Process monitor from the sysinternals from microsoft

Visualising the process using Process Explorer

Figure 10: A visual summary of all the processes Go to Tools > Cross reference summary (paths that are written and read between differing processes). This dialogue box shows the paths that are written by one process and read by another one.

Network summary lists each unique destination IP address present in the trace and a number of different types of events, including sends and receives, to each address. You can access the stack summary by going to Tools > Stack Summary. Stack summary is used to visualise individual instances of stack traces for each process. Figure 7: Network information during trace Figure 8: Cross reference summary during trace Figure 9: Visualising the CPU process Registry summary can be accessed by going to Tools > Registry Summary. Registry summary lists each unique registry path present in the filtered trace, the amount of time spent performing I/O to the registry path, the total number of events that referenced the path, and the count of individual operation types. The file summary can be achieved by means of the folder and extension.ДЄctivity summary lists all the processes seen in the trace, file events, I/O, registry events, network events, including their process ID, image name and command line.ДЄctivity summary can be accessed by going to Tools > Process Activity Summary. Figure 4: Activity summary for various processes and their operations Figure 5: Registry information accessed during trace Figure 6: Stack information during traceДЇile summary dialogue lists each unique file system path present in the filtered trace, the amount of time spent performing I/O to the file, the total number of events that referenced the path, and the count of individual operation types.ДЇile summary can be accessed by going to Tools > File summary.

It also detects and monitors new file system devices. Process monitor displays all the activities of a file system, including local and remote storage. Process tree displays all of the processes referenced in a hierarchy in the loaded trace, which shows parent-child relationships. Process monitor includes a number of dialogues that allow you to perform simple data mining on the events collected in a trace. Figure 1: Process tree for various processes Figure 2: File system activity Figure 3: File summary by path

Process monitor from the sysinternals from microsoft