Immediately stop data collection with the magnifying glass button.

Typically, you would follow these steps to do the initial data collection: Since Procmon tends to capture a lot of data very quickly, it's important to know how to use it effectively. This button will start and stop data capturing. To stop capturing, press Ctrl+E or the magnifying glass icon on the toolbar.

Once it's opened, it will immediately begin collecting and showing current process events. Once it's downloaded and unzipped, you should right click and run it as administrator.

Most easily, you can download it directly at.

Like all Sysinternals tools, Procmon can be obtained in a number of ways. By watching all of the reads/writes of the app, you can find the file you're looking for. For example, you may have trouble locating a configuration or log file for a certain application. In addition, if you ever just need to find what files or registry keys are being used, Procmon can help you find out.

Registry keys or values missing or being named incorrectly.

Incorrect permissions on a file or registry key.

That's perfect for tracking down issues such as: Specifically, if you are trying to found out what files an application uses or what registry entries are being read or modified, Procmon can help. Procmon is a great tool for trying to resolve certain issues. It has a robust filtering system that makes it easy to drill down into the data needed to resolve a variety of issues. Procmon is a real-time monitoring tool that logs all filesystem and registry activity. Process Monitor, or Procmon is one of the tools in the Sysinternals suite and is invaluable in troubleshooting certain types of Windows and application issues.

How to use sysinternals suite