'Process Monitor' has a max history depth of 199 million events. I need to record about 10 times this. I don't mind if the data is split, e.g. a new data set for every hour. Anyone know how to do it? I'm guessing a batch file, with backing files going to sequentially named folders. Is there a way of detecting once Process Monitor has filled its history depth to kill it, or do I just need to sleep?
closed as not constructive by mdpc, RolandoMySQLDBA, Michael Hampton♦, Dave M, Ward Mar 27 '13 at 1:53
As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.
Yes, you're going to have to script it. I've done some similar work with Procmon like this before, but my aim was nothing like to capture billions of events. Nevertheless, this should help you, unless you needed someone to write the script for you:
Create a VBscript that runs every 5 minutes. Task Scheduler can help you with that.
If this is the first time the script has run, then start Procmon like so:
Then on subsequent runs of the script, measure the total size of all the *.pml files in the subDir.
That isn't specifically tailored to your situation. You'll have to tweak it. That's something I wrote a long time ago for a slightly different purpose. What you want to do is if the size of all the *.pml files in the subdirectory added together has not increased since the last time the script ran... then you know it's time to terminate Procmon and start a new instance.
The point is that you have to terminate Procmon gracefully with the /terminate parameter, not just kill the process, or else the log will be corrupt and unreadable.
Then start a new instance of procmon in a new subDir. Creativity will have you creating subdirectories with incremental names like subdir1, subdir2, subdir3, etc.
Edit: Also, I've never run Procmon to 200 million events before, so I don't know if it just sits there and does nothing after reaching 199 million, or if it completely shuts down. If the latter is the case, then your job is easier. Just check if Procmon.exe is still running. If it's not, then you know it's time to fire it up again under a new subdirectory.
Edit: Yeah I think it just starts rolling once it hits the history depth... so do the file size thing.