I am trying to track CPU usage of our build script and of all the processes it spawns to accomplish the task of creating a release. I ran a procmon64.exe (with profiling) session during the course of a successful release build and saved the resulting .pml file. I later started procmon /noconnect and loaded the .pml file to do analysis.

In the tools menu, I select the process tree and find the initial invocation of powershell.exe that runs our script. With that parent process selected, I add it and all its child process PID's to the filter. Thus I have a filter that consists exclusively of a list of PID includes.

This all works fine and the filtered process events are exactly the selection I expect and want. Now I want to know (and log) the total CPU time spent by each process. In the Tools menu, I select Process Activity Summary. I think this is intended to give a summary of various process activity statistics, for all "processes generating events during trace" that are selected by the filter. Except it doesn't. Of 170 PIDs in the filter, it shows summaries for only 6. It seems the only PIDs for which it will generate a summary are those which were still running when procmon was closed, i.e. those with no "exited" time.

What can I do to get summaries of all the processes I am filtering for?

  • When you click the "Include Subtree" button in the Process Tree dialog, do all 170 PID's actually get written to the current filter? Do you then click the "Apply" button in the filter dialog?
    – kreemoweet
    Aug 13 at 5:17
  • Yes and yes. The filter is also now saved for later application. There is no issue with the filtering: "the filtered process events are exactly the selection I expect and want". From the filtered events, for the Process Activity Summary, it chooses exactly those processes which were still alive at the end of the monitoring session, that is clear. The issue is, why? And how do I change that? Aug 13 at 16:53

1 Answer 1


The following is not a proper answer, but is a work-around. With the processes and events you want filtered, use the Save function in the file menu, and in the Events to save: selection, choose Events displayed using current filter (and then also your choice ragarding the Also include profiling events option). Save to a PML format file. You have thus saved a file with only the events and processes you are interested in. Exit Procmon, and restart it using procmon /accepteula /noconnect /quiet /nofilter. Then load the .pml file you just saved (file menu, open). With no filtering, and only the processes and events you want thusly loaded, choosing Process Activity Summary under the Tools menu will now show and save all processes, not just those still running at the end of the session.

If anyone knows a better solution, please post...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.