Collect a Procmon Capture
search cancel

Collect a Procmon Capture

book

Article ID: 285280

calendar_today

Updated On:

Products

Carbon Black App Control Carbon Black Cloud Audit and Remediation Carbon Black Cloud Endpoint Standard Carbon Black Cloud Enterprise EDR Carbon Black Cloud Workload Carbon Black EDR Endpoint Protection Endpoint Security Endpoint Security Complete CBX Complete CBX Essentials

Issue/Introduction

Instructions on how to collect a Process Monitor (Procmon) capture.

Environment

  • All Products
  • Microsoft Windows: All Supported Versions

Resolution

Standard Procmon:

  1. Download and extract Process Monitor from Microsoft.
  2. Temporarily disable Tamper Protection on any applicable applications in order to properly access stack information.
  3. Launch Procmon and configure the capture as follows:
    • Press CTRL+E to stop the current capture.
    • Press CTRL+X to clear the current results.
    • Filter > Filter > Click Reset and uncheck Process Name > is System > OK
    • Options > Profiling Events > Generate thread profiling events > Every 100 milliseconds > OK
  4. Start the capture (CTRL+E) when ready to reproduce
  5. After reproduction, stop the capture (Ctrl+E).
  6. Use File > Save and use the following options:
    • Events to save: All events
    • Format: Native Process Monitor Format (PML)
  7. Compress the PML and upload to Support.

Boot Procmon:

  1. Download and extract Process Monitor from Microsoft.
  2. Launch Procmon and configure the capture as follows:
    • Press CTRL+E to stop the current capture.
    • Press CTRL+X to clear the current results.
    • Filter > Filter > Click Reset and uncheck Process Name > is System > OK
    • Options > Profiling Events > Generate thread profiling events > Every 100 milliseconds > OK
    • Options > Enable Boot Logging
  3. Click OK and reboot the endpoint.
  4. After the reboot, open Process Monitor once more.
  5. When prompted, click Yes to save the boot-time activity as a PML (Ex: Laptop1-bootlog.pml)
  6. Close Process Monitor, and open the PML created to verify it loads without errors.
  7. Compress the PML and upload to Support.

Circular Logging:

  1. Download and extract Process Monitor from Microsoft.
  2. Launch Procmon and stop the current capture.
  3. Choose: Options > History Depth...
    1. Enable Limit to and specify a size between 200 MB and 500 MB (ex: 300 MB)
    2. Click OK
  4. Choose: File > Backing Files...
    1. Enable Use file named and specify a path (ex: C:\Temp\LogFile.pml)
    2. Click OK
  5. Start the capture and reproduce the issue.
  6. Once the capture is complete, compress all files in the path chosen (LogFile-1.pml, LogFile-2.pml, etc....) and provide to Support.

Configure Procmon for Low Altitude:

  1. Download Process Monitor > https://learn.microsoft.com/en-us/sysinternals/downloads/procmon
  2. Unzip the downloaded file.
  3. Open an administrative command prompt and navigate to the location of the unzipped files.
  4. Run the command:
    fltmc

    Example Result:

    Filter Name                     Num Instances    Altitude    Frame
 ------------------------------  -------------  ------------  -----
 bindflt                                 1       409800         0
 UCPD                                    3       385250.5       0
 BHDrvx64                                3       365100         0
 SymEvnt                                 3       365090         0
 eeCtrl                                  2       329010         0
 SRTSP                                   3       329000         0
 vsepflt                                 3       328200         0
 SymEFASI                                3       260610         0
 storqosflt                              0       244000         0
 wcifs                                   0       189900         0
 CldFlt                                  0       180451         0
 bfs                                     5       150000         0
 FileCrypt                               0       141100         0
 luafv                                   1       135000         0
 UnionFS                                 0       130850         0
 npsvctrig                               1        46000         0
 Wof                                     1        40700         0
 FileInfo                                3        40500         0
  5. Review Results:
    • Locate and note the lowest altitude number in the Altitude column.
    • If PROCMON24 appears in the fltmc output, you must reboot the machine to unload the driver before proceeding.
  6. Run Procmon with the /Altitude flag using a number lower than the altitude identified. Example:
    Procmon.exe /Altitude 40000
  7. When the Process Monitor Filter pop-up window is shown, click the Reset button, then Apply and OK.
  8. In the File menu, press Ctrl-E, then Ctrl-X to stop the capture and clear the display.
  9. In the Filter menu, ensure "Enable Advanced Output" is checked.
  10. Press Ctrl-E to start capturing.
  11. Capture the issue for a minute or two, return to the Procmon window and press Ctrl-E to stop capturing.
  12. Press Ctrl-S and save all events in the Native Process Monitor Format (PML).
  13. When saved, navigate to the save location, select and right-click the PML file, then select the Send to > Compressed (zipped) folder menu option to compress it.
Powered by Wolken Software