What's New in version 3.82:

  • This update to Process Monitor fixes 'go to event' from context menu and introduces some UI improvements for the dark theme.

What's New in version 3.80:

  • Process Monitor is the latest tool to integrate with the new Sysinternals theme engine, giving it dark mode support.

What's New in version 3.70:

  • This update to Process Monitor allows constraining the number of events based on a requested number minutes and/or size of the events data, so that older events are dropped if necessary. It also fixes a bug where the Drop Filtered Events option wasn't always respected and contains other minor bug fixes and improvements.

What's New in version 3.60:

  • Adds support for multiple filter item selection, as well as decoding for new file system control operations and error status codes.

What's New in version 3.2:

  • Adds an option to show all file system values in hexadecimal, adds additional error code and file system control strings, and fixes a bug that prevented boot capture on Windows 10.

What's new in version 3.11:

  • This update to Process Monitor, an interactive system activity monitoring utility, fixes a bug that could cause a crash in the stack summary dialog and a bug that could prevent boot monitoring from working on Windows 10.

What's new in version 3.1:

  • This release adds registry create file disposition (create vs open) and a new switch, /saveapplyfilter, which has Process Monitor apply the current filter to the output file as it saves it.

What's new in version 3.04:

  • now includes support for new Windows 8 file information query types and fixes a bug in the tooltip handling.

What's new in version 3.02:

  • This release fixes an external logging issue that prevented certain registry paths from display correctly when run with App-V and fixes a bug in the save logic.

What's New in version 3.01:

  • This update to Process Monitor, a real-time file, registry, process and network monitor, adds decoding of several new Windows 8 file system control codes, including offload read and write, and now obtains image version information for 32-bit DLLs when run on 64-bit Windows.

What's new in version 2.96:

  • This release changes the appearance of its tooltips to the default theme, fixes a drawing bug in the treeview, and updates the graphs to match the style introduced in Process Explorer v15.

What's New in version 2.95:

  • This update to Process Monitor reports the write-through flag on file I/O, shows DLL version information on the process page of the event properties dialog, automatically launches the correct version of Process Monitor to match the bitness (32 or 64) of a logfile, and fixes several bugs.

What's New in version 2.94:

  • This release adds names for additional file system control codes, error values, and adds a copy-to-clipboard entry to the item context-menu.

What's New in version 2.93:

  • This fixes a bug related to volume object ID formatting and enables the before/after exclude quick filter on entries that don't have a path.

What's New in version 2.92:

  • This update adds a toolbar button that makes the process tree dialog more accessible. In order to make it easy to zoom in on a particular time range in a trace, it also introduces two quick-filter context menu items that enable you to filter out events before or after a selected event.

What's New in version 2.91:

  • This update to Process Monitor makes it easy to configure process filters from the process tree dialog with the addition of two buttons, one that sets a filter for the selected process and another that sets a filter for the selected process and its descendants.

What's New in version 2.9:

  • This update to Process Monitor adds translations for more error codes, the ability to disable individual filter entries, and a debugging API so that developers can insert debug output into the Process Monitor event stream (John Robbins has implemented helper classes for generating process monitor debug output from native and managed applications).

What's New in version 2.8:

  • Displays new Windows 7 CreateFile options, includes file-delete operations in the Category filter's Write subcategory, and displays names for more IOCTLs and result codes.