New Update Process Monitor - Sysinternals

[silversurfer]

Introduction​

Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity. It combines the features of two legacy Sysinternals utilities, Filemon and Regmon, and adds an extensive list of enhancements including rich and non-destructive filtering, comprehensive event properties such as session IDs and user names, reliable process information, full thread stacks with integrated symbol support for each operation, simultaneous logging to a file, and much more. Its uniquely powerful features will make Process Monitor a core utility in your system troubleshooting and malware hunting toolkit.

Overview of Process Monitor Capabilities​

Process Monitor includes powerful monitoring and filtering capabilities, including:

• More data captured for operation input and output parameters
• Non-destructive filters allow you to set filters without losing data
• Capture of thread stacks for each operation make it possible in many cases to identify the root cause of an operation
• Reliable capture of process details, including image path, command line, user and session ID
• Configurable and moveable columns for any event property
• Filters can be set for any data field, including fields not configured as columns
• Advanced logging architecture scales to tens of millions of captured events and gigabytes of log data
• Process tree tool shows relationship of all processes referenced in a trace
• Native log format preserves all data for loading in a different Process Monitor instance
• Process tooltip for easy viewing of process image information
• Detail tooltip allows convenient access to formatted data that doesn't fit in the column
• Cancellable search
• Boot time logging of all operations

Process Monitor - Sysinternals

Monitor file system, Registry, process, thread and DLL activity in real-time.

learn.microsoft.com

---

Process Monitor v3.93​

Published: March 9, 2023

Download: https://download.sysinternals.com/files/ProcessMonitor.zip

 

[silversurfer]

Process Monitor v3.94​

Published Jun 07 2023

• This update to Process Monitor, a utility for observing real-time file system, Registry, and process or thread activity, improves handling of incomplete Procmon Log files (.pml), and restores "Copy All" functionality in the Event Properties window.

Process Monitor v3.94 | Microsoft Community Hub

Learn about the latest updates to Process Monitor v3.94

techcommunity.microsoft.com

 

[silversurfer]

Process Monitor v3.95​

Published: June 27, 2023

• This update to Process Monitor fixes a crash on loading certain PML files and improves boot logging.

Process Monitor - Sysinternals

Monitor file system, Registry, process, thread and DLL activity in real-time.

learn.microsoft.com

 

[silversurfer]

Process Monitor v3.96​

Published: September 29, 2023

• This update to Process Monitor speeds up the clear events operation, adds a security fix, and several bug fixes.

ProcDump 2.2 for Linux, Sysmon 1.3 for Linux, Process Monitor v3.96, and SDelete v2.05

Learn about the latest updates to ProcDump 2.2 for Linux, Sysmon 1.3 for Linux, Process Monitor v3.96, and SDelete v2.05

techcommunity.microsoft.com

Process Monitor - Sysinternals

Monitor file system, Registry, process, thread and DLL activity in real-time.

learn.microsoft.com

 

[silversurfer]

Process Monitor v4.0​

Published: June 17, 2024

This update to Process Monitor introduces a new event column for the process start timestamp. The new column, Process Start, can be used to filter processes by their start times - for example to hide all processes that were running when this Process Monitor session started, or to only show those processes. In the Process Monitor Filter dialog, this column will have the timestamp of the current time as a pre-filled value in the drop-down. Copying and pasting a value from any of the timestamp columns in the main event list also works.

The user interface improvements in this version include a more native look to the dark theme, new interface icons, more consistent behaviors for the summary dialogs accessible through the Tools menu, better mouse and keyboard navigation, and template values autofilled to some of the filter columns. The summary dialogs now have the "Edit Filter" option, and the main event list supports a per-column "Count Occurrences" action.

We have fixed two Boot Logging bugs: one that incorrectly stopped the log after 428 seconds with profiling events enabled and one that incompletely initialized module symbol information with the /ConvertBootLog command line option.

Copying items to the clipboard from the main event list is faster and also displays the interruptible progress dialog visible with other time consuming operations throughout Procmon.

There are also a series of UI element alignment fixes, we updated the online search from the event properties dialog, the dialogs' geometry, we enabled runtime checks, and made a series of security improvements.

Process Monitor v4.0 and Sysmon 1.3.3 for Linux | Microsoft Community Hub

Learn about the latest updates to Process Monitor v4.0 and Sysmon 1.3.3 for Linux

techcommunity.microsoft.com

Download Process Monitor

 

[silversurfer]

Process Monitor v4.01​

Published: Jun 20 2024

• This update to Process Monitor colorizes the activity operation icons - Registry, File System, Network, Process and Thread, and Profiling Events.

Process Monitor v4.01

Learn about the latest update to Process Monitor v4.01

techcommunity.microsoft.com

Download Process Monitor