{"id":3346,"date":"2016-06-21T11:33:09","date_gmt":"2016-06-21T06:03:09","guid":{"rendered":"http:\/\/198.58.113.91\/blog\/?p=3346"},"modified":"2022-11-29T09:37:00","modified_gmt":"2022-11-29T04:07:00","slug":"procmon-track-process-creation-exit-time","status":"publish","type":"post","link":"https:\/\/www.winhelponline.com\/blog\/procmon-track-process-creation-exit-time\/","title":{"rendered":"Track Process Creation and Exit Time Using Process Monitor"},"content":{"rendered":"

Summary: This post tells you how to track process creation and exit events using the Process Monitor utility.<\/em><\/p>\n

My previous post, List Running Processes<\/a>, helps you track down currently running processes. And the article Command Prompt Opens and Closes immediately<\/a>\u00a0tells you if a last run program window was a scheduled task or not.<\/p>\n

While those posts can be useful for knowing what’s running in the system, there is still something missing using those methods.<\/p>\n

The first post talks about Process Explorer<\/a>, which shows the real-time view of running processes. But it doesn’t keep track of processes that ran a few minutes before and then terminated.<\/p>\n

\"process<\/p>\n

Process Explorer highlights new processes for a couple of seconds, but it doesn’t record a history of creation and termination time or processes. And the second link above deals only with Scheduled Tasks. However, you may need to get the list of processes (especially the short-lived processes) that ran for some time and then terminated. Process Monitor can be helpful in getting that info.<\/p>\n

Use Process Monitor to Track Process Start and Exit Events<\/h2>\n

Start Process Monitor<\/a>, enable the Process activity button, and disable the other buttons.<\/p>\n

\"Process<\/p>\n

Then click the Filter button (or press Ctrl<\/kbd> + L<\/kbd>) to launch the Process Monitor Filter<\/b> dialog.<\/p>\n

