Using Procmon in Command-line

You can run Procmon using command-line.

1. The following command-line will spawn procmon in Quiet mode(will not ask for any filter. It will collect all information). The procmon will start in the minimized window and also save the log in the file(abc.PML):
procmon /Quiet /Minimized /BackingFile abc.PML
2. Once you are done you can issue the following command to stop the procmon :
procmon /Terminate
3. Now you can open the abc.PML file and check if there is any activity that is causing the issue.

You can even schedule two tasks to start/stop procmon at the specified time.

Comments (4)
  1. Rusty says:

    I've followed every example that I can find using the /terminate flag… and I have yet to see it work correctly.

    If you use the the test script show in the help files:

    set PM=C:sysintprocmon.exe

    start %PM% /quiet /minimized /backingfile C:tempnotepad.pml

    %PM% /waitforidle

    start /wait notepad.exe

    %PM% /terminate

    all this does is leave 2 procmon processes running neither one can you get to.

    and if you kill them (i.e. procexp)   then you can't get the .PML file to read.

  2. zartimus says:

    I think when you see two instances of procmon processes sitting there doing nothing after being called from a scheduled task, that's when you have it running under another account that has not accepted the License agreement. Try logging on with said account (or use your own) and run it interactively so you can say yes to the license agreement. Then you may have success.


  3. Thomas says:

    Did anyone get round to fixing this? I have the same problem, two processes running and killing them currupts the log file.

  4. M says:

    My solution to this was to call procmon using the "/Terminate" argument and then to kill both left over processes using pskill.  Eg.

    procmon /Terminate

    pskill procmon

    pskill procmon64

Comments are closed.

Skip to main content