How To Make ProcMon Circular Log to Nail Intermittent Issues

OK I love ProcMon. But leaving it to run the whole day to capture that bizarre random event that you just can’t figure out what causes it is probably not a good idea. Massive ProcMon logs can get very hard to filter and take a long time to save.

So I have two options:

One is to configure the number of events to keep in ProcMon. This is found in Options –> History Depth…

image

Let’s you configure maximum number of events to save. It is in millions, and the smallest amount you can keep is 1 million events.

image

If set to 1 million it captures to about 1.6 million then resets to the most recent 800,000 or so events. What you will get when using with a backing file is it will start <backingfile>-1.pml then <backingfile>-2.pml will start logging with the new events. <backingfile>-1.pml stays around until <backingfile>-3.pml is created, and so on.

On my machine I found 1 million events took up about 420 MB uncompressed and 35 MB zipped. Of course this will vary based on events captured.

However maybe you want to capture over a long time, but to ensure each individual log if small enough to work with easily. This batch file will keep looping and overwriting old log files automatically. As configured here it will make 5 logs of 5 minutes each, then will start overwriting the oldest one. The five minute logs I’ve found averaged ~270 MB uncompressed per log file on my Windows Developer Preview x64 machine during light usage, and these zipped to about 30 MB each.

The batch file can be downloaded here, rename to .cmd, run as Administrator with ProcMon in the path.

http://www.tiange.com.au/ProcMonCircular.txt

About chentiangemalc

specializes in end-user computing technologies. disclaimer 1) use at your own risk. test any solution in your environment. if you do not understand the impact/consequences of what you're doing please stop, and ask advice from somebody who does. 2) views are my own at the time of posting and do not necessarily represent my current view or the view of my employer and family members/relatives. 3) over the years Microsoft/Citrix/VMWare have given me a few free shirts, pens, paper notebooks/etc. despite these gifts i will try to remain unbiased.
This entry was posted in Batch Files, ProcMon and tagged . Bookmark the permalink.

4 Responses to How To Make ProcMon Circular Log to Nail Intermittent Issues

  1. Thank you for this script! My lab builds astronomical instruments for large telescopes, and I’m using it to troubleshoot a spectroscopic detector.

  2. Rom says:

    Hi chentiangemalc
    Would you have pls sometime to fix the abouve link http://www.tiange.com.au/ProcMonCircular.txt
    your batch file looks like what I am looking to troubleshoot some weir shutdowns pls. ;-)

  3. Ryan Lindenfelser says:

    Hi Chentiangemalc
    Could you point me in the re direction to down load your ProcMonCircular.txt batch file the link does not work.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s