Process Monitor shows every file, registry and network operation a program performs, but only if the filter is set before you reproduce the bug. Filter by process, narrow to a path, read the stack and export the trace.
Stop capture, clear the buffer, then include only your process with **Filter > Process Name is**. Reproduce once, read **Event Properties > Stack**, and save the trace as **PML** so the evidence survives a reboot.
Procmon records tens of thousands of events per second from the moment it starts, so the interesting minute is buried by the time you find the bug. Pause with **Ctrl+E** and clear with **Ctrl+X** before anything else.
procmon64.exe /AcceptEula
# Ctrl+E stops capture, Ctrl+X clears the buffer
# Ctrl+L opens the filter dialog
Get-ChildItem C:\Tools\Procmon\ | Select-Object Name,LengthA filter with a single **Include** row is easier to debug than five excludes. Set **Process Name is** to the executable, add it, and apply before you start the app.
# Filter > Filter... > Process Name / is / heavyapp.exe / Include > Add > Apply
# the entry shows in the filter list at the top of the window
Get-Process -Name heavyapp | Select-Object Id,StartTime,PathA second filter on **Path begins with** turns a noisy trace into a readable one. Point it at the folder the app writes to, or at the registry hive you suspect.
:: second row: Path / begins with / D:\work\ - Include
:: for registry: Path / begins with / HKLM\SOFTWARE\Vendor\
:: start capture with Ctrl+E and launch the action you want to traceDouble-click an event to see the **Detail** column and the **Stack** tab. The stack names the module that made the call, which is how a mystery write is traced back to a DLL rather than the executable.
# Event Properties > Detail: result, desired access, options
# Event Properties > Stack: module names from the deepest frame up
Select-String -Path C:\trace.pml -Pattern 'heavyapp' -SimpleMatch -ErrorAction SilentlyContinue**/BackingFile** writes events straight to disk, and **/Terminate** stops the capture and saves the log. That pair is what makes a trace repeatable instead of a manual click sequence.
procmon64.exe /AcceptEula /Quiet /Minimized /BackingFile C:\trace.pml
Start-Sleep -Seconds 60
procmon64.exe /Terminate
Get-Item C:\trace.pml | Select-Object Name,Length,LastWriteTime**PML** keeps every column and the stacks; **CSV** is what other people can open. Save as CSV from a filtered view so the file stays small enough to mail.
# File > Save As > CSV, choose All events or the filtered set
Get-Content C:\trace.csv -TotalCount 5
(Get-Content C:\trace.csv | Measure-Object -Line).LinesThe filter excluded the process by name. Check the process name in Task Manager, it is often different from the executable on disk, and re-add the include row.
An antivirus or a driver blocks the helper driver Procmon loads. Ask for an exception for procmon64.exe and its .sys file, or capture from a machine with the same configuration.
A system-wide capture with no path filter fills a gigabyte quickly. Add the path filter before starting capture, and set Options > History Depth to a smaller buffer.
Enable Options > Enable Boot Logging before rebooting, then load the resulting log file when Procmon starts again. Without that switch nothing is recorded before the shell loads.
No. Process Explorer shows what is running and its handles; Procmon records every operation over time. Use Explorer for a snapshot, Procmon for the sequence that leads to a failure.
For access-denied, missing-file and wrong-path problems yes. It shows what the program asked the operating system for, not why the code decided to ask.
It contains file names, registry paths and often command lines. Treat a PML like a log file and strip anything sensitive before sharing it.
Close Procmon with File > Exit and delete the .pml and .csv files you created. Nothing is changed on the system; the capture is read-only observation.
Free · no account needed · tracks your progress