Since we could capturing hours or days worth of data it might be preferred to store that to a disk with lots of free space (multiple GBs or more depending on expected duration and number of events). Instead launch it from the command line with the /noconnect parameter.īy default ProcMon will store event data in virtual memory. If you start up ProcMon by double clicking the executable ProcMon will start capturing data immediately.

Since we are monitoring for such a long time we want to make sure that ProcMon only captures the data that we need as well as be mindful of memory / disk space usage. In such a scenario we need to monitor a file / registry entry from a fresh start (restart application pool, process, etc.) until the file / registry access error happens which could be hours or days.

Usually the problem involves one piece of software placing a write-lock or exclusive hold on a file / registry entry while the other software expects the same. Net website and anti-virus software, SharePoint and server backup software, etc. Skip down to the Tips section if you don’t want to read the back story.Īt least once a month I have a customer scenario where two or more applications are not playing nice with each other.

This is useful if your customer / organization doesn’t allow installing / running 3rd party tools or has concerns about running them directly on a machine. You can run the Sysinternals tools from the web at Sysinternals Live without needing to download the tools to your local machine. Note that I am not an expert in ProcMon by a long shot, so this is more of a selfish post to remind myself of some key settings to be sure to configure. In this post I will cover a few tips for getting started with using ProcMon ( Process Monitor in the Sysinternals Suite) for troubleshooting long running processes.

Sysinternals file monitor