Process Monitor: The Evolution of RegMon and FileMon
For system administrators and power users, monitoring the inner workings of an operating system is essential for troubleshooting and forensics. One of the most powerful toolsets for this purpose emerged from the collaboration of Mark Russinovich and Bryce Cogswell. Originally developed while they were at NuMega Technologies and later Sysinternals, their work laid the foundation for what would become a staple in the Windows diagnostic toolkit.
The Origins of System Monitoring
Before the unified experience of modern monitoring tools, Sysinternals offered two distinct utilities: FileMon and RegMon. These tools were designed to provide deep visibility into how applications interacted with the core components of the Microsoft Windows environment.
FileMon
FileMon, a portmanteau of "File" and "Monitor," was a free utility compatible with both 32-bit and 64-bit Windows operating systems. It provided users with a powerful mechanism to monitor and display real-time file system activity, allowing technicians to see exactly which files were being accessed or modified by specific processes.
RegMon
While FileMon handled the file system, RegMon focused on the Windows Registry—the hierarchical database that stores low-level settings for the Microsoft Windows operating system and applications. RegMon provided critical forensics on Registry usage, helping users track changes and queries made to system configuration keys.
[ไม่มีภาพประกอบ]
The Transition to Process Monitor
To streamline the diagnostic process, FileMon and RegMon were eventually combined into a single, comprehensive application known as Process Monitor (often abbreviated as ProcMon). This integration allowed users to track file system, Registry, and process activity simultaneously in one interface.
The software's compatibility has evolved alongside the operating systems it monitors. Early versions of Process Monitor (up to version 2.8) were compatible with Windows 2000 SP4 with Update Rollup 1. However, the current version of the software is designed exclusively for Windows Vista and newer versions.
Expanding Beyond Windows
For many years, ProcMon was available exclusively for Microsoft Windows. This changed in November 2018 when Microsoft confirmed that it was porting several Sysinternals tools, including ProcMon and ProcDump, to Linux.
Unlike its Windows counterpart, the Linux port of Process Monitor is open source. It is released under the MIT License, and its source code is publicly available on GitHub, allowing the community to contribute to its development.
Key Facts
- Creators: Developed by Mark Russinovich and Bryce Cogswell.
- Acquisition: Sysinternals was acquired by Microsoft in 2006.
- Legacy Tools: FileMon and RegMon are no longer supported.
- Current Status: FileMon and RegMon were merged to create Process Monitor.
- Linux Availability: A Linux port exists as an open-source project under the MIT License.
| Tool | Primary Function | Current Status | Platform |
|---|---|---|---|
| FileMon | File system activity monitoring | Unsupported | Windows (32/64-bit) |
| RegMon | Windows Registry forensics | Unsupported | Windows |
| Process Monitor | Combined File, Registry, and Process monitoring | Active | Windows Vista+ / Linux |
Frequently Asked Questions
What happened to FileMon and RegMon?
FileMon and RegMon are no longer supported as standalone utilities. They were merged into a single, more powerful tool called Process Monitor.
Who created these tools?
The tools were primarily created by Mark Russinovich and Bryce Cogswell during their time at NuMega Technologies and Sysinternals.
Can I use Process Monitor on Linux?
Yes. Microsoft began porting Sysinternals tools to Linux in 2018. The Linux version of ProcMon is open source and available on GitHub.
What is the licensing for the Linux version of ProcMon?
The Linux port of Process Monitor is licensed under the MIT License.
Which Windows versions are supported by the current Process Monitor?
The current version of Process Monitor runs on Windows Vista and all subsequent versions of Windows.