How to use ProcMon (Process Monitor) - WKB10444

OBJECTIVE or GOAL

Run ProcMon (Process Monitor) on a server/PC to help troubleshoot performance or stability issues.

ENVIRONMENT

• Empower
• NuGenesis LMS/SDMS
• MassLynx
• UNIFI
• Any software-related investigations

PROCEDURE

1. Download ProcMon from the internet
2. Copy the executable to the customer's machine and unzip it
3. Prepare the system for monitoring (to reproduce the issue as quickly as possible)
4. Short-duration monitoring (useful when the issue can be reproduced on-demand):
   1. Close as many other applications as possible, to reduce log entries during the execution of ProcMon
   2. Start ProcMon.  It will immediately start capturing events
   3. Reproduce the issue as quickly as possible.
   4. Stop ProcMon.
   5. Save the log file in "process monitor" format
5. Long-duration monitoring (useful when the issue occurrence cannot be predicted):
   1. Start Procmon and immediately stop the capture (File menu \ Capture events), and clear any captured data (Edit menu \ Clear Display)
   2. Click File \ Backing Files
   3. Select Use file named
   4. Browse to a folder for the file and enter an arbitrary file name, such as test.pml.  Click OK
   5. Enter any relevant filters, if the event is suspected to involve file / registry / or network events
   6. Click Filter menu \ Drop Filtered Events so that procmon will not retain events that do not match the filters
   7. Start the capture (File menu \ Capture Events)
   8. Run procmon for as long as needed to record the activity of interest.  The configuration steps above will minimize the impact of procmon on the system's performance and the PML file's size
6. Make sure that you save all captured processes
7. Zip the PML file and send it to Waters Support
8. Remove the ProcMon application/zip file after final use

ADDITIONAL INFORMATION

ProcMon can be downloaded from www.sysinternals.com.