Sysinternals Homepage
Forum Home Forum Home > Sysinternals Utilities > Process Monitor
  New Posts New Posts RSS Feed: ProcMon Hangs up during initialization
  FAQ FAQ  Forum Search   Calendar   Register Register  Login Login

ProcMon Hangs up during initialization
 Post Reply Post Reply Page  <1 34567 9>
Author
Message Reverse Sort Order
  Share Topic Share Topic  Topic Search Topic Search  Topic Options Topic Options
controler View Drop Down
Senior Member
Senior Member


Joined: 01 October 2006
Online Status: Offline
Posts: 222 		Post Options Post Options   Quote controler Quote  Post ReplyReply Direct Link To This Post Topic: ProcMon Hangs up during initialization
    Posted: 12 August 2007 at 6:38am
I am having the same exact problem here.
Dell with Nvidia card, Win XP freshly reformated and have KAV's new suit running.
Freezes at 27 % here after 91,000 events.
Is this a problem if we are running procmon as a user with admin priv's?
 
I just uninstalled KAv and procman works fine now without hanging :-)
I installed RKU first to try terminate procman if it hung. I could reinstall KAV and see if the problem returns.
 
controler


Edited by controler - 12 August 2007 at 7:01am
Back to Top
Mark View Drop Down
Admin Group
Admin Group


Joined: 04 June 2005
Location: United States
Online Status: Offline
Posts: 465 		Post Options Post Options   Quote Mark Quote  Post ReplyReply Direct Link To This Post Posted: 11 August 2007 at 4:17pm
What's the "Sandbox" driver you have on your system?
 
Please post crash dump to someplace I can access and I'll take a look. When you're connected with the kernel debugger you can save a dump with the ".dump" command.
Back to Top
mastabog View Drop Down
Newbie
Newbie


Joined: 16 July 2007
Online Status: Offline
Posts: 3 		Post Options Post Options   Quote mastabog Quote  Post ReplyReply Direct Link To This Post Posted: 09 August 2007 at 4:44pm
Bug still present in the new v1.21 ...
 
There have one major release v1.2 and one minor v1.21 and this is still ignored. This is a major bug ... really. It's odd that it doesn't get fixed.
Back to Top
Thur View Drop Down
Newbie
Newbie


Joined: 09 August 2007
Online Status: Offline
Posts: 3 		Post Options Post Options   Quote Thur Quote  Post ReplyReply Direct Link To This Post Posted: 09 August 2007 at 9:56am
I am facing exactly the same problem:

1. First instance of procmon.exe hangs. There is no way to terminate the process and windows does not shut down completely.
2. Second started instance of procmon.exe is running just fine.

I tried to gather some information on the hanging instance using windgb. I am not an expert on this topic, though:


lkd> !process 88b9f020
PROCESS 88b9f020 SessionId: 0 Cid: 0dd4    Peb: 7ffdf000 ParentCid: 0de4
    DirBase: 6e1e4000 ObjectTable: e3ea4498 HandleCount: 68.
    Image: Procmon.exe
    VadRoot 884415b8 Vads 81 Clone 0 Private 489. Modified 2019. Locked 0.
    DeviceMap e1a7b318
    Token                             e406d4a8
    ElapsedTime                      00:14:16.371
    UserTime                          00:00:00.030
    KernelTime                        00:00:00.300
    QuotaPoolUsage[PagedPool]        39380
    QuotaPoolUsage[NonPagedPool]      3400
    Working Set Sizes (now,min,max) (1431, 50, 345) (5724KB, 200KB, 1380KB)
    PeakWorkingSetSize               1432
    VirtualSize                      808 Mb
    PeakVirtualSize                   808 Mb
    PageFaultCount                    3517
    MemoryPriority                    BACKGROUND
    BasePriority                      8
    CommitCharge                      808

        THREAD 8a3c1b80 Cid 0dd4.03ec Teb: 7ffde000 Win32Thread: e1509008 WAIT: (UserRequest) KernelMode Non-Alertable
            b4b9a770 NotificationEvent
        Not impersonating
        DeviceMap                 e1a7b318
        Owning Process            88b9f020       Image:        Procmon.exe
        Wait Start TickCount      400193        Ticks: 57733 (0:00:09:38.161)
        Context Switch Count      291                 LargeStack
        UserTime                  00:00:00.020
        KernelTime               00:00:00.300
        Win32 Start Address 0x00130000
        Start Address kernel32!BaseProcessStartThunk (0x7c810665)
        Stack Init b4b9ab30 Current b4b9a6ec Base b4b9b000 Limit b4b94000 Call b4b9ab3c
        Priority 10 BasePriority 8 PriorityDecrement 2 DecrementCount 16
        ChildEBP RetAddr
        b4b9a704 804dc0f7 nt!KiSwapContext+0x2e (FPO: [Uses EBP] [0,0,4])
        b4b9a710 804dc143 nt!KiSwapThread+0x46 (FPO: [0,0,0])
        b4b9a738 805a3126 nt!KeWaitForSingleObject+0x1c2 (FPO: [Non-Fpo])
        b4b9a7c4 b7f68e07 nt!NtLoadDriver+0x179 (FPO: [Non-Fpo])
WARNING: Stack unwind information not available. Following frames may be wrong.
        b4b9a888 804de7ec Sandbox+0x13e07
        b4b9a888 7c91eb94 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ b4b9a894)
        004c51f4 00000000 ntdll!KiFastSystemCallRet (FPO: [0,0,0])

lkd> !thread 8a3c1b80
THREAD 8a3c1b80 Cid 0dd4.03ec Teb: 7ffde000 Win32Thread: e1509008 WAIT: (UserRequest) KernelMode Non-Alertable
    b4b9a770 NotificationEvent
Not impersonating
DeviceMap                 e1a7b318
Owning Process            88b9f020       Image:        Procmon.exe
Wait Start TickCount      400193        Ticks: 26845 (0:00:04:28.836)
Context Switch Count      291                 LargeStack
UserTime                  00:00:00.020
KernelTime               00:00:00.300
Win32 Start Address 0x00130000
Start Address kernel32!BaseProcessStartThunk (0x7c810665)
Stack Init b4b9ab30 Current b4b9a6ec Base b4b9b000 Limit b4b94000 Call b4b9ab3c
Priority 10 BasePriority 8 PriorityDecrement 2 DecrementCount 16
ChildEBP RetAddr Args to Child              
b4b9a704 804dc0f7 8a3c1bf0 8a3c1b80 804dc143 nt!KiSwapContext+0x2e (FPO: [Uses EBP] [0,0,4])
b4b9a710 804dc143 e4243cb2 00000000 e4243c38 nt!KiSwapThