Understanding Process Monitor

Written by Barry Dysert (last updated February 13, 2017)

The folks at Sysinternals produce some high-quality and very useful Windows tools. Another tip talks about their Process Explorer, so I thought I'd introduce you to their Process Monitor tool. Process Monitor is great for monitoring all the activity that goes on for all the processes on your system. In fact, its default configuration makes it too good because you are quickly overwhelmed by how much data gets presented to you. Don't worry, though—you'll learn how to filter the data so that you can hone in on exactly what you want to monitor without being overwhelmed with data you don't care about.

With Process Monitor, you can capture process details, including image path, command line, user and session ID; configure the GUI to have it present whatever columns are of interest; set include/exclude filters for any data field—even those whose columns are not displayed; and much more. Personally, I use it the most when I want to track activity on a particular file or track exactly what a certain process is doing.

The best way to understand Process Monitor is to actually use it, so the first thing to do is to download it from their site:


Process Monitor is a simple .exe file that can be run either from the command line or from Windows Explorer. The first time you launch it, you're presented with an agreement that you should click to agree with. From then on, you'll be able to run it without seeing that initial screen.

The screen for Process Monitor is displayed below. (See Figure 1.)

Figure 1. Process Monitor main screen.

By default, as soon as it comes up Process Monitor starts scrolling thousands of lines of data about the activities going on with most of the processes on your system. The columns that are displayed are configurable. On my system I have it configured to display the Time of Day, Process Name, PID, Operation, Path, Result, and Detail columns related to the activities being monitored. You can change what columns are displayed by right-clicking one of the column headings to display the Process Monitor Column Selection dialog box. (See Figure 2.)

Figure 2. Selecting columns.

You can even change the order the columns are displayed by clicking and dragging a column heading to wherever you want it, and then releasing the mouse button.

Process Monitor has ToolTips for the icons you see at the top of its main screen. As you hover the mouse over each of the icons you'll see a short description of what the icon does. For example, the tip provided for the first icon on the left says "Open" (you can save the output of Process Monitor and open it later for analysis). The next icon is the "Save" function, and so on. There aren't that many icons, and visually it's pretty obvious what they do, but I've found a few of them to be particularly useful. In this tip I'll just mention the ones I use the most, and in the tip titled Using Process Monitor I'll go into a bit more depth on how to use them.

A good tool to use is the third from the left: the Capture tool. This freezes the screen and allows you to analyze the snapshot in a variety of ways. The next icon to the right toggles AutoScroll. With this, you can turn off live scrolling yet still have Process Monitor continue to monitor what's going on. When you turn AutoScroll back on it will immediately catch up to the current time.

The fifth icon from the left lets you Clear the display. You would typically use this feature in conjunction with setting filters so that you can start with an empty display and then watch for the activity that you've indicated in your filters.

Speaking of filters, the ability to filter the output is probably the heart of Process Monitor—filtered data becomes very useful information as you are investigating a particular process's behavior. The Filter icon is sixth from the left and looks like an upside-down pyramid.

You exit Process Monitor simply by clicking the Close button or by selecting File | Exit from the menu.

 This tip (13119) applies to Windows 7, 8, and 10.

Author Bio

Barry Dysert

Barry has been a computer professional for over 35 years, working in different positions such as technical team leader, project manager, and software developer. He is currently a software engineer with an emphasis on developing custom applications under Microsoft Windows. When not working with Windows or writing Tips, Barry is an amateur writer. His first non-fiction book is titled "A Chronological Commentary of Revelation." ...


Using the Sort Command

Sorting data is a common task even of end users. Fortunately, The Windows command line provides us with a Sort utility so ...

Discover More

Minimizing All Open Windows in One Step

There may be times when you need to minimize all of your open windows in one quick step. Windows provides a few methods ...

Discover More

Understanding IP Addresses

IP addresses are at the heart of computer networking. They are typically handled automatically, but you may find it ...

Discover More
More WindowsTips

Monitoring Data Usage

With Windows 10 you can easily see how your data is being used. Even if you are not on a metered data plan, it can be ...

Discover More


Launchy is a small utility that packs a powerful punch. It allows you to instantly find files and launch them without ...

Discover More

Using Microsoft Fix It

Got a program on your system that you can't get rid of? Here's a handy little program that Microsoft provides that may be ...

Discover More

If you would like to add an image to your comment (not an avatar, but an image to help in making the point of your comment), include the characters [{fig}] (all 7 characters, in the sequence shown) in your comment text. You’ll be prompted to upload your image when you submit the comment. Maximum image size is 6Mpixels. Images larger than 600px wide or 1000px tall will be reduced. Up to three images may be included in a comment. All images are subject to review. Commenting privileges may be curtailed if inappropriate images are posted.

What is 5 - 0?

There are currently no comments for this tip. (Be the first to leave your comment—just use the simple form above!)

Newest Tips