- Process Monitor home
- Operating Systems
Process Monitor is a program that displays information on real-time about Windows running processes.
Operating Systems allow us to use the computers in a simple way. Thanks to them we can write documents, listen to music, browse the Internet, watch movies, etc. To do those tasks, final no need to know which processes are running in the Operating System.
However, in certain situations, it is necessary and useful to know which processes are being executed by the installed programs.
Process Monitor allows us to display and monitor different Operating System processes.
Software's main screen consists of a toolbar, and a panel where all system activity will be logged. Some of the data displayed in the panel is:
- Time when the event happened.
- Name of the process
- PID (the number that identifies uniquely the Process)
- Type of Operation
- Path accessed by the process
- Result: Displays if the process has been satisfactory or has produced any other type of result.
We can add new columns to the information panel, so it will show up more information about the registered event. For example it can display: Process company name, Process version, duration of the event, parent process PID, and more.
The information panel registers the following aspects of the Windows Operating system:
- Show Registry Activity: Here we can see programs that have accessed Windows registry, and we can see the key registry they have read or modified. This is very useful if we want to know if a program tries to modify maliciously the System registry.
- Show File System Activity: The programs shown here are those that read or write any file on the file system. This allows us to view the files that are being modified or read by the programs. This function can be used to identify log error files created by some programs.
- Show Network Activity: This list shows the programs that are making use of the network connection. Displays information such as; protocol connection (TCP, UDP, etc), remote IP address, domain, etc. This information allows to identify the programs that make malicious use of the Internet connection, for example malware and adware.
- Show Process and Thread Activity: Information showed here is about about processes and threads created in PC's memory by active programs.
- Show Profiling Events: This option allows us to see the time consumed by any running process. It is very useful to detect possible performance problems of programs and applications.
In the top toolbar we can show or hide any of the activities referred above. For example, we can display only the File System activity. That way, only events related to file system will be logged and displayed.
If we double click on any of the registered events, it will display a window with more information about that event. Depends on the type of event, it will display a type of information or another.
The program also includes a powerful filtering tool, so that we can quickly find the events and processes that we were looking for.
Another useful tool included in this software is the “Tree Process” (Process Tree), which shows the processes that are being executed in the System in the form of a data tree.
The software does not require installation, and so we only need to unzip it and launch the included executable.
it is worth mentioning that this software combines the features of two discontinued programs, and are therefore not updated any more: FileMon and RegMon developed by Sysinternals.