Sysinternals replaces Filemon and Regmon with Process Monitor
Jamie Cansdale shares that the venerable Filemon and Regmon utilities have been replaced with Process Monitor, which has a nice list of added features listed below. Time to update the toolbelt.
- Monitoring of process and thread startup and exit, including exit status codes
- Monitoring of image (DLL and kernel-mode device driver) loads
- More data captured for operation input and output parameters
- Non-destructive filters allow you to set filters without losing data
- Capture of thread stacks for each operation make it possible in many cases to identify the root cause of an operation
- Reliable capture of process details, including image path, command line, user and session ID
- Configurable and moveable columns for any event property
- Filters can be set for any data field, including fields not configured as columns
- Advanced logging architecture scales to tens of millions of captured events and gigabytes of log data
- Process tree tool shows relationship of all processes referenced in a trace
- Native log format preserves all data for loading in a different Process Monitor instance
- Process tooltip for easy viewing of process image information
- Detail tooltip allows convenient access to formatted data that doesn't fit in the columna