Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Process Explorer can show currently running processes and also can show the command line each process was started with. Is there a tool that can capture a trace of processes that were started and finished while the tool is running with the respective command lines?

share|improve this question
up vote 4 down vote accepted

Process Monitor, also from SysInternals can do that:

By default, the command line isn't shown, but if you right-click on the column headers and click on "Select Columns", you can add "Command Line" to the list of displayed columns.

Edit: If you haven't ever used Process Monitor before, it generates a lot of information. But, if you're looking for a particular *.exe or something, you can specify various filters so that you only get what you're looking for.

For example, if you wanted to just show the information for any cmd.exe processes, you can click on the filter button (Ctrl-L), and add a filter like this:

enter image description here

This is what needs to be selected to filter out process start / process exit operations you are after:

enter image description here

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.