SysInternals – The New Process Monitor

Just when I thought I was done talking about the SysInternals tools, Microsoft finally integrates them into their TechNet site and makes some changes. I’ve already mentioned a few in my last post, in this one I wanted to take a quick look at the new ProcMon.

Available at, the new Process Monitor (ProcMon) replaces two older tools, FileMon and RegMon. It will keep an eye on all disk activity, whether it be on the drive or the registry. In the example below you can see what’s going on in my system as I write this. For example, I have WinAmp playing a recent DotNetRocks episode.

[Picture of Process Montiors main UI.]

One feature I rather like is the Process Tree, under the Tools menu.

[Process Monitors Process Tree]

Here you can see some of the many programs I have running. All I have to do is click on one of them then click the Go To Event button and it will take me right to the event. Three buttons on the main toolbar make it very easy to filter down to the events you want to see.

[Handy tools in the ProcMon Toolbar.]

The leftmost button turns registry events on or off. The middle button shows or hides file system activity. The right most button toggles the display of process / thread activity. Other filters allow you to narrow down to specific files or events you want to monitor.

I like the new version of this tool, lots of new features that make me prefer this to the older FileMon/RegMon tools, which are still available if you want to do your own comparisons.


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s