Finding Specific Processes In Process Monitor: A Quick Guide

Process Monitor is a free advanced monitoring tool for Windows that shows real-time file system, registry, and process/thread activity. It is included in the Windows Sysinternals suite of Windows utilities and allows users to view detailed information about all processes running on their system. This includes the process name, ID, and the result of every operation. With Process Monitor, users can also set filters on any field to limit the data displayed, log process events for troubleshooting, and view a process tree that shows the relationship between parent and child processes. This article will provide a step-by-step guide on how to use Process Monitor to find and monitor a specific process.

Using the Find and Filter tools

Process Monitor is a free advanced monitoring tool that allows you to view detailed information about all processes running on your system. It is included in the Windows Sysinternals suite of Windows utilities. The tool includes several features that can help you find and filter specific processes.

To use the Find tool, you can right-click on the Process Name and select "Include *process_name_here". This will limit the number of results displayed and help you focus on the specific process you are interested in.

Additionally, you can use the Filter tool to further narrow down your results. Right-click on any of the processes and choose "Edit Filter" to update the process filter. This will open a window that allows you to customise your filter. You can select the object for your filter (such as Process Name), choose an operator (such as "is", "is not", "less than", etc.), and enter or select your filter criteria. You can also choose whether to include or exclude the entries that match your filter.

Another way to access the filter options is by going to the Filter menu and selecting "Filter". This will open the same window as before, but with a blank filter. You can then select each dropdown and customise your filter accordingly.

Process Monitor also offers non-destructive filters, which means you can set filters without losing any data. You can set filters for any data field, including fields that are not configured as columns. This flexibility allows you to create complex and customised filters to find and isolate specific processes.

In addition to the Find and Filter tools, Process Monitor also provides a process tree view. This view displays the parent process and all the processes it has launched, along with information such as the launch command, app developer, duration, and launch date.

By utilising the Find and Filter tools, along with the process tree view, you can effectively find and filter specific processes in Process Monitor. These tools help you navigate through the vast amount of information and focus on the processes that are relevant to your troubleshooting or debugging tasks.

Right-clicking to access properties

Right-clicking on a process in Process Monitor allows you to access its properties, which can provide a wealth of information about the process in question. The properties are organised into several tabs, each offering specific details about the process.

The Event tab displays general information about a selected event, including its sequence number, issuing thread, event class, operation, result, and timestamp. For file system and registry events, it also includes the resource path. The lower area of the Event tab lists additional details about the event, which are dependent on the event operation.

The Process tab provides information about the process that executed the event. This includes the path and version strings of the process image, as well as process execution attributes such as the process ID, user account, and whether the process is 32-bit or 64-bit. For processes running on Windows Vista systems, the integrity level of the process and virtualisation status are also shown. The bottom area of the Process tab displays a list of images loaded in the process, along with their loaded addresses.

The Stack tab shows the thread stack of the thread when the event was recorded. It can be useful for understanding why an event occurred and identifying the responsible component. Kernel-mode frames are designated with a 'K', while user-mode stacks are marked with a 'U'.

Right-clicking on a process in Process Monitor provides a quick and convenient way to access detailed information about that process, making it easier to analyse and troubleshoot issues related to specific processes and events.

Sorting by column

Sorting data by columns in Excel is a useful skill to have for data analysis. Sorting data helps you visualise and understand your data better, allowing you to make more effective decisions.

Sorting by One Column

To sort by a single column, first, select a cell in the column you want to sort. Then, on the Data tab, in the Sort & Filter group, do one of the following:

• To sort in ascending order (A to Z, smallest to largest, or earliest to latest date), click the "Sort Ascending" button.
• To sort in descending order (Z to A, largest to smallest, or latest to earliest date), click the "Sort Descending" button.

Sorting by Multiple Columns

You can also sort by more than one column. For example, you might have a table with a "Department" column and an "Employee" column. First, you can sort by Department, and then sort by name to put the names in alphabetical order within each department.

To do this, first, select any cell within your data range. Then, on the Data tab, in the Sort & Filter group, click "Custom Sort". In the Custom Sort dialog box, under Column, select the first column you want to sort by. Then, under Order, select how you want to sort. Repeat these steps to add another column to sort by.

Sorting by Row

It is also possible to sort by row, rearranging the order of columns from left to right based on column headers or values in a particular row. For example, you might have a list of photo cameras with different features, specifications, and prices. You can sort the cameras by the model name first.

To do this, select the range of data you want to sort. If you want to rearrange all the columns, simply select any cell within your range. Then, click the "Sort" button on the Data tab to open the Sort dialog. If your worksheet does not have headers, uncheck the "My data has headers" checkbox. If your sheet does have headers, leave the tick and click the "Options" button. In the opening Sort Options dialog under Orientation, choose "Sort left to right", and click "OK". Then, select the row by which you want to sort. Make sure you have "Values" selected under "Sort on" and select "A to Z" or "Z to A" under "Order", then click "OK".

Filtering by PID

Using Process Monitor on Windows

Firstly, launch the Sysinternals Process Monitor on your Windows computer. This tool allows you to inspect specific processes and their details. In the Process Monitor window, look for the "Filters" button and click on it. This will open up the filtering options.

In the Filters window, you'll find various fields that you can use to narrow down your search. To filter by PID, look for the "Process ID" field. You can enter the PID of the process you're looking for directly into this field. If you don't know the PID, you can find it using the Task Manager or tools like AutoHotkey Window Spy.

Once you've entered the PID, click on the "Add" button to apply the filter. The Process Monitor will now only display the process(es) associated with that specific PID.

Using htop in Linux

If you're using Linux, a similar tool called htop can be used to monitor and manage processes. To find a specific process by its PID in htop, simply open the htop application and type in the PID of the process you're looking for. There's no need to hit Enter; htop will automatically find and highlight the process with the matching PID.

Using Wireshark

Wireshark is a popular tool for monitoring network traffic, and while it doesn't directly support filtering by PID, there are some workarounds. One method is to match port numbers from Wireshark with port numbers from netstat, which will allow you to identify the PID of a process listening on that port.

Alternatively, you can use Microsoft's Network Monitor 3.3 or Microsoft Message Analyzer, which do include a "Process Name" column that can be easily added to a filter using the context menu.

Using top in Linux

The "top" command-line utility in Linux provides information about active processes and system resources. While it doesn't directly support filtering by PID, you can achieve this by using additional tools like "pgrep". By combining "top" with "pgrep", you can filter processes by their PIDs.

For example, the command "$ top -c -p $(pgrep -d',' -f matching_string_in_cmdline_output)" will filter the output of "top" to only display processes with PIDs matching the specified pattern.

Additionally, you can create a custom script that continuously monitors a specific process by name and updates the output at regular intervals. This script can be set to refresh the output every few seconds, ensuring that you capture any changes in the process's PID.

Using Procmon64.exe for 64-bit Windows systems

Procmon64.exe is an executable file associated with the software Process Monitor, also known as Sysinternals Procmon. This software is developed by Sysinternals, a part of Microsoft that provides a range of utilities for power users to manage, diagnose, troubleshoot, and monitor Windows systems.

Process Monitor is a powerful tool used for system monitoring and malware analysis. It provides detailed real-time information about processes, threads, and registry activities happening in the system. It combines the features of two older Sysinternals utilities, Filemon and Regmon, and adds enhancements including rich and non-destructive filtering, and comprehensive event properties.

Procmon64.exe is required when you want to monitor and capture the file system, Registry, and process/thread activity in real-time. It is a valuable tool for system administrators, developers, and power users for diagnosing problems. It is also used by IT security professionals for malware analysis and system troubleshooting.

If you are running a 64-bit Windows system, choose the file named Procmon64.exe. From the main Process Monitor window, you can launch a view that is similar to the Process Explorer app. This is the process tree view, which can be accessed by selecting the small document icon with an image of a tree diagram.

Some information you can see in this view includes the parent process and all of the processes it has launched. You can also see the launch command, the app developer (if available), how long it has been running, and the date it was launched.

It is important to note that under normal circumstances, there is no need to remove Procmon64.exe if you are using the Process Monitor tool. However, if you find this executable file running on your system without having installed Process Monitor, it could potentially be a malicious program disguising itself as Procmon64.exe. In such cases, it is recommended to run a full system scan with a reliable antivirus or antimalware program.

Frequently asked questions