ProcMon Viewer

ProcMon Viewer is a read-only Visual Studio Code custom editor for Windows Process Monitor PML captures. It opens captures locally and never modifies the source PML files.

Prerequisites

Basic capture browsing requires Visual Studio Code 1.129 or later and a little-endian Process Monitor PML version 9 capture. Process Monitor is needed only to create captures on Windows; it does not need to be installed on the computer used for analysis.

LLVM for native symbols

Native function and source resolution requires LLVM 22 or later. Install LLVM, then restart VS Code so the extension can detect llvm-symbolizer and llvm-pdbutil in PATH or a standard installation location.

Windows (WinGet)

winget install --exact --id LLVM.LLVM
& "$env:ProgramFiles\LLVM\bin\llvm-symbolizer.exe" --version
& "$env:ProgramFiles\LLVM\bin\llvm-pdbutil.exe" --version

macOS (Homebrew)

brew install llvm
"$(brew --prefix llvm)/bin/llvm-symbolizer" --version
"$(brew --prefix llvm)/bin/llvm-pdbutil" --version

Azure CLI for authenticated symbol servers

Azure CLI is optional. It is used only when an explicitly configured authenticated symbol server requires Microsoft Entra credentials. Microsoft Public Symbols and unauthenticated servers do not require it.

After installation, open a new terminal. Sign in interactively and select the subscription associated with the symbol server, then restart VS Code:

az login
az account set --subscription "<subscription-name-or-id>"
az account show

Use az login --tenant "<tenant-id>" when the account belongs to multiple tenants. Add --use-device-code when a browser cannot be opened. Do not put passwords or access tokens on the command line.

Open a capture

1. Install ProcMon Viewer from the VS Code Extensions view or from a provided VSIX.
2. Open a .pml file in VS Code. If another editor opens it, use Open With... > ProcMon Viewer.
3. Wait for indexing and the initial Filter to finish. Progress appears in the editor.

File extensions are matched case-insensitively. For split captures named like trace.pml, trace-1.pml, and trace-2.pml, open any member; ProcMon Viewer discovers the contiguous family and presents one capture-ordered event space.

Use the views

Work with events

• Open Filter with Ctrl/Cmd+F or Ctrl/Cmd+L. Add typed Include or Exclude rules, enable or disable rows, and choose oldest-first or newest-first order.
• A first-seen capture starts with 21 enabled exclusions for common ProcMon, low-level I/O, NTFS metadata, and profiling noise. Reset to defaults restores them; Clear filters saves an intentionally empty Filter.
• Use More actions > Columns to choose from all 36 fields. Scroll horizontally when the selected columns exceed the viewport.
• Click any cell to select its event. Use Arrow, Page, Home, End, wheel, scrollbar, or trackpad navigation across large captures.
• Use Shift and Cmd/Ctrl selection for multiple rows. Copy selected visible columns as TSV, or export the active Filter and visible columns to CSV or JSONL.
• Double-click an event to open or update a detachable Event Details window. The inline Inspector and details window provide Event, Process, and paged Stack views.
• Add bookmarks and independent color highlights without changing Filter membership. Navigate them from More actions or the Command Palette commands below.
• Event timestamps, process lifetimes, lifecycle entries, bookmarks, Timeline ranges, and PE/COFF module timestamps use UTC in the fixed yyyy/MM/dd HH:mm:ss format.
• Module tables in Processes, the Events Inspector, and Event Details start with wider Timestamp and Version columns. Drag any column separator to adjust that table for the current session.
• Module Version display omits parenthesized WinBuild metadata.

Resolve native symbols

1. Select an event with a recorded stack, then open Stack in the Inspector, Event Details, or the Symbols view.
2. Check that LLVM is reported as ready. Choose offline mode for verified-cache-only resolution, or online mode when symbol downloads are allowed.
3. Select Resolve for the displayed stack page or current viewport. Resolution never starts automatically and can be cancelled.

Online resolution tries configured HTTPS SymStore servers in order and Microsoft Public Symbols last. Downloaded PE/PDB artifacts are identity-checked before use and retained in the verified cache. Configure authenticated Azure DevOps endpoints as https://artifacts.dev.azure.com/{organization}/_apis/symbol/symsrv/ and complete the Azure CLI sign-in described above first.

Some symbol servers retain a PDB but not its matching PE image. In Online mode on Windows, ProcMon Viewer automatically searches the standard Edge, WebView2, System32, and SysWOW64 roots for an exact timestamp/SizeOfImage match. When analyzing an older capture on another computer, copy the matching application version directory from the capture computer and add its absolute local path to procmonViewer.symbols.moduleDirectories. Only a matching PE basename and identity are promoted to the verified cache; UNC/device roots are rejected, and configured paths are not sent to the Webview or included in diagnostics. Offline mode continues to read only the verified cache.

If llvm-symbolizer crashes for one native PDB address, resolution isolates that address and falls back to the nearest function in LLVM's validated PDB public-symbol map. Other addresses retain normal inline/source results; a public fallback has a function name but no source line.

When a module fails, the completion status names it and reports the failed PE, PDB, or LLVM stage together with sanitized per-endpoint state and HTTP diagnostics. Large failure sets are bounded in the status display.

Commands

GitHub Copilot analysis

In Visual Studio Code 1.129 or later, select the extension-contributed ProcMon Analyst agent for a guided read-only investigation. You can also reference an individual tool such as #inspectProcmonCapture. Open the PML in ProcMon Viewer first, or pass an absolute local .pml path to the inspection tool.

• Every data-bearing invocation asks for confirmation before bounded PML values are sent to the selected language model. Tool inputs and results are not persisted by the extension.
• Stack resolution defaults to cacheOnly, which makes no network request. online requires an explicit argument and confirmation.
• Copilot tools cannot write PML, extract a whole capture without bounds, resolve endpoint names automatically, or open paths recorded in a capture.

Settings

Example settings.json:

{
  "procmonViewer.symbols.offline": false,
  "procmonViewer.symbols.servers": [
    "https://artifacts.dev.azure.com/example/_apis/symbol/symsrv/"
  ],
  "procmonViewer.symbols.moduleDirectories": [
    "/path/to/copied/application/version"
  ]
}

The Symbols view can override offline mode for the current editor session. Server and module-directory changes apply to the next resolution. Azure CLI starts only for a recognized authenticated endpoint that you explicitly list; credentials are never attached to another endpoint or forwarded to an artifact redirect. SymWeb file.ptr targets are accepted only when they name a signed HTTPS Azure Blob artifact with the expected basename; local, UNC, device, and other URL targets are rejected.

Compatibility

Privacy and limitations

• Input PML files are immutable. ProcMon capture creation, live capture, pause/resume, backing files, boot logging, and drop-filtered-events capture mode are not provided.
• PML files can contain private machine and user data. Capture values are read locally in bounded ranges and are not written to extension logs.
• Configured Filter operands and order are the bounded local-persistence exception. Bookmarks persist only a path-free capture fingerprint and event indexes; suggestions, decoded rows, and export paths remain session-only or Host-only.
• Filtered export writes CSV or JSONL to a local destination, not PML.
• Automatic network-name resolution and opening paths recorded in a capture are disabled because captures can contain private, foreign, Windows-only, or untrusted values.
• A capture family is limited to 256 discovered members and 50,000,000 aggregate event slots. An absent unknown trailing member cannot be inferred from filenames.

Contributor setup, architecture, build, test, benchmark, controlled-capture, and packaging information is maintained in DEVELOPMENT.md.