Guide to Logging for Monitor Solution Process Monitor

Guide to Logging for Monitor Solution Process Monitor Logs 7 of 8 Morgan Neill Technical Support Analyst for Monitor Solution Process Monitor Logs 7 of 8 1

Process Monitor Logs Explained • Process Monitor (Proc. Mon) is an advanced monitoring tool for Windows that shows realtime file system, Registry and process/thread activity. • This can be a very useful tool in many situations, especially if the source of problem at hand is hard to track down. • Process Monitor Logs - When to collect: – Process Monitor logs (PM Logs) are a good to collect when there are problems with the monitor agent such as: excessive CPU usage, excessive memory usage, monitor agent crashes, or monitor agent is causing a BSOD (Blue Screen of Death). Process Monitor Logs 7 of 8 2

How to collect Process Monitor Logs • Download Process Monitor from http: //technet. microsoft. com/enus/sysinternals/bb 896645. aspx • Create a folder named Proc. Mon on the root of the C drive. Extract the contents of the zipped folder to C: Proc. Mon. • Double click Procmon. exe to start the program. • When Procmon. exe first launches it will automatically start logging. This can cause unnecessary logging and slow operation of the operating system. • To disable logging until the task at hand is ready to be run and logged by Procmon. exe click File > Capture Events. • Once the task to be analyzed is ready to run click File > Capture Events to enable it. • Once the task to be analyzed has been run and logged by Procmon. exe, save the log files by clicking File > Save and then enter the path in which the. PML file is to be saved and click OK. Process Monitor Logs 7 of 8 3

Thank you! Morgan Neill Morgan_Neill@Symantec. com 541 -335 -3508 Copyright © 2013 Symantec Corporation. All rights reserved. Symantec and the Symantec Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U. S. and other countries. Other names may be trademarks of their respective owners. This document is provided for informational purposes only and is not intended as advertising. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice. Presentation Identifier Goes Here 4