Scripting Process Monitor

Process Monitor

Scripting Process Monitor

You can use Process Monitor command-line options to drive it with a batch file. Here is how your batch file should look to capture a trace of notepad.exe's execution:

set PM=C:\sysint\procmon.exe start %PM% /quiet /minimized /backingfile C:\temp\notepad.pml
%PM% /waitforidle
start /wait notepad.exe
%PM% /terminate

The first invocation of Process Monitor using start ensures that the process detaches from the console window, which allows it to run concurrently with the later commands. The second invocation with /WaitForIdle causes the batch file to pause until the first instance is up and running and actively capturing events. The final invocation with /Terminate tells the first instance to stop capturing, commit any outstanding data to the backing file and exit cleanly.