Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I know process monitor has the "enable boot logging" function.

but that only takes effect for next boot.

is there a way to enable boot logging for every boot in the future?

share|improve this question
    
Boot logging is intended for troubleshooting and should not be enabled by default. Even more since the logging will continue until the program is started the next time (i.e. you would be logging everything from boot to shutdown). What problem are you trying to solve by this? –  Ansgar Wiechers Nov 8 '12 at 9:42
    
every several days I find the entry containing "www.google.com" gone from my hosts file, which is very annoying. I need to monitor the file for several days(probably a week) to find out which program did it. –  David Dai Nov 8 '12 at 10:02
    
@DavidDai why not set "read only" attribute on the hosts file? –  Moab Nov 8 '12 at 15:16
    
of course I can do that. but I just want to find out the black hand behind this. :( –  David Dai Nov 9 '12 at 1:59
add comment

1 Answer

I'm not aware of a regular way to permanently enable boot logging, but it seems that boot logging is controlled by two registry values in the Procmon driver configuration. Perhaps (re-)creating these values (e.g. with a startup script) will do what you want:

if not exist %SystemRoot%\System32\Drivers\PROCMON23.sys copy PROCMON23.sys %SystemRoot%\System32\Drivers\
reg add HKLM\SYSTEM\CurrentControlSet\services\PROCMON23 /v ImagePath /t REG_SZ /d "System32\Drivers\PROCMON23.sys" /f
reg add HKLM\SYSTEM\CurrentControlSet\services\PROCMON23 /v Start /t REG_DWORD /d 0x0 /f
reg add HKLM\SYSTEM\CurrentControlSet\services\PROCMON23 /v Type /t REG_DWORD /d 0x1 /f

However, before trying something like that, I'd first try "regular" monitoring (without boot logging). Start Process Monitor once and configure it to monitor only access to the hosts file (Filter → Filter...). Export that configuration to the file C:\hosts.pmc (File → Export Configuration...). Then run something like this in a startup script:

procmon /LoadConfig C:\hosts.pmc /BackingFile C:\hosts_%DATE:/=-%.pml /Quiet > C:\hosts.log 2>&1

That will start Process Monitor with the exported configuration (/LoadConfig C:\hosts.pmc), start monitoring without prompting for confirmation of filter settings (/Quiet), and log the recorded events to a log file with the current date (/BackingFile C:\hosts_%DATE:/=-%.pml). The expression %DATE:/=-% produces the current date with forward slashes / replaced by hyphens -. If your date format is not MM/DD/YYYY you'll have to modify this expression accordingly.

Startup scripts can be configured in various ways (Run keys in the registry, scheduled tasks, group policies, ...). See the answers to this question on StackOverflow for an overview.

share|improve this answer
    
other than the registry keys, boot logging requires a file PROCMON23.sys in C:\Windows\System32\Drivers\. if I enable boot loging by using the menu, it does that. but I cannot move the file from Drivers to anywhere else. –  David Dai Nov 8 '12 at 13:27
    
With admin privileges you should be able to copy the file. Perhaps you could copy the backup copy back to the drivers directory if it doesn't exist, and then set the registry keys. But again, I recommend against trying this before you have tried everything else. –  Ansgar Wiechers Nov 8 '12 at 14:05
    
I couldn't back up PROCMON23.sys even with administrator.I left procmon running during last night and I have found the processes that ruin my hosts file. they are "system" and "svchost.exe", that is another question. Thanks anyway. –  David Dai Nov 9 '12 at 2:04
    
Make sure to copy PROCMON23.SYS into system32/drivers before manually adding the reg values. When using procmon GUI option it copy it into this directory and apply the reg values. when un checking this option it deletes it. If you want to do it manually, copy the sys file to this directory and apply the reg values your self. works ok. –  user195665 Feb 5 '13 at 11:23
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.