Showing results for 
Show  only  | Search instead for 
Did you mean: 
IMPORTANT: Currently some Knowledge Base content may be unavailable. We are working diligently to restore these articles and appreciate your patience.

How to Collect a low Altitude Procmon Capture

How to Collect a low Altitude Procmon Capture


Microsoft Windows: All Supported Versions


To collect a low altitude Process Monitor (ProcMon) capture.


  1. Download and extract Process Monitor from the attached .zip file
  2. Open Procmon
  3. On keyboard, press "Ctrl+E" to stop capturing events (or navigate to File > Capture Events and uncheck it)
  4. On keyboard, press "Ctrl+X" to clear any events (or click the eraser icon)
  5. Navigate to Options > Profiling Events > Select Generate profiling events every 100 milliseconds.
  6. On keyboard, press "Ctrl+E" to start capturing events
  7. Reproduce issue
    • Capture a maximum of 10 minutes of events

  8. On keyboard, press "Ctrl+E" to stop capturing events
  9. On keyboard, press "Ctrl+S"
  10. Save "All Events" in the "Native Process Monitor Format (.PML)"
  11. Compress the .PML file into a .zip file.
  12. Upload the .zip to
  13. Once the upload completes, please comment on your case that the data is available for review.

Was this article helpful? Yes No
100% helpful (1/1)
Article Information
Creation Date: