Synopsis¶
Sometimes it is required to know exactly which process starts which other processes.
On Windows¶
On Windows one can use Microsoft's Process Monitor for tracing newly created processes.
Process Monitor requires Administrator rights/elevation, so starting it may result in the Windows UAC (User Account Control) dialog to ask whether to start this applicaiton.
Step 1: Start Process Monitor (procmon.exe)
Step 2: Add "Process Create" filter
In the dialog shown after first start or opened via Ctrl+L add a filter for "Operation is Process Create" (choose "Reset" to clear/restore the default filters):
After adding it:
Step 3: Check "Drop Filtered Events"
Step 4: Check "Capture Events"
Step 5: Choose "Clear Display"
Step 6: Start application
Launch the desired application and perform the steps that result in the suspected sub-processes to be started.
Step 7: Uncheck "Capture Events"
Step 8: Open process tree
Step 9: Locate desired application/process
Step 10: Add desired process and its sub-processes to filter
Step 11: Export the collected information
Step 12: - Verifying the exported information
Load the export file into Process Explorer via File > Open... and browse the events and the process tree to ensure that it contains the expected entries. (If no entries are shown, clear the filters via Ctrl+L, Reset.)
Step 13: - Send the export file to Squish technical support, if requested.