Anyone who’s done any decent amount of Windows administration or consulting will be familiar with the name Mark Russinovich and his old company, Sysinternals. A while back, they were bought out by Microsoft and Mark became one of Microsoft’s "fellows", a big brain repsonsible for coming up with new ideas and research.
The Sysinternals site has now been migrated into Microsoft. To coincide with this, a new tool called Process Monitor has been released. How does one describe this new tool … it’s a completely new tool that is like Filemon and Regmon togehter and on steroids. Yeap … that does it. This utility is a very useful addition to your toolkit and you’ll find it very useful to track what a program is doing, what it’s touching or even to find out what is touching a file or registry value.
Here’s the blurb from the MS site:
Process Monitor’s user interface and options are similar to those of Filemon and Regmon, but it was written from the ground up and includes numerous significant enhancements, such as:
- Monitoring of process and thread startup and exit, including exit status codes
- Monitoring of image (DLL and kernel-mode device driver) loads
- More data captured for operation input and output parameters
- Non-destructive filters allow you to set filters without losing data
- Capture of thread stacks for each operation make it possible in many cases to identify the root cause of an operation
- Reliable capture of process details, including image path, command line, user and session ID
- Configurable and moveable columns for any event property
- Filters can be set for any data field, including fields not configured as columns
- Advanced logging architecture scales to tens of millions of captured events and gigabytes of log data
- Process tree tool shows relationship of all processes referenced in a trace
- Native log format preserves all data for loading in a different Process Monitor instance
- Process tooltip for easy viewing of process image information
- Detail tooltip allows convenient access to formatted data that doesn’t fit in the column
The best way to become familiar with Process Monitor’s features is to read through the help file and then visit each of its menu items and options on a live system.
The "installation" process will be familiar to anyone familiar with Sysinternals tools. All you have to do is download the tool and run it.