Author: funkatron3000
Subject: Long-running procmon traces
Posted: 10 March 2014 at 8:10pm
Hello. I've been experimenting with long-running procmon traces and was looking for some advice.
I'm trying to track down an intermittent hang on a remote PC and was hoping to use procmon. I have procmon configured to:
Subject: Long-running procmon traces
Posted: 10 March 2014 at 8:10pm
Hello. I've been experimenting with long-running procmon traces and was looking for some advice.
I'm trying to track down an intermittent hang on a remote PC and was hoping to use procmon. I have procmon configured to:
- write log files to disk (backing file instead of virtual memory)
- filter out stuff I'm not interested in (primarily anti-virus)
- drop filtered events
- a history depth of 10 million events (reducing hard drive space usage and recording the most recent 10-15 minutes worth of events)
Things go great for about an hour or so. Procmon writes new log files to disk and deletes old ones. After a few hours though the old log files are not being deleted and begin to accumulate. Although the files are still visible the disk usage remains consistent with the space necessary to store ~10 million events. However, system performance declines and procmon sometimes locks up.
I'd appreciate any insights anyone has on successfully running procmon for long periods. Thanks!