cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
IMPORTANT: Currently some Knowledge Base content may be unavailable. We are working diligently to restore these articles and appreciate your patience.

How to Collect a low Altitude Procmon Capture

How to Collect a low Altitude Procmon Capture

Environment

Microsoft Windows: All Supported Versions

Objective

To collect a low altitude Process Monitor (ProcMon) capture.

Resolution

  1. Download and extract Process Monitor from the attached .zip file
  2. Open Procmon
  3. On keyboard, press "Ctrl+E" to stop capturing events (or navigate to File > Capture Events and uncheck it)
  4. On keyboard, press "Ctrl+X" to clear any events (or click the eraser icon)
  5. Navigate to Options > Profiling Events > Select Generate profiling events every 100 milliseconds.
  6. On keyboard, press "Ctrl+E" to start capturing events
  7. Reproduce issue
    • Capture a maximum of 10 minutes of events

  8. On keyboard, press "Ctrl+E" to stop capturing events
  9. On keyboard, press "Ctrl+S"
  10. Save "All Events" in the "Native Process Monitor Format (.PML)"
  11. Compress the .PML file into a .zip file.
  12. Upload the .zip to https://community.carbonblack.com/groups/cb-vault
  13. Once the upload completes, please comment on your case that the data is available for review.

Attachments
Was this article helpful? Yes No
100% helpful (1/1)
Article Information
Author:
Creation Date:
‎06-14-2016
Views:
6970