Windows sysinternals

132 Part II Usage Guide
Automating Procmon: Command-Line Options
Procmon offers a number of command-line options, which helps enable scripted execution.
Say, for example, you need a novice user to run Procmon with a particular configuration
and to send you the results. Instead of asking the user to follow detailed instructions for
configuring and running Procmon, you can simply give that person a batch file to run.
Procmon’s Help menu includes a quick summary of Procmon’s command-line options.
Table 4-4 describes them in more detail.
TABLE 4-4 Command-Line Options
Option
/OpenLog pml-file
/BackingFile pml-file
/PagingFile
/NoConnect
/NoFilter
/AcceptEula
/LoadConfig config-file
/Profiling
/Minimized
/WaitForIdle
/Terminate
/Quiet
/Run32
Description
Opens a previously saved Procmon log file. Note that a log file must
be opened by an instance of Procmon running in the same processor
architecture as that which recorded it.
Saves events in the specified backing file. Using a named backing file
enables a log file capacity limited by free disk space. Note that this option
is sticky—the file you specify becomes the Procmon log not just for
the instance you’re launching; it becomes a permanent setting change.
(See the “Backing Files” section for more information.)
Saves events in virtual memory, backed by the system page file. This
option is used to revert the /BackingFile setting.
Starts Procmon but does not automatically begin capturing data. By
default, Procmon begins event capture on start.
Clears the filter at startup. This removes all filter rules except the
exclusion of Profiling events.
Doesn’t display the End User License Agreement (EULA) dialog box on
first use. Use of this option implies acceptance of the EULA.
Loads a previously saved configuration file. (See the section on
Configuration Files for more information.)
Enables the Thread Profiling feature.
Starts Procmon minimized.
Waits for up to 10 seconds for another instance of Procmon on the same
Win32 Desktop to become ready to accept commands. See below for an
example of how to use this option.
Terminates any instance of Procmon running on the same Win32
Desktop and then exits. This option uses window messages to send
the command to the target Procmon instance. (See “Sessions, Window
Stations, Desktops, and Window Messages” in Chapter 2.)
Doesn’t confirm filter settings during start up. By default, if filter rules
have been configured, Procmon displays the filter dialog box to allow
you to modify them before capturing data.
Run the 32-bit version to load 32-bit log files (x64 only).
www.it-ebooks.info