Hacker News Reader

Comment by aargh_aargh | Hacker News Reader

I haven't used much Windows recently, but I remember this GUI tool, which offers much needed filtering capabilities.

https://technet.microsoft.com/en-us/sysinternals/processmoni...

Yeah, but it's limited because process monitor stores its output in memory (from what I can see) even though if you use a backing file other than the swap file.

I use this tool all the time!

I really wish there was a command line version that is divorced from the GUI that you can pipe to another process or file. This might be as close as any I've found so far!

Me too - I usually start my diagnostics session with Procmon. Not so long ago, Mark Russinovich revealed that they are working on a command line version of Procmon for Nano server (https://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-16...). I hope they will release it soon :)

I use procmon heavily too. Good point about the mem usage. I find procmon especially helpful for diagnosing COM activation issues; being able to trace all the registry and file system accesses is invaluable in figuring why a specific DLL is or isn't loaded.

COM activation has eaten a week of mine. Any idea why procmon wouldn't load on a Server 2008 box as Admin? Gives me a driver error.

Google says:

* reboot

* check anti-virus

* requires 'Workstation' service

* try a different/older version

* verify other SysInterals utils can load their driver

* extract the 64-bit version and run it directly

http://superuser.com/questions/211759/process-monitor-fails-...

Any further details on the error message?

Unfortunately lowly devs are not allowed access to that particular server, but I'd bet it's the Workstation service. Thanks.

No idea on procmon refusing to load as Admin. But I would caution on using the System account to run services that use COM activation, which does ClassId & ProgId lookups via the HKCU hive. LocalSystem will go to HKCU\.Default [1], which is probably not what you need.

[1] https://social.msdn.microsoft.com/Forums/vstudio/en-US/cef65...

Reply on news.ycombinator.com