Skip to content

procmon deletes backing files #126

@bauermww

Description

@bauermww

I start procmon with/Backingfile output.pml.
Start-Process -FilePath "procmon.exe" -ArgumentList "/Quiet /Minimized /Backingfile output.pml /LoadConfig ProcessMonitorPmcFile.pmc" -Verbose

It starts to create output.pml, output-1.pml up to output-21.pml
After a while the files output.pml, output-1.pml up to output-5.pml are deleted.
But this call is working
Start-Process -FilePath "procmon.exe" -ArgumentList "/OpenLog output.pml /SaveApplyFilter /SaveAs temp_output.csv" -Wait -Verbose
But the file output.pml does not exist anymore.

My question, will i miss any captured events?

I have 600 GByte free disk space.

procmon version 4.1.0.0

This is the ProcessMonitorPmcFile.pmc file:
ProcessMonitorPmcFile.txt

Enable ring buffer is disabled

Settings are both grayed out

Image

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions