#Process monitor find starting process how to#

You can save wherever works best for you. Once the issue is reproduced (error message pops up, function doesn't work, etc) then click the Magnifying glass to stop the trace. Click File > Save and select All Events as

Of course there are always exceptions to the rules, but these are the general guidelines.

But if the error happens when you click an icon in a program, then the program should be running before you start capturing with ProcMon.If the error happens as part of the start up of a program, then ProcMon should be capturing before you start the program.Make sure to have ProcMon started early enough to capture Then execute the steps to reproduce the issue. When prepared to reproduce the issue, click the Magnifying glass to start the trace. AlsoĬlick the second icon (Eraser) to clear the log before starting the capture of the issue. However they do compress well so don't worry to much even if it takes some time to capture the information the logįile can usually be compressed to a manageable size. Note: if left on for long periods ProcMon traces can get very large. To go through the process that will cause the issue we are looking for. Once you have determined where you want it to run, start ProcMon but click the Magnifying glass icon to pause the trace until you are ready If just capturing something that happens in the users session after logon, then just run in the users session.Even if you are using Switch User, if you have ProcMon running in the other user session it will capture the information that happens in the new session started when you It is best to run ProcMon in another logged on users session on the same machine. If you are trying to capture something that happens during the logon process.There are two general locations to run ProcMon.

#Process monitor find starting process how to#

How to use ProcMon to gather information to troubleshooting FSLogix issues. Using Process Monitor (ProcMon.exe) to troubleshoot FSLogix issues