As a Windows user, at approximately dot inwards time, you lot practise experience concerned most the speed of your machine. It could endure most how quick does your organisation responds spell logging inwards or how fast it runs to laissez passer on park tasks. To break just what the programs running on your PC are doing you lot demand to install a monitoring tool as well as this is where Sysinternals Process Monitor tool comes inwards use.
Use Process Monitor to mensurate reboot & logon times
Although at that spot are several monitoring tools for Windows, Process Monitor offers advanced diagnostics as well as tackles diverse troubleshooting scenarios. It has been developed to monitor the organisation correct from its starting stage as well as provides useful information such as:
- Time required yesteryear the organisation to display logon screen
- Time required yesteryear the user to travel inwards the credentials
- Time required yesteryear the organisation to start the Explorer
- Time required yesteryear the organisation to laid upward the desktop inwards a laid solid soil (Desktop is inwards a laid solid soil indicates that Windows has started alongside the bulk of its services as well as processes as well as the user tin start interacting alongside diverse applications without waiting for a busy cursor sign)
The features of Process Monitor are every bit follows:
- Display every bit good every bit tape real-time file system, Registry, as well as process/thread activity
- It tin tape booting fourth dimension yesteryear running inwards real-time mode
- Using Process Monitor, you lot tin filter, search as well as create reports most organisation as well as registry activities
- Troubleshooting tool for the System admins
- Malware hunting
How to start using Process Monitor
- Process Monitor does non require installation. You receive got to download a cipher archive. Once you lot extract the files, you lot tin run Procmon.exe to launch the application.
- When the tool is run for the start time, the user volition endure asked to receive got the End User License Agreement (EULA). Once accepted it would never endure displayed i time to a greater extent than for the same profile.
- Simply pivot the tool to the taskbar alongside correct click option. It would endure tardily to start the Process monitor alongside simply i click.
Process Monitor User Interface
As before long every bit the UI window opens, the tool starts capturing information most Registry, Files as well as Process/Thread activity. The UI reminds you lot of a spreadsheet alongside a massive outlay of information. There are filters that users tin apply to form the collected data.
You volition run into the growing listing of processes inwards the primary window alongside information categorized nether several useful headers.
How to tape a Reboot Cycle describe alongside Process Monitor
Follow the below-mentioned steps to describe the reboot cycle of your system:
Locate the file named “ProcMon” from the unzipped folder as well as click.
Once you lot run into the Process Monitor Filter’ interface click on the ‘Reset’ push clit to reset filters to default values, as well as and therefore click the ‘OK’ button.
Now, click on the Capture push clit inwards the file bill of fare to halt the electrical flow real-time describe every bit shown:
Note: It is advisable to filter approximately events from the describe that are non required inwards analyzing reboot as well as logon as well as cut the describe to real small-scale size. Mentioned below is the procedure to filter out the unwanted events.
On the ProcMon icon bar de-select the next categories of events:
- Show Network Events
- Show File System Activity
- Show Registry Activity
Now, click on the “Filter” selection from the ProcMon bill of fare as well as and therefore click on the bill of fare “Drop Filtered Events”.
In monastic enjoin to start tracing click “Options” on the Process Monitor menu. Then click on “Enable Boot Logging” to enable the Process Monitor kick logging till the tracing is stopped.
A dialog box stating “Enable Boot Logging “ volition seem alongside the selection to “Generate Thread Profiling Events”. Click exclusively on OK push clit as well as avoid clicking other options to enable kick logging on the subsequent reboot every bit shown below.
Now unopen the Process monitor as well as restart the computer.
If you lot wishing to relieve the disk space, as well as therefore log on i time your organisation initiates, Now, start the Process Monitor as well as halt it. Save the trace. This volition ensure that an excessive amount of disk infinite is non consumed.
So, this was most how nosotros tin tape the describe using Process Monitor. Now, allow us run into how to analyze this trace.
Read: Freeware to mensurate Boot or Startup Time inwards Windows.
How to analyze the reboot cycle describe alongside Process Monitor
- Once the organisation starts, logon as well as start the Sysinternals’ Process Monitor.
- Now reset the filter every bit mentioned to a higher house as well as click Ok.
- A dialog box volition enquire you lot to relieve the electrical flow trace. Save the describe inwards a folder.
- Now, this kick describe volition endure available as well as fifty-fifty displayed inwards Process Monitor.
- Next, click on “Tools” as well as and therefore on “Process Tree”.
- Here, click on “Idle” the start item inwards the leftmost column as well as popular off on the banking concern notation of the fourth dimension on the clock.
- Again click on “Tools” as well as and therefore on “Process Tree”. Look for the selection “Logonui.exe” inwards the leftmost as well as click on it spell noting the clock fourth dimension every bit shown below.
The departure betwixt both the noted fourth dimension that is betwixt Idle fourth dimension as well as Logonui.exe fourth dimension is the fourth dimension gap betwixt calculator startup as well as logon credentials.
Above was an explanation of how reboot cycle fourth dimension is evaluated alongside Process Monitor. Now, let's empathise the significance of Userinit.exe.
‘Userinit.exe is the procedure that is launched if the user’s credentials are verified, as well as initiates the subsequent chain of events leading to the user’s trounce starting, desktop starting, as well as the of import marking “desktop laid to use”. The ‘Userinit.exe’ procedure should endure relatively unopen but under’ the previously noted procedure ‘Logonui.exe. Note the clock fourth dimension for starting of the ‘Userinit.exe’ process. The departure inwards clock fourth dimension betwixt starting of ‘Userinit.exe’ as well as ‘Procmon.exe’ is roughly that exceptional user's overall logon time.
It is quite tardily to mensurate respective times using Process monitor.
Process Monitor uses simply 8KB or 8192 bytes to monitor the reboot time. Also, its powerful filtering capability requires simply “”process start” events to endure collected. Thus overall logon as well as reboot describe statistics are non affected yesteryear the describe capture.
This is i of the special features of Process Monitor that makes it outstanding from all other tools designed for the same purpose.
Other features
- Process Monitor allows you lot to capture information according to your parameters. This characteristic is non available alongside other tools.
- Previously collected information remains alongside you lot fifty-fifty later novel queries.
- By capturing as well as analyzing thread stacks for each operation, you lot tin break the rootage cause
- Process details include ikon path, ascendance line, user as well as session ID
- Columns are configurable – They tin endure moved, hidden or shown
- Extensive filters for whatsoever information field
- Process tree shows the human relationship of all processes inwards a trace.
- Possibility to cancel search
- Boot fourth dimension logging for all operations
- Advanced logging architecture scales to tens of millions of captured events as well as gigabytes of log data
- Ability to relieve native log format information for utilisation inwards dissimilar Process Monitor instances
Click on Tools to select from the other laid of useful tabs similar System details, Process Activity Summary, File Summary, Registry Summary as well as more.
Refer the screenshots for reference.
You tin also run into the Process action summary.
The exclusively drawback of Process Monitor is that it is a chip complicated for the novice user to use. Most users may break it challenging to utilisation the tool as well as may receive got to invest fourth dimension inwards agreement how it works.
IT experts, Systems admins or applied scientific discipline geeks are best suited to utilize the features of Process Manager.
To download Process Monitor watch docs.microsoft.com. For to a greater extent than details watch TechNet.
Source: https://www.thewindowsclub.com/
comment 0 Comments
more_vert