Automating ProcMon from SysInternals

Hello,

I am looking to use ProcMon to monitor a single process for all File System, Network, Process\Thread and Profiling Events activity. (Registry activity would be an overwhelming amount of data)
I would like to run ProcMon in this manner against a single process entirely in the background. Ideally, I would like to close and then export the data captured on a periodic basis and then continue monitoring for a short time period and then export.....etc and the loop continues. I am trying to minimize as much as possible the possibility of killing or even affecting the system I am running ProcMon on.  Thanks for any feedback on how I can automate this in a transparent manner.
Charlie_MelegaAsked:
Who is Participating?
 
GovvyConnect With a Mentor Commented:
procmon /Quiet /LoadConfig <file> /Minimized /BackingFile abc.PML

where you create the config file for the process you wish to monitor beforehand...
0
 
Charlie_MelegaAuthor Commented:

Thanks Govvy. Based on this, how often would the process data I capture be saved to the "BackingFile"? Is there a specific file size limit for this type of BackingFile and would another file be opened an incremented? I am trying to continuously write this data. The file, with the specific process data written,  would be closed and a new one opened based on a file size or time limit. Thanks again.
0
 
GovvyCommented:
Run from the command prompt

>procmon /?

You will see the options are unfortunately limited :(
0
 
Charlie_MelegaAuthor Commented:
One last question on this, how is a ProcMon config file created?  
0
 
Charlie_MelegaAuthor Commented:
disregard, I just exported the current configuration to a pmc file and will use in command line syntax provided. I will say that these files grow very large, very quickly. It's understandable based on the data captured but I need to pare this down a bit and also build a script that will delete the folders contents of the backing files so that there are no more than 2 at a given time. After the 2nd file closes, I need to delete both and start with the original file name and loop this process.
0
All Courses

From novice to tech pro — start learning today.