Description
An app reports it cannot find its config but never says which path it looked in; an installer dies with nothing but an error code; a program stalls three seconds at every launch waiting for something unnamed. The answers to all of these live in the system calls. Process Monitor pulls that layer open: it records in real time which file each process read, which registry key it queried, and whether the result was SUCCESS or NAME NOT FOUND — and that NOT FOUND line tells you exactly which folder to create or key to add.
It is the workhorse of the Microsoft Sysinternals suite for hard-to-diagnose problems, maintained by Mark Russinovich's team. A single portable executable that starts logging the moment it runs and leaves no driver behind when closed.
Four event classes: file system, registry, process and thread, and network activity captured together, each line carrying time, process name, PID, operation, path and result.
Powerful filtering: combine conditions on process name, path, operation and result to find the handful of relevant lines among hundreds of thousands; right-click any row to add an include or exclude rule instantly.
Call stacks: double-click an event to see the full stack that triggered it, and with a symbol server configured you can trace it back to the exact module.
Boot logging: enable it and the next start records from driver load onward, which is how you diagnose slow boots and problems that only appear during startup.
Process tree: the creation relationships during a capture are drawn as a tree, exposing which process launched what — including the children an installer starts quietly.
Save and analyse offline: captures save to PML files to open on another machine, and export to CSV or XML.
Single portable file: unzip and run, no registry writes, no installed service, deletable afterwards, and driveable from the command line for automated captures.
It is the workhorse of the Microsoft Sysinternals suite for hard-to-diagnose problems, maintained by Mark Russinovich's team. A single portable executable that starts logging the moment it runs and leaves no driver behind when closed.
Features
Four event classes: file system, registry, process and thread, and network activity captured together, each line carrying time, process name, PID, operation, path and result.
Powerful filtering: combine conditions on process name, path, operation and result to find the handful of relevant lines among hundreds of thousands; right-click any row to add an include or exclude rule instantly.
Call stacks: double-click an event to see the full stack that triggered it, and with a symbol server configured you can trace it back to the exact module.
Boot logging: enable it and the next start records from driver load onward, which is how you diagnose slow boots and problems that only appear during startup.
Process tree: the creation relationships during a capture are drawn as a tree, exposing which process launched what — including the children an installer starts quietly.
Save and analyse offline: captures save to PML files to open on another machine, and export to CSV or XML.
Single portable file: unzip and run, no registry writes, no installed service, deletable afterwards, and driveable from the command line for automated captures.
