Automating ProcMon from SysInternals
Posted on 2011-09-07
I am looking to use ProcMon to monitor a single process for all File System, Network, Process\Thread and Profiling Events activity. (Registry activity would be an overwhelming amount of data)
I would like to run ProcMon in this manner against a single process entirely in the background. Ideally, I would like to close and then export the data captured on a periodic basis and then continue monitoring for a short time period and then export.....etc and the loop continues. I am trying to minimize as much as possible the possibility of killing or even affecting the system I am running ProcMon on. Thanks for any feedback on how I can automate this in a transparent manner.