Process Monitor for SHUTDOWN logging

2019-10-11

Question

_{Friday, October 11, 2019 2:16 PM}

hi all,

in this thread Robert Smith, PFE, explains how to use sysinternals' PROCESS MONITOR for boot logging.

Well I have some hanging clients, who stay in the LOGGING OFF Screen forever and like to check this.

Is PROC MON logging shutdown events as well or just at reboot?

How would a forced shutdown (power button 4 sec) appear in the PROC MON ?

All replies (3)

_{Friday, October 11, 2019 2:25 PM}

you can use Windows Perrromance Recorders "Shutdown" scenario:
Windows Performance Recorder

_{Monday, October 14, 2019 3:10 AM}

Hi,

Please use the following method to collect shudown process by procmon:

1. Download PsExec tool from the following website:

https://docs.microsoft.com/en-us/sysinternals/downloads/psexec

2. Open CMD as an administrator and run: PsExec.exe -s cmd
3. Then convert to the folder of process monitor, like (cd C:\mstrace) , run the following command and shutdown the server:
procmon /backingfile C:\mstrace\logfile.pml /NoFilter /AcceptEula /Minimized /Quiet
4. The .pml logs will generated under C:\mstrace folder.

Best regards,

Yilia

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected].

_{Friday, October 18, 2019 8:35 AM}

Hi,

Is there anything I can do for you?

If you have any problems or concerns, please feel free to post here.