Hacker News Reader

Comment by chris_wot | Hacker News Reader

Yeah, but it's limited because process monitor stores its output in memory (from what I can see) even though if you use a backing file other than the swap file.

I use this tool all the time!

I really wish there was a command line version that is divorced from the GUI that you can pipe to another process or file. This might be as close as any I've found so far!

View on HN

I use procmon heavily too. Good point about the mem usage. I find procmon especially helpful for diagnosing COM activation issues; being able to trace all the registry and file system accesses is invaluable in figuring why a specific DLL is or isn't loaded.

COM activation has eaten a week of mine. Any idea why procmon wouldn't load on a Server 2008 box as Admin? Gives me a driver error.

No idea on procmon refusing to load as Admin. But I would caution on using the System account to run services that use COM activation, which does ClassId & ProgId lookups via the HKCU hive. LocalSystem will go to HKCU\.Default [1], which is probably not what you need.

[1] https://social.msdn.microsoft.com/Forums/vstudio/en-US/cef65...

Google says:

* reboot

* check anti-virus

* requires 'Workstation' service

* try a different/older version

* verify other SysInterals utils can load their driver

* extract the 64-bit version and run it directly

http://superuser.com/questions/211759/process-monitor-fails-...

Any further details on the error message?

Unfortunately lowly devs are not allowed access to that particular server, but I'd bet it's the Workstation service. Thanks.

Me too - I usually start my diagnostics session with Procmon. Not so long ago, Mark Russinovich revealed that they are working on a command line version of Procmon for Nano server (https://channel9.msdn.com/Shows/Defrag-Tools/Defrag-Tools-16...). I hope they will release it soon :)

Reply on news.ycombinator.com