CB Connect 2020 early-bird discount pricing expires on January 31. Learn more and reserve your spot today!
Showing results for 
Search instead for 
Did you mean: 

How to Collect a low Altitude Procmon Capture

How to Collect a low Altitude Procmon Capture


Microsoft Windows: All Supported Versions


To collect a low altitude Process Monitor (ProcMon) capture.


  1. Download and extract Process Monitor from the attached .zip file
  2. Open Procmon
  3. On keyboard, press "Ctrl+E" to stop capturing events (or navigate to File > Capture Events and uncheck it)
  4. On keyboard, press "Ctrl+X" to clear any events (or click the eraser icon)
  5. Navigate to Options > Profiling Events > Select Generate profiling events every 100 milliseconds.
  6. On keyboard, press "Ctrl+E" to start capturing events
  7. Reproduce issue
    • Capture a maximum of 10 minutes of events

  8. On keyboard, press "Ctrl+E" to stop capturing events
  9. On keyboard, press "Ctrl+S"
  10. Save "All Events" in the "Native Process Monitor Format (.PML)"
  11. Compress the .PML file into a .zip file.
  12. Upload the .zip to https://community.carbonblack.com/groups/cb-vault
  13. Once the upload completes, please comment on your case that the data is available for review.

Was this article helpful? Yes No
No ratings
Article Information
Creation Date: