4 ms·

I haven't used much Windows recently, but I remember this GUI tool, which offers much needed filtering capabilities. https://technet.microsoft.com/en-us/sysint

I haven't used much Windows recently, but I remember this GUI tool, which offers much needed filtering capabilities. https://technet.microsoft.com/en-us/sysinternals/processmonitor.aspx https://technet.microsoft.com/en-us/sysinternals/processmoni...

chris_wot 10y ago
Yeah, but it's limited because process monitor stores its output in memory (from what I can see) even though if you use a backing file other than the swap file. I use this tool all the time! I really wish there was a command line version that is divorced from the GUI that you can pipe to another process or file. This might be as close as any I've found so far!
- lowleveldesign 10y ago
  Me too - I usually start my diagnostics session with Procmon. Not so long ago, Mark Russinovich revealed that they are working on a command line version of Procmon for Nano server (https://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-164-Sysinternals-Nano https://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-16...). I hope they will release it soon :)
- osullivj 10y ago
  I use procmon heavily too. Good point about the mem usage. I find procmon especially helpful for diagnosing COM activation issues; being able to trace all the registry and file system accesses is invaluable in figuring why a specific DLL is or isn't loaded.
  - voltagex_ 10y ago
    COM activation has eaten a week of mine. Any idea why procmon wouldn't load on a Server 2008 box as Admin? Gives me a driver error.
    - j_s 10y ago
      Google says: * reboot * check anti-virus * requires 'Workstation' service * try a different/older version * verify other SysInterals utils can load their driver * extract the 64-bit version and run it directly http://superuser.com/questions/211759/process-monitor-fails-to-load http://superuser.com/questions/211759/process-monitor-fails-... Any further details on the error message?
      - voltagex_ 10y ago
        Unfortunately lowly devs are not allowed access to that particular server, but I'd bet it's the Workstation service. Thanks.
    - osullivj 10y ago
      No idea on procmon refusing to load as Admin. But I would caution on using the System account to run services that use COM activation, which does ClassId & ProgId lookups via the HKCU hive. LocalSystem will go to HKCU\.Default [1], which is probably not what you need. [1] https://social.msdn.microsoft.com/Forums/vstudio/en-US/cef6584d-d05e-4510-a7c2-7ab529c303f9/setting-user-registry-keys-hkcu-from-a-local-system-account-service?forum=vcgeneral https://social.msdn.microsoft.com/Forums/vstudio/en-US/cef65...

chris_wot 10y ago

Yeah, but it's limited because process monitor stores its output in memory (from what I can see) even though if you use a backing file other than the swap file. I use this tool all the time! I really wish there was a command line version that is divorced from the GUI that you can pipe to another process or file. This might be as close as any I've found so far!

lowleveldesign 10y ago
Me too - I usually start my diagnostics session with Procmon. Not so long ago, Mark Russinovich revealed that they are working on a command line version of Procmon for Nano server (https://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-164-Sysinternals-Nano https://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-16...). I hope they will release it soon :)
osullivj 10y ago
I use procmon heavily too. Good point about the mem usage. I find procmon especially helpful for diagnosing COM activation issues; being able to trace all the registry and file system accesses is invaluable in figuring why a specific DLL is or isn't loaded.
- voltagex_ 10y ago
  COM activation has eaten a week of mine. Any idea why procmon wouldn't load on a Server 2008 box as Admin? Gives me a driver error.
  - j_s 10y ago
    Google says: * reboot * check anti-virus * requires 'Workstation' service * try a different/older version * verify other SysInterals utils can load their driver * extract the 64-bit version and run it directly http://superuser.com/questions/211759/process-monitor-fails-to-load http://superuser.com/questions/211759/process-monitor-fails-... Any further details on the error message?
    - voltagex_ 10y ago
      Unfortunately lowly devs are not allowed access to that particular server, but I'd bet it's the Workstation service. Thanks.
  - osullivj 10y ago
    No idea on procmon refusing to load as Admin. But I would caution on using the System account to run services that use COM activation, which does ClassId & ProgId lookups via the HKCU hive. LocalSystem will go to HKCU\.Default [1], which is probably not what you need. [1] https://social.msdn.microsoft.com/Forums/vstudio/en-US/cef6584d-d05e-4510-a7c2-7ab529c303f9/setting-user-registry-keys-hkcu-from-a-local-system-account-service?forum=vcgeneral https://social.msdn.microsoft.com/Forums/vstudio/en-US/cef65...