Overview

Microsoft have a tool called ProcMon which can see all the file system, network and registry access on a machine running the Windows operating system.

The issue with running this tool is that it can severely consume resources on the machine it is running on. Ideagen does not advise leaving it running a moment longer than necessary and never run it on a live production machine except on the explicit instructions of Ideagen support.

Downloading the tool

The link below is a direct download:

http://live.sysinternals.com/procmon.exe

The main page for the application is here:

http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

Download the application and make sure it is on the user's computer who is experiencing the challenges but do not run it yet.

Guide to using ProMon

The Ultimate Guide to Procmon (adamtheautomator.com)

Using ProcMon for Mail Manager processes or collections

In the example below we will be analyzing Mail Manager process which are what run in the background of Outlook for Mail Manager to work. Outlook will spawn processes when started up.

First, ensure that Outlook is not running

Running ProcMon

This needs to be run as an Administrator user to be sure it can access everything.

When ProcMon runs for the first time it will pop-up a license agreement. Acknowledge this and the screen below will appear. If you have run it before then ProcMon still start showing events so hit the button to stop logging.

Monitoring Mail Manager processes

if you wish to monitor the Mail Manager processes, change the drop down that contains the word “Architecture” to read “Process Name” and make sure it looks like the screenshot below with contains and mailmanager entered. Note that your list of items to exclude may appear different to the screenshots as it is dependent on your environment.

Hit add to add the new filter

Monitoring Mail Manager Collection file access

If you wish to monitor mail manager collection file access you, change the drop down that contains the word “Architecture” to read “Path” and make sure it looks like the screenshot below with contains and mmcollection entered. Note that your list of items to exclude may appear different to the screenshots as it is dependent on your environment.

Hit add to add the new filter

Hit “OK” to use whichever filter you are adding here. You may or may not see items appear in the main window as this depends on the state of procmon.

Hit the button to stop logging so it looks like this:

Hit the eraser button on the toolbar to clear the log:

If the challenge occurs whilst using Mail Manager to a certain task in, then you would now load up Outlook and do everything required up to the point just before you see the error or challenge you want to trace. If this challenge occurs in just using Mail Manager at all, or during the startup of it, then wait before starting Outlook.

Go back into procmon and hit to start the tracing.

Execute the action or start Outlook, if needed, and check in procmon that the system is logging like the screenshot below:

Once the action in Mail Manager is complete, which if this is during Mail Manager startup then you may need to wait until the Mail Manager buttons light up, assuming they do light up if you wait a short period as this should capture all of that. So once that action is done, stop the ProcMon trace by doing this:

Hit the button to stop logging so it looks like this:

Now follow the section "Sending the results to Support" to send the log so it can be analysed.

Sending the results to Support

With ProcMon still running hit File/Save to save the capture to a PML file

Accept the defaults and save the file.

Now find the file you just saved and zip it up.  

As this file will be likely be too large to email to Support, you may need to use the customer upload facility at https://dropoff.ideagen.com

Once the upload is complete inform Support of this ,so that we know to look for this and the assigned engineer will download the file and examine the ProcMon trace.