Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Process Explorer can show currently running processes and also can show the command line each process was started with. Is there a tool that can capture a trace of processes that were started and finished while the tool is running with the respective command lines?

share|improve this question
add comment

1 Answer

up vote 4 down vote accepted

Process Monitor, also from SysInternals can do that:

http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

By default, the command line isn't shown, but if you right-click on the column headers and click on "Select Columns", you can add "Command Line" to the list of displayed columns.

Edit: If you haven't ever used Process Monitor before, it generates a lot of information. But, if you're looking for a particular *.exe or something, you can specify various filters so that you only get what you're looking for.

For example, if you wanted to just show the information for any cmd.exe processes, you can click on the filter button (Ctrl-L), and add a filter like this:

enter image description here

This is what needs to be selected to filter out process start / process exit operations you are after:

enter image description here

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.