Configure the filters as follows:<\/p>\n

Operation \u2192 contains \u2192 Process<\/b><\/pre>\n
\"process<\/p>\n
Click Add, OK. Process Monitor would start capturing events and display results containing Process Create<\/i>, Process Start<\/i>, and Process Exit<\/i> under the Operation column.<\/p>\n
Quick Tip:<\/b> If you’re going to run the trace for a long period of time, then consider enabling Drop Filtered Events<\/b> under the Filter menu. This makes sure your memory or disk is not filled up unnecessarily; it only keeps the record of events that have passed your filter.<\/i><\/p>\n
Here you go! Process Monitor has recorded some Process Start and Process Exit events. To know more details of an event, double-click the entry. It shows the full command-line and path of that process.<\/p>\n
\"process<\/p>\n
\n
Additional Information<\/h3>\n
Enable the Sequence Number and other columns<\/h4>\n
You can enable the Command Line column in Process Monitor Column Selection dialog. From the Options menu, click Select Columns… and enable Command Line,<\/b> and Sequence Number<\/b>.<\/p>\n
Now, a column named “Command Line” appears in the results window.<\/p>\n
\"process<\/p>\n
Process Tree<\/h4>\n
You can view the list of processes in a tree format showing the Parent Processes<\/a>, Path, Life Time, and other information. From the Tools menu, click Process Tree (Ctrl + T).<\/p>\n
\"process<\/p>\n
To make the Life Time bar graph use the trace time (i.e., capture start time) instead of the boot session as the baseline, enable Timelines cover displayed events only<\/b>.<\/i><\/p>\n
Save the Log file<\/h4>\n
For future analysis, save the events to a .PML file containing All Events (if “Drop Filtered Events” wasn’t enabled during the trace) or currently shown events. If you plan to share the log file with an analyst, please zip the file before sending it. Compressing reduces the .PML log file size by 90%.<\/p>\n","protected":false},"excerpt":{"rendered":"
Summary: This post tells you how to track process creation and exit events using the Process Monitor utility. My previous post, List Running Processes, helps you track down currently running processes. And the article Command Prompt Opens and Closes immediately\u00a0tells you if a last run program window was a scheduled task or not.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[6,7],"tags":[412,414],"class_list":["post-3346","post","type-post","status-publish","format-standard","hentry","category-utilities","category-windows","tag-process-explorer","tag-process-monitor"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":1166,"url":"https:\/\/www.winhelponline.com\/blog\/determine-parent-process-of-running-process\/","url_meta":{"origin":3346,"position":0},"title":"How to Determine the Parent Process of a Running Process in Windows?","author":"Ramesh","date":"June 3, 2012","format":false,"excerpt":"You may have come across situations where a continuous hard disk activity taking place although your system being in an idle state. If you open Task Manager out of curiosity, you may find several processes starting and exiting of their own without you doing anything. It could be a scheduled\u2026","rel":"","context":"In "Utilities"","block_context":{"text":"Utilities","link":"https:\/\/www.winhelponline.com\/blog\/category\/utilities\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/archived\/parentproc-3.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/archived\/parentproc-3.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/archived\/parentproc-3.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":1062,"url":"https:\/\/www.winhelponline.com\/blog\/resource-monitor-find-process-locked-file-windows-7\/","url_meta":{"origin":3346,"position":1},"title":"How to Use Resource Monitor to Find Which Process Has Locked a File","author":"Ramesh","date":"July 21, 2010","format":false,"excerpt":"Many folks use Process Explorer from Windows Sysinternals to gather information about running processes and their open handles. In addition, there is an excellent but less familiar utility in-built with Windows 7 and higher (including Windows 10\/11). The built-in utility is Resource Monitor, which provides complete details of running processes,\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"openfiles","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/10\/openfiles-4.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":5946,"url":"https:\/\/www.winhelponline.com\/blog\/program-constantly-writing-hard-disk-io\/","url_meta":{"origin":3346,"position":2},"title":"Find Which Program is Constantly Reading or Writing to Disk","author":"Ramesh","date":"November 4, 2017","format":false,"excerpt":"Does your hard drive LED in the computer's chassis show non-stop disk input or output activity? If the I\/O operations occur at an alarming rate, sometimes even at 100% disk usage, find the process and stop it from running, especially if you're using Solid State Drive. If you're wondering which\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"track disk io usage","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/11\/track-disk-usage-windows.jpg?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/11\/track-disk-usage-windows.jpg?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/11\/track-disk-usage-windows.jpg?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":988,"url":"https:\/\/www.winhelponline.com\/blog\/process-monitor-track-events-generate-log-file\/","url_meta":{"origin":3346,"position":3},"title":"Using Process Monitor to Track Registry and File System Changes","author":"Ramesh","date":"February 1, 2009","format":false,"excerpt":"Process Monitor is an excellent troubleshooting tool from Windows Sysinternals that displays the files and registry keys that applications access in real-time. The results can be saved to a log file, which you can send to an expert for analyzing a problem and troubleshooting it. This article tells you how\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"ProcMon PML log","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2009\/02\/procmon-save-log.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":156,"url":"https:\/\/www.winhelponline.com\/blog\/list-running-processes-and-their-creation-times\/","url_meta":{"origin":3346,"position":4},"title":"List Running Processes And Their Creation Times","author":"Ramesh","date":"April 4, 2008","format":false,"excerpt":"The Windows Task Manager does not list the creation time and date of running processes. To get this info, you may use one of these methods.Process ExplorerProcess Explorer is an excellent tool from Microsoft Sysinternals which shows a list of the currently active processes, along with many other important details.\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"Process creation time","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2008\/04\/proctime1.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":1107,"url":"https:\/\/www.winhelponline.com\/blog\/determine-program-process-owns-error-message-window\/","url_meta":{"origin":3346,"position":5},"title":"How to Find Which Program Owns an Error Message Window","author":"Ramesh","date":"November 8, 2010","format":false,"excerpt":"Error message dialog boxes usually have title bar text containing the application or process name that generated the error. However, you may sometimes encounter a pop-up window with no text in the title bar, making you guess which program has caused the error. Let's say 100+ processes are showing up\u2026","rel":"","context":"In "Windows"","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"process explorer find window handle - drag and drop","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2010\/11\/procexp-drag-window-finder.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2010\/11\/procexp-drag-window-finder.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2010\/11\/procexp-drag-window-finder.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2010\/11\/procexp-drag-window-finder.png?resize=700%2C400&ssl=1 2x"},"classes":[]}],"_links":{"self":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/3346","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/comments?post=3346"}],"version-history":[{"count":0,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/3346\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/media?parent=3346"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/categories?post=3346"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/tags?post=3346"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}