Other filters allow you to narrow down to specific files or events you want to monitor.

The right most button toggles the display of process / thread activity. The middle button shows or hides file system activity. The leftmost button turns registry events on or off. Three buttons on the main toolbar make it very easy to filter down to the events you want to see. All I have to do is click on one of them then click the Go To Event button and it will take me right to the event. Here you can see some of the many programs I have running. One feature I rather like is the Process Tree, under the Tools menu. For example, I have WinAmp playing a recent DotNetRocks episode. In the example below you can see what’s going on in my system as I write this. It will keep an eye on all disk activity, whether it be on the drive or the registry. I’ve already mentioned a few in my last post, in this one I wanted to take a quick look at the new ProcMon.Īvailable at, the new Process Monitor (ProcMon) replaces two older tools, FileMon and RegMon. Just when I thought I was done talking about the SysInternals tools, Microsoft finally integrates them into their TechNet site and makes some changes.

Sysinternals api monitor