Process Monitor

ApplicationMicrosoft Corporation

Also called procmon, procmon64, sysinternals process monitor

Microsoft CorporationSystem

A file, registry, and process trace from Sysinternals. The 64-bit process is Procmon64.exe. The log grows fast. It is not Process Explorer.

What you need to know

Process Monitor is a trace log. Process Explorer is a live tree.

Sysinternals Process Monitor records file, registry, and process events. Get it from Microsoft Learn. Filter first. The log grows fast. procexp64.exe is the other Sysinternals window.

What is it?: A file, registry, and process tracer
Same as Process Explorer?: No. Explorer is a live tree
Does the log grow?: Yes. Filter first

Feex says

If the question is "who wrote this file ten seconds ago", I would start Process Monitor with a filter, then reproduce. I would not leave it running all day. The log grows fast.

What is Process Monitor?

Process Monitor records a timeline of file, registry, network, and process events. Procmon64.exe is the logger. Process Explorer is procexp64.exe, a live tree without this boot-to-now log.

If you have never used it

If you need a log of file, registry, and process events, Process Monitor is the Sysinternals tracer. Download it from Microsoft Learn. The log grows fast, so set a filter before you reproduce the bug. It is not Process Explorer, which is a live tree, and it is not Resource Monitor.

What is it used for?

Trace which process touches a file

Reproduce the action with a filter on the path. Process Explorer shows the handle now. This tool shows the history.

Trace registry writes

Find which app changed a key. That is Procmon, not Task Manager Startup and not Autoruns.

Boot logging (advanced)

Options can log during startup. The PML file gets large. Turn it off after the capture.

Who is it for?

People hunting an access-denied or a leftover writer
Admins who already tried Process Explorer's handle search
Anyone who should filter first so the log does not eat the disk

Current status

Process Monitor (2006) is a current system activity tracer from Microsoft Corporation. The vendor still points Windows users at https://learn.microsoft.com/sysinternals/downloads/procmon.

How old is it?

Process Monitor shipped in 2006 as the merge of Filemon and Regmon. Process Explorer is older (1997). Microsoft still hosts both. A Filemon-only guide is stale.

Versions

Major channels first. Exact build numbers are not all verified here.

Procmon64.exe

Sysinternals Suite zip

System requirements

Values follow the publisher's public guidance. Workload still changes the real need.

Minimum

Minimum system requirements
Operating system	A current supported Windows 10 or Windows 11 release, per Microsoft Sysinternals
RAM	Enough for Windows plus this app. Heavy projects want more.

Resource profile

CPU demand: Rises with event rate
Disk demand: The log grows fast without a filter

Installed processes

These executables belong to this product when it is installed.

Installed processes
Procmon64.exe	Trace window
Procmon.exe	Launcher that starts the 64-bit build

Startup components

Procmon should not stay on at logon unless you enabled boot logging on purpose. Turn that off after the test.

File locations

Common Process Monitor locations
Typical install	Wherever you unpacked Sysinternals

File formats

PMLCSV

Common problems

The log fills the disk

Set a filter, drop unused event classes, or use /BackingFile on a large volume. Process Explorer does not write this PML.

Capture without a filter

You will drown in System and Explorer noise. Filter on the process name or path before you click the bug.

Getting unstuck

Download Procmon from Microsoft Learn, not a random procmon.exe

The Sysinternals zip is signed. Process Explorer is the live tree if you did not need a log.

Filter > Process Name or Path before you reproduce

That is how Procmon stays usable. Autoruns is the logon list, not this timeline.

File > Save a PML, then File > Backing Files if the capture must be huge

Default paging can still grow. Stop the capture when you have the event.

Alternatives

Process Explorer for a live look. Autoruns for logon hooks. Resource Monitor for a simpler disk and network glance.

Official help and downloads

Start with the vendor. Random exe sites are not a support channel.

Official contacts
Download	learn.microsoft.com/sysinternals/downloads/procmon Official installer or vendor page
Help	learn.microsoft.com/sysinternals/ Vendor support
Official site	learn.microsoft.com/sysinternals/downloads/procmon Start here, not a random exe host

Related hardware

A fast disk helps when the PML is large. The tool traces software activity, not a GPU bench.

Technical details

Vendor version numbers change. This article does not pin a build.

Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.

Process Monitor official site · Vendor product page
Process Monitor help · Vendor support
Process Monitor · Microsoft documentation
Foxhole process map · First-party samples on Windows PCs. Not a lab benchmark.

Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.