Using Process Monitor

Written by Barry Dysert (last updated February 13, 2017)

Process Monitor from Sysinternals is a great diagnostic tool when you want to figure out what is going on with process and/or files. I introduced this tool in the tip titled Understanding Process Monitor. In this tip I'll show you how to actually use some of its features in diagnosis.

In this first scenario, imagine that you have a process running, but it doesn't seem to be doing anything. You'd like to know if it's hung or if it is in fact doing something that you just can't detect at the moment. As with all diagnoses, there may be several approaches you can take, but since this tip is focusing on Process Monitor we'll use its capabilities to see what's going on.

Launch Process Monitor and see if you can observe your process scrolling by under the Process Name column. If you don't see it, try searching for it by clicking the binoculars icon ("Find") and typing the process name (include its extension, e.g. type "MyProgram.exe"). If it is found, Process Monitor stops scrolling and highlights the row where it first finds the process name. If you aren't sure of the .exe name, you can use the "Include Process from Window" icon (eighth from the left). You use this by clicking and dragging the icon to the window where your process is running. Once you have dragged the icon to the window, release the mouse, and Process Monitor will go to the row where that window's process is found. At this point you can filter out everything about that particular process so you can watch it for activity without being distracted by everything else going on.

Filtering is a powerful yet simple concept in Process Monitor. A filter can be set to include entries or to exclude entries. It's important to realize that if there is an "include" filter turned on, then only those entries that match the filter will be displayed. On the other hand, if you have "exclude" filters turned on, then everything except what's in the filter will be displayed. "Include" filters always take precedence over "exclude" filters.

Click the Filter icon (the upside-down pyramid). Notice that Process Monitor has automatically already created an "include" filter for the process it found so you really don't have to do anything but click Cancel on the filter window and watch for activity from your process in the main screen. (See Figure 1.)

Figure 1. Process Monitor Filter window.

In a second scenario, let's say that there is a file on your hard drive that intermittently exhibits odd behavior. For example, its Modified date occasionally changes or sometimes processes crash because of a "file locked by another user" error. You can use Process Monitor to watch the file and see what processes are accessing it.

Launch Process Monitor. Since you set a filter the last time you ran Process Monitor, it remembers this setting and brings up the Filter window automatically. You want to start this session with a clean slate, so click the Reset button to return the filtering criteria to their default settings; then click OK.

Assume the file you want to watch is named "C:\Temp\Indexes.dat". Again, you could watch the information in the main screen for your file to appear in the Path column, but it would probably be easier to click the Filter icon and make an "include" filter so that only activity relative to that file appears.

Click the Filter icon and in the top left dropdown list select "Path"; then type "C:\Temp\Indexes.dat" (without the quotes) into the box just to the right of the dropdown list containing the word "is." (See Figure 2.)

Figure 2. Filtering on a particular file name.

Now click the Add and the OK buttons to return to the main screen. Now you'll be able to see exactly when the file is accessed, and what process is doing it.

In a final scenario, let's say that you notice what seems to be an extraordinary amount of hard disk activity going on. You can use Process Monitor to take a snapshot of this activity for subsequent analysis. Launch Process Monitor and reset the filtering to its default condition as you did in scenario two. Then, when you are at the main screen, click the "Capture" icon (third from the left). This causes a snapshot of the current activity to be taken and the scrolling is stopped.

To now look at the disk activity of this snapshot, click the Tools | File Summary menu item. The File Summary dialog box is displayed, which includes all of the file activity captured by the snapshot. (See Figure 3.)

Figure 3. File Summary by path.

This summary is currently sorted by the Total Events column, but clicking on a column heading sorts the data by that particular field. It is also interesting to click the "By Folder" tab to see the files grouped by their names. (See Figure 4.)

Figure 4. File Summary by folder.

Now you can drill down by clicking the plus signs on the left and seeing what all files are being accessed.

This tip has presented three scenarios that you may come across where Process Monitor can be used in diagnosing issues. You may have noticed along the way that there are many more icons and menu items that have not been addressed. As was said in the beginning, the best way to discover what Process Monitor can do is to experiment with it on your own.

 This tip (13120) applies to Windows 7, 8, and 10.

Author Bio

Barry Dysert

Barry has been a computer professional for over 35 years, working in different positions such as technical team leader, project manager, and software developer. He is currently a software engineer with an emphasis on developing custom applications under Microsoft Windows. When not working with Windows or writing Tips, Barry is an amateur writer. His first non-fiction book is titled "A Chronological Commentary of Revelation." ...


Moving and Resizing Windows

The ability to work on multiple things simultaneously is a hallmark of Windows. If you have many windows up at once, ...

Discover More

Understanding Windows Defender

There are a myriad of computer viruses always looking for new systems to infect. You can mitigate your risk of being ...

Discover More

Creating a Simple Batch File

One of the powerful capabilities built into Windows is the ability to create and use batch files to perform a wide ...

Discover More
More WindowsTips

Enabling Speech to Text Dictation

With Dictation feature in Windows 10 Fall Creators Update, you can quickly say what you want and have Windows 10 ...

Discover More


Navigating to favorite files or folders need not be a time waster of click through a tree structure. ConFavor makes this ...

Discover More


Need to find out which files are hogging the most space on your hard drives? The WizTree utility can analyze your drives ...

Discover More

If you would like to add an image to your comment (not an avatar, but an image to help in making the point of your comment), include the characters [{fig}] (all 7 characters, in the sequence shown) in your comment text. You’ll be prompted to upload your image when you submit the comment. Maximum image size is 6Mpixels. Images larger than 600px wide or 1000px tall will be reduced. Up to three images may be included in a comment. All images are subject to review. Commenting privileges may be curtailed if inappropriate images are posted.

What is three less than 3?

There are currently no comments for this tip. (Be the first to leave your comment—just use the simple form above!)

Newest Tips