Process Monitor is an advanced monitoring tool for Windows that tracks file system, registry, process and thread activity. Developed by Microsoft, it is part of the Sysinternals suite and is designed to analyze the behavior of applications and services.
- File operation logging. Process Monitor records all file read, write, create and delete operations performed by processes in real time. It includes details such as the file path, the process involved, the result of the operation and the exact time. This is essential for detecting unauthorized access or permission problems.
- Windows registry monitoring. The tool captures every action related to the system registry, including key reads, modifications and deletions. It provides details such as the key path, the modified value and the responsible process. Useful for resolving configuration conflicts.
- Process activity tracking. Process Monitor logs process creation and termination, including information about the executable, the command-line arguments and the process identifier (PID). It helps identify unwanted or malicious processes.
- Advanced filtering. Filters can be applied based on multiple criteria such as process name, operation type, result or path. Filters can be combined to isolate specific events and reduce noise in the logs.
- Stack trace capture. It can optionally save stack traces for operations, showing the sequence of calls that led to a particular action. This helps in understanding the context in which an event occurred.
- Built-in search. It includes quick search functions across the captured data, making it possible to locate operations by text, process or event type. Regular expressions are supported for complex searches.
- Data export. Logs can be exported to formats such as CSV or XML for later analysis in other tools. All metadata of the captured events is preserved.
- Event bookmarking. Specific events can be tagged during monitoring to make them easier to find later. Bookmarks persist even after filters are applied.
- Operation highlighting. Can be configured to visually highlight events that meet certain conditions, such as access errors or operations from specific processes. The colors are customizable.
- Real-time statistics. Displays metrics about the captured activity, including counts by operation type, process or result. This helps identify behavior patterns.
- Profile configuration. Monitoring settings, including filters and display options, can be saved and loaded. Useful for repetitive diagnostic scenarios.
- Process Explorer integration. A process can be opened directly in Process Explorer to get additional details. The integration makes cross-analysis between the tools easier.
Process Monitor was originally created by Bryce Cogswell and Mark Russinovich, founders of Winternals Software. Microsoft acquired the company in 2006 and brought its tools into the Sysinternals suite. It evolved from earlier tools such as FileMon and RegMon. Process Monitor is distributed as part of Sysinternals and has received regular updates over the years to support new versions of Windows.
Alternatives to Process Monitor:
For Process Monitor there are 2 alternative programs. Free: 2, paid: 0.
MyProcesses is an application for analyzing and managing running processes in Windows systems.
Price: Free Size: 2.3 MB Version: 1.2.0.9 OS: Windows
Loxx is a specialized tool for viewing and analyzing log files generated by systems and applications.
Price: Free Size: 44.1 MB Version: 1.02.3102 OS: Windows
