How to debug Windows applications with Process Monitor

Do you have Windows 10 apps that aren't working as expected? Maybe it's too slow, crashes all of a sudden, or has loads of hard-to-identify problems. One way to get to the root of the problem is to use a free official Microsoft utility called Process Monitor. This tool will help you diagnose and debug any Windows application errors or problems.

Download and install Process Monitor

The SysInternals Process Monitor (ProcMon) utility has been around since 2006 and does much more than diagnose application problems. It provides the ability to view all registry keys, file system locations, and network traffic. However, it does not capture mouse pointer movements or hardware-related changes. If your goal is to catch malware, identify troubled applications, or get a high-level overview of your Windows PC, then ProcMon is the most advanced tool to have.

• Download Process Monitor

There is no need for installation, but you must accept the SysInternals software license terms before running the.exe file. Let Process Monitor list all the events on your Windows system. Any running programs are automatically included in the analysis.

Diagnose problems with Windows Process Monitor

When the program lists detailed information, you can be overwhelmed to see so many rows and columns. There are millions of entries. You don't have to take care of everything; just pay attention to the following:

• Process name
• Process ID (PID): A four or five-digit number
• File path
• Result code: “Success” or more entries such as “name not found”, “Reparse”, etc.

To quickly jump to troubled apps, go to Tools > Process Tree.

Go to Tools > Process Tree

The dashboard will have all the applications open and running on your system. A complete green block in the "Life Time" column usually indicates there is no problem in the relevant application. If Windows 10 programs and systems are updated, many registry errors and file health problems won't cause any trouble. For updating-related matters, you can use another utility called SetUpDiag.

The green block in the “Life Time” column indicates there is no problem in the related app

Scroll down to the problematic event and click "Go to Event" to navigate to the issue. In the next screen, ProcMon diagnoses many problems with Tencent's QQ Browser. A process ID ("3428") can be identified by its.exe file. Once the problem source is identified, you need to use an option called "Filters". By right-clicking and adding the "Include" filter to a specific executable, you focus only on a specific application and then apply the filter. Depending on the number of entries, it may take some time. There are already thousands of entries in this filter. You can also exclude certain results like “Success” or “Buffer Overflow”, as they indicate the application is not crashing. This will narrow the search even further. Now, focus on the most common result code for the troubled application. The "Name not found" problem is the most common here, with thousands of entries, meaning the caller tried to open an object that doesn't exist. In other words, the installation itself went wrong. Thus, you have diagnosed the root of the problem.

The “Name not found” problem is the most common phenomenon

Final Troubleshooting

Here, the article will show the final troubleshooting for the above program. Before addressing a diagnosed issue that requires uninstallation, you may want to save the ProcMon file from File > Save so you can look into related issues in the future. Saving the file also gives you the filter presets you just created. If you want to go back to the default settings, click Reset. As shown here, the program needs to be uninstalled because many DLL files are missing. Uninstalling a program is not always easy, so ProcMon has a right-click option called “Search online”. It leads to the Uninstall screen.

Uninstall screen

The program was completely removed after clicking the uninstaller.

Clicking on the uninstaller removed the program completely

The uninstall step is a nuclear option (the "extreme" option), but it works with programs that have too many file-missing problems. When reopening ProcMon with the same filter presets, the problem with Tencent's QQ Browser disappeared. You can use Windows Process Monitor to diagnose Windows application errors and resolve problems. It only takes a little effort to locate the main source of the problem. If your Windows is experiencing 100% CPU usage errors, see the solutions here to fix it. Thewindowsfan.com also provides solutions for incorrect system configuration information.

Source: https://thewindowsfan.com/how-to-debug-windows-applications-with-process-monitor/