The blog..

Tim Mangan wrote an article on Brianmadden.com about the new tool and I decided to have a look.

Microsoft has released a new tool called ProcessMonitor and in basics it is the combination of Filemon, Regmon and Process Explorer this tool comes from Microsoft buying Sysinternals and Wininternals last year. As most of you know Microsoft has continued to release the Sysinternal tools freely to us all and now they have taken it one step further actually collecting a few of our favorite tools in one. The tool can be downloaded from here: http://www.microsoft.com/technet/sysinternals/utilities/processmonitor.mspx

As I wrote the three great tools have been collected into one interface and the layout has been changed slightly but nothing that will make it hard for prior users to adopt this new tool. Basic functionality is the same as before however there has been added support for showing or hiding the collected data from registry, file access or process monitoring.

(The hiding or showing of captured data is done in the top bar by toggling the famous icons.)

Some of the very cool new features are:
File, Registry, process and stack summary giving an easy to view look at what has been accessed, run or read during a trace.

Process tree has been added to the same tool as we knew it pretty much from process Explorer.

And there has been added support for boottime logging, something I am very happy to see integrated.

NOTE: This feature combined with advanced output can easily absorb 20-30GB of diskspace, so be sure not to enable this unless you are specifically looking for something and after the boot procedure has finished be sure to open Process Monitor and save the data to a file.

And as everything else it is easily configured through the tools menus.

But the key to this new tool seems to be ‘The tools we love in a new wrapping’. No more launching filemon and regmon trying to piece together from timestamps what happens when, now we have a tool to show all the information in one tool, and it is even possible to launch the tool minimized from a commandline.

For me this tool is definitely going to replace file- and regmon from the list of tools of the trade.

Microsoft has changed the license slightly according to Tim Mangan mainly to limit distribution of the tools to Microsofts site.

I will update this post as I learn more about the tool from my work with it, until now it seems like a nice way of collecting the tools we all use with an even better chance of piecing the information together.

/René Vester