Using Procmon in Command-line

  • Article

You can run Procmon using command-line.

1. The following command-line will spawn procmon in Quiet mode(will not ask for any filter. It will collect all information). The procmon will start in the minimized window and also save the log in the file(abc.PML):
procmon /Quiet /Minimized /BackingFile abc.PML
2. Once you are done you can issue the following command to stop the procmon :
procmon /Terminate
3. Now you can open the abc.PML file and check if there is any activity that is causing the issue.

You can even schedule two tasks to start/stop procmon at the specified time.