This is sometimes that you can use it while you want to capture a process for a certain period and don’t want your logs to get clouded with garbage. If you capture Icon looks like the one below, it means that you have paused the capture.

This means that the ProcMon (Process Monitor) is currently running and is capturing all the information. This is very important for you to have a good understanding of some of the options that are placed here.Ĭapture : If you Capture icon looks like the one below. Once you have the tool in front, you need to look for the row with options like below: One is a tool which is made for a user, however, the other tool is made for experts as there is a lot you can do with this tool which you cannot do with Task Manager. Now you will think that we have a task manager who does the same thing “Show Processes”.īut there is a Big Difference in a way these two tools shows the running processes. Now all this information is nothing but processes and threads that are running on your system. Once you will open it, you are going will be flooded with a lot of information. Once you have downloaded it you can just open the Exe file Now in this article, I will only be covering the very basics of the Process Monitor tool, I will be posting few more articles on this topic just so that we can have a clear understanding of the software and its functioning. To look into these things we use a Sysinternals tool named ProcMon (Process Monitor).

Sometimes when you are troubleshooting an issue on windows, you want to look into things like when the process created, who created the process and what is the stack with which the process is running.

Procmon