Process Monitor是Windows的進階監視工具，可顯示實時檔案系統，註冊表和程式/執行緒活動。
它結合了兩個舊的Sysinternals實用程式Filemon和Regmon的功能，並加入了廣泛的增強功能清單。
內含豐富的和非破壞性的過濾，全面的事件屬性（例如會話ID和使用者名），可靠的過程訊息，帶有整合符號的完整執行緒堆疊支援每個操作，同時記錄到檔案等。
它獨特的強大功能將使Process Monitor成為您的系統故障排除和惡意軟體搜尋工具包中的核心實用程式。
【程式監視器】Process Monitor 3.61 功能概述：
Process Monitor具有強大的監視和過濾功能，其中內含：
為操作輸入和輸出參數捕獲更多資料
無損過濾器使您可以設定過濾器而不會丟失資料
捕獲每個操作的執行緒堆疊在許多情況下都可以確定操作的根本原因
可靠地捕獲過程詳細訊息，內含圖像路徑，指令行，使用者和會話ID
任何事件屬性的可配置和抽取式列
可以為任何資料欄位設定過濾器，內含未配置為列的欄位
先進的日誌記錄體系結構可延伸到數千萬個捕獲的事件和數千兆位元組的日誌資料
程式樹工具顯示追蹤中引用的所有程式的關係
本機日誌格式保留所有資料以供加載到不同的Process Monitor案例中
過程工具提示，可輕鬆檢視過程圖像訊息
詳細訊息工具提示可方便地訪問列中不適合的格式化資料
可取消的搜尋
所有操作的啟動時間記錄
熟悉Process Monitor功能的最好方法是通讀說明檔案，然後訪問實時系統上的每個選單項和選項。
【程式監視器】Process Monitor 3.61 官網下載：
https://docs.microsoft.com/en-us/sysinternals/downloads/procmon
Introduction
Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity. It combines the features of two legacy Sysinternals utilities, Filemon and Regmon, and adds an extensive list of enhancements including rich and non-destructive filtering, comprehensive event properties such as session IDs and user names, reliable process information, full thread stacks with integrated symbol support for each operation, simultaneous logging to a file, and much more. Its uniquely powerful features will make Process Monitor a core utility in your system troubleshooting and malware hunting toolkit.
Overview of Process Monitor Capabilities
Process Monitor includes powerful monitoring and filtering capabilities, including:
More data captured for operation input and output parameters
Non-destructive filters allow you to set filters without losing data
Capture of thread stacks for each operation make it possible in many cases to identify the root cause of an operation
Reliable capture of process details, including image path, command line, user and session ID
Configurable and moveable columns for any event property
Filters can be set for any data field, including fields not configured as columns
Advanced logging architecture scales to tens of millions of captured events and gigabytes of log data
Process tree tool shows relationship of all processes referenced in a trace
Native log format preserves all data for loading in a different Process Monitor instance
Process tooltip for easy viewing of process image information
Detail tooltip allows convenient access to formatted data that doesn’t fit in the column
Cancellable search
Boot time logging of all operations
The best way to become familiar with Process Monitor’s features is to read through the help file and then visit each of its menu items and options on a live system.