFilterdialog,whichyouopenbyselecting [Link] anattributefield([Link],ProcessName,etc.),acomparisonoperation,an attributevalue,[Link],ProcessMonitor willautomaticallypopulatetheattributevaluedropdownwithvaluesthatarepresentinthe loadedtracedata,butyoucanenterarbitraryvalues. FilterContextMenu IfyourightclickonaniteminthedisplayProcessMonitordisplaysacontextmenuthatlet's youviewtheitem'spropertiesorconfigureafilterbasedontheitem'[Link], quickfilterentriesareaddedtothemenuforthevalueofthecolumnonwhichyouclick. DestructiveFiltering Bydefault,ProcessMonitorfiltersapplytothedataitdisplays,[Link] youtochangefilterstoobtaindifferentviewsofdatawithoutaffectingtheexcludeddata. However,youcanconfigureProcessMonitortodeleteanydatathat'sexcludedbyafilteratthe timethedataiscapturedbytogglingdestructivefilteringmode,whichyoudobychoosingDrop FilteredEventsfromtheFiltermenu.

IncludeProcessfromWindow Thetoolbarincludesabuttonshapedlikeatargetthatyoucandragoffanddropontoa windowtocauseProcessMonitortoaddtheprocessIDoftheprocessthatownsthewindow totheIncludefilter. [Link] TheFiltermenu'sEnableAdvancedOutputmenuitemcontrolswhetherProcessMonitoris [Link] filterstoexcludesystemrelatedactivityfromthedisplayandusesintuitivenamesforinternal [Link],ProcessMonitorshowstheinternalIRP_MJ_READ [Link] eventsusuallynotrelevantforapplicationtroubleshooting. SavingandLoadingFilters OnceyouhaveconfiguredafilteryoucansaveitusingtheSaveFiltersmenuitemintheTools [Link] canchangetheorderinwhichthefiltersdisplayinthemenuusingtheOrganizeFiltersdialog [Link] renamesavedfiltersaswellastoeasilyexportfilterstoaformatthatyoucanthenreimport usingtheOrganizeFilterdialogonothersystems. Highlighting ProcessMonitorshighlightingfiltersenableyoutospecifyeventattributesthatcauseanevent [Link] accessfordefininghighlightfilterentriesandtheHighlightmenuentryintheToolsmenuopens theHighlightFilterdialog,whichoperatessimilarlytotheInclude/ExcludeFilterdialog. TheProcessTree TheProcessTreemenuentryintheToolsmenuopenstheProcessTreedialog,whichdisplays alloftheprocessesreferencedintheloadedtraceinahierarchythatreflectstheirparentchild [Link]. Processesthatarealignedalongtheleftsideofthewindowhaveparentprocessesthatdidnot executeanyeventinthetrace. WhenyouselectaprocessinthetreeasubsetofthedataProcessMonitorhasobtainedabout theprocess,suchasitsimagepath,useraccount,andstarttime,showsinthebottomofthe [Link], whichresultsinProcessMonitorlocatingandselectingthefirstvisibleiteminthetrace

[Link] excludingfromthedisplayallofthespecifiedprocess'events. TraceSummaryTools ProcessMonitorincludesanumberofdialogsthatallowyoutoperformsimpledataminingon theeventscollectedinatrace. SystemDetails ProcessMonitorcapturessomeinformationaboutthesystemonwhichitcollectsatrace, includingthemachinename,thesystemrootpath,[Link] canaccessthisinformation,whichProcessMonitorstoresinlogfiles,fromtheSystemDetails dialogintheToolsmenu. UniqueValues TheUniqueValuesdialog,whichyouopenusingthecorrespondingmenuentryintheTools menu,letsyouseetheuniquevaluesforeachofthedifferentattributevaluesdefinedfor [Link],ifyouwantquicklyseeallthepathsreferencedinthetrace, choosePathintheselectionentry. DoubleclickingonadisplayedvalueorclickingontheFilterbuttonaddsanincludefilterforthe currentlyselectedvalue. CountOccurrences [Link] tracefortheattributetypeyouspecifyalongwiththenumberoftimesinthetraceanevent containedthevalue. ProcessSummary Thisdialogsummarizestheprocessesseeninthetrace,includingtheirprocessID,imagename, andcommandline. FileSummary TheFileSummarydialoglistseachuniquefilesystempathpresentinthefilteredtrace,the amountoftimespentperformingI/Otothefile,totalnumberofeventsthatreferencedthe path,andthecountofindividualoperationtypes.

RegistrySummary TheRegistrySummarydialoglistseachuniqueRegistrypathpresentinthefilteredtrace,the amountoftimespentperformingI/OtotheRegistrypath,totalnumberofeventsthat referencedthepath,andthecountofindividualoperationtypes. NetworkSummary TheNetworkSummarydialoglistseachuniquedestinationIPaddresspresentinthefiltered traceandthenumberdifferenttypesofevents,includingsendsandreceives,toeachaddress. StackSummary UsetheStackSummarydialogtoseeindividualinstancesofstacktracesforeachprocess, includingthenumberoftimesthestacktraceoccursandthetotaltimespentineventsthat sharethesametrace. Options AnumberofsettingsintheOptionsmenumodifyProcessMonitor'sbehavior. AlwaysonTop SelectingthisoptioncausestheProcessMonitorwindowtoremainontopofotherwindows. Font ThisoptionopensafontselectiondialogwhereyoucanchosethefontProcessMonitoruses foritsdisplay. HighlightColors ChosethisentrytoopenadialogtopickthetextandbackgroundcolorsProcessMonitoruses forentriesthatmatchtheconfiguredhighlightfilters. ConfigureSymbols ProcessMonitorcanusesymbolinformation,ifavailable,toshowfunctionsreferencedon [Link] ToolsforWindowswebpage.

HistoryDepth ProcessMonitorwatchescommittedmemoryusageandturnsitselfoffwhenvirtualmemory runslow,buttheHistoryDepthdialoglet'syoulimitthenumberofentriesitkeepssothatyou canleaveProcessMonitorrunningforlongperiodsandensurethatitalwayskeepsthemost recentevents. ProfilingEvents Usethismenuentrytoopenthethreadprofilingconfigurationdialog,whereyouenablethread [Link] enabled,ProcessMonitorcapturesthreadstacktracesandCPUutilizationthatyoucanuseto identifythesourceofCPUrelatedperformanceissues. EnableBootLogging UsethisoptiontoconfigureProcessMonitorbootlogging. SavingandLogging FileFormats YoucanusetheSaveentryintheFilemenutosaveProcessMonitordatainnative(PML), commadelimitedvalue(CSV),[Link] capturedsothatyoucanreloaditbackintoProcessMonitoronthesamesystemoradifferent [Link],XML emitsXMLformatteddatathatcanbeparsedbytoolsthatmanipulateXML. Logging Bydefault,[Link] dialog,whichyouaccessfromtheFilemenu,toconfigureProcessMonitortostorecaptured [Link] PMLformatasitcapturesit. TheBackingFilesdialogalsodisplaysdiagnosticinformation,includingthenumberofevents captured,processesdefinedandthecapturethread'sloadstatus. BootLogging ProcessMonitorcanlogactivityfromapointveryearlyinthebootprocessduringthe [Link] [Link]'sdriverwilllogactivity

atthenextbootintoafileinthe%Windir%directoryandwillcontinueloggingthroughthe [Link],ifyoudon'trunProcessMonitorduring abootsessionyouwillcaptureatraceoftheentireboottoshutdowncycle. WhenyourunProcessMonitoritlookstoseeifapreviousbootloghasbeengenerated,andif so,[Link] [Link], whichistheonlyprocessearlyinaboot,selectEnableAdvancedOutputfromtheOptions menu. Ifyouconfigurebootloggingandthesystemcrashesearlyinthebootyoucandeactivateboot loggingbychoosingtheLastKnownGoodoptionfromtheWindowsbootmenu(whichyou accessbypressingF8duringtheboot). Note:networkevents,whicharebasedonETW(EventTracingforWindows),arenotavailable inbootlogs. ImportingandExportingConfiguration OnceyouhaveconfiguredafilteryoucansaveitusingtheSaveFiltersmenuitemintheTools [Link] canchangetheorderinwhichthefiltersdisplayinthemenuusingtheOrganizeFiltersdialog [Link] renamesavedfiltersaswellastoeasilyexportfilterstoaformatthatyoucanthenreimport usingtheOrganizeFilterdialogonothersystems. YoucanalsoexportProcessMonitor'sentireconfiguration,includingfilters,columnselection, columnorderandsize,logfilesettings,anddebughelpfilepathconfiguration,toaProcess MonitorConfigurationfile(.PMC)usingtheExportConfigurationmenuentryintheFilemenu. UsetheFilemenu'sImportConfigurationentrytoloadasavedconfigurationfile. CommandLineOptions ProcessMonitorsupportsseveralcommandlineoptions: /Openlog<savedPMLlogfile> DirectsProcessMonitortoopenandloadthespecifiedlogfile. /Backingfile<logfilename> HasProcessMonitorcreateandusethespecifiedfilenameastheloggingfile. /Pagingfile

Saveeventstothepagingfile. /Noconnect WhenthisflagispresentProcessMonitordoesnotautomaticallystartloggingactivity. /Nofilter Clearsthefilteratstartup. /AcceptEula AutomaticallyacceptsthelicenseandbypassestheEULAdialog. /Profiling Enablesthethreadprofilingeventclass. /Minimized StartsProcessMonitorwithitswindowminimizedtothetaskbar. /WaitForIdle WaitforaninstanceofProcessMonitortobecomeready. /Terminate TerminateallinstancesofProcessMonitorandexit. /Quiet Don'tconfirmfiltersettingsonstartup. /Run32 Usesthisswitchtorunthe32bitversionofProcessMonitoron64bitWindowstoopenlogs generatedon32bitsystems /HookRegistry Thisswitch,whichisavailableonlyon32bitVistaandServer2008,hasProcessMonitoruse systemcallhookinginsteadoftheRegistrycallbackmechanismtomonitorRegistryactivity, [Link]

optionmustbeusedthefirsttimethatProcessMonitorisrunonasystemandshouldonlybe usedtotroubleshootSoftGridapplications. /SaveAs,/SaveAs1,/SaveAs2 Usetheseswitcheswiththe/OpenLogswitchtohaveProcessMonitorexportalogfileinto CSV,XML,[Link]/SaveAs1optionincludesstackinformationforexporttoXML formatandthe/SaveAs2optionaddssymbolinformation. ScriptingProcessMonitor [Link] [Link]'sexecution: setPM=C:\sysint\[Link] start%PM%/quiet/minimized/backingfileC:\temp\[Link] %PM%/waitforidle [Link] %PM%/terminate ThefirstinvocationofProcessMonitorusingstartensuresthattheprocessdetachesfromthe consolewindow,[Link] invocationwith/WaitForIdlecausesthebatchfiletopauseuntilthefirstinstanceisupand [Link]/Terminatetellsthefirst instancetostopcapturing,commitanyoutstandingdatatothebackingfileandexitcleanly.

Common questions

Powered by AI

Process Monitor uses Event Tracing for Windows (ETW) to monitor TCP and UDP network activity, capturing source/destination addresses and data transfer amounts. While this provides valuable information about network traffic, the main limitation is that it does not capture the actual data content being transmitted. This restricts its utility to analyzing traffic patterns rather than the data itself, potentially limiting its effectiveness in situations where data payloads are crucial for troubleshooting or security analysis .

Process Monitor's profiling feature scans active threads and records their kernel and user CPU time along with context switches since the previous profiling event. This allows analysts to identify CPU-related performance issues by indicating which threads and processes consume the most CPU resources. Profiling data enables a detailed examination of how system resources are used over time, aiding in the optimization of application performance and system resource management .

Process Monitor tracks all process and thread creation and exit operations, as well as DLL and device driver loads. It records detailed attributes including process ID, thread ID, user and session IDs, and tracks whether the process is running in 32-bit or 64-bit mode on 64-bit systems. For Windows Vista systems, it also tracks the integrity and virtualization status of processes. The tool's ability to provide detailed process/thread information aids in understanding and diagnosing system behaviors and malfunctions .

The basic mode of Process Monitor simplifies its output by using intuitive names for file system operations and excluding system-related activity, making it user-friendly for application troubleshooting. This mode omits less relevant events, reducing noise for users focused on specific application behavior. Advanced mode, however, provides more comprehensive data, displaying all system activities, which is crucial for in-depth technical analysis and diagnosing complex operational issues. The choice between these modes impacts data interpretation by determining the breadth and granularity of available information .

Process Monitor is an advanced monitoring utility for Windows, providing real-time file system, Registry, and process/thread activity monitoring. It combines features from earlier utilities such as Filemon and Regmon with enhancements like rich filtering and comprehensive event properties. It offers reliable process information, full thread stacks, and network monitoring through Event Tracing for Windows (ETW). Additionally, it supports simultaneous logging and profiling of CPU usage, which are essential for troubleshooting system issues and detecting malware activities .

The native PML format in Process Monitor preserves all captured data with full detail, allowing for comprehensive analysis and reloading on any system with Process Monitor installed, which is ideal for in-depth investigation and collaborative troubleshooting. In contrast, CSV is beneficial for importing data into spreadsheet applications like Excel for data manipulation and analysis, albeit with potential data loss in terms of detail. XML offers structured data suitable for integration with systems supporting XML data, aiding in automation and data mining tasks. Each format serves different analytical purposes, balancing granularity against ease of sharing and cross-application compatibility .

Process Monitor facilitates stack analysis by showing the thread stack details for each recorded event. It distinguishes between kernel-mode and user-mode frames, resolving function addresses if symbol information is available. Stack analysis is significant as it aids in identifying the cause of an event and the responsible components. It is particularly useful for debugging and performance diagnostics, helping to pinpoint bottlenecks and faults in program execution .

Enabling boot logging in Process Monitor allows it to capture activity from early in the boot process, including initialization of boot-start drivers, and continues through to shutdown. This comprehensive logging is vital for diagnosing system startup issues because it enables the capture of events that might lead to early boot failures or delays. The complete boot-to-shutdown logs provide insights into system behavior that might not be visible from typical operational logs. However, network events, based on Event Tracing for Windows, are not captured in boot logs, which may limit network-related diagnostics .

Symbol resolution in Process Monitor enhances stack trace analysis by converting raw addresses into human-readable function names, offering detailed insights into execution flow. It assists users in understanding which functions are involved in specific events or errors. Users can configure symbol resolution through Process Monitor's symbol configuration option, which involves setting the path to debugging tools that can resolve symbols, thereby increasing the precision of event analysis .

Process Monitor allows non-destructive filtering, meaning that while filters change the data view, the excluded data is not removed from the log. This feature enables users to apply various filters to decide which data to display for targeted troubleshooting without losing any information. Filters can be saved and organized for reuse, facilitating efficient analysis of recurring issues. Advanced filtering includes highlighting specific events, configuring destructive filters, and using quick-filters for contextual filtering. These filtering capabilities help analysts focus on relevant data, simplifying the identification and understanding of operational anomalies .

Using Process Monitor    Process Monitor Tutorial    This information was adapted from the help file for the program.   Proce
mounted a share as drive letter Z:, any accesses they make to that share will display in  Process Monitor as being relative t
Autoscroll: Select Autoscroll entry in the Edit menu, the autoscroll toolbar button or Ctrl+A  hotkey to toggle Process Monit
• Session ID The Windows session in which the process that executed an operation is  executing.  • Authentication ID The lo
Event  The Event page displays information specific to an event, including its sequence number, issuing  thread, event class 
 Filtering and Highlighting  Process Monitor offers several ways to configure filters or highlighting.   Include and Exclude 
Include Process from Window  The toolbar includes a button shaped like a target that you can drag off and drop onto a  window
executed by the process. Note that filters can prevent this operation from succeeding by  excluding from the display all of t
Registry Summary  The Registry Summary dialog lists each unique Registry path present in the filtered trace, the  amount of t
History Depth  Process Monitor watches committed memory usage and turns itself off when virtual memory  runs low, but the His

You might also like