Process Monitor (procmon)
Process Monitor (microsoft.com) is Microsoft SysInternals' tool for capturing file, registry and process activity. It is very helpful during diagnosis of unexpected side-by-side behaviour. Typical uses:
- Check startup sequence to see if a manifest is accessed as expected.
- Verify manifest search sequence to confirm that the expected manifest is loaded.
- Verify that COM information form the registry is not read.
Typical use instructions
- Download Process Monitor from microsoft.com. Unzip to a folder of your choice. Always use the latest version of procmon. We may not be able to use the file if it is captured with an old version of procmon.
- Start Process Monitor (procmon.exe). Wait for it to initialize. It may take a moment for the first time.
- A filter window pops up. Click “Reset” to reset all filters to default. Click OK.
- Normally capture starts immediately and you will see events in procmon window. If it does not start automatically – start by hand.
- Clear the Process Monitor display. First time it will take a moment.
- Start your application.
- Reproduce the problem.
- As soon as the problem is reproduced stop capture in Process Monitor. You want to avoid capturing too much data.
- Save Process Monitor events using these settings: "All events", "Native Process Monitor format".
- Review the content of Process Monitor log to check for proprietary information you do not want to share with us. Do not filter the output. If there is proprietary information, reproduce the problem on a clean machine. This can easily be done using Hyper-V and a clean installation of Windows.
- Zip the file. Post it somewhere on the internet where we can download it with HTTP/HTTPS. Mail us the link. We will not accept links other than plain HTTP/HTTPS. We will not use any client software, just plain HTTP GET.
Example uses of Process Monitor
CLR assembly search order analysis.
Diagnosis of CLR startup issues.
Things to remember
Process is created by CSRSS. The initial Win32 side-by-side assembly lookup is performed by CSRSS. Subsequent access is performed by the actual process.
Common Language Runtime (CLR) may be initialized first. This impacts the availability of features and setting. See also Runtime Versions.
There should be no Windows COM registry access when cretaing objects properly defined in manifests. Any reads of
HKEY_LOCAL_MACHINE\SOFTWARE\Classes, HKEY_CURRENT_USER\SOFTWARE\Classes or HKEY_CLASSES_ROOT
indicate missing or incorrect manifests.
Use menu Tools / File Summaryfor a quick glance at what files are being accessed. Sort by path and check if your manifest
file was used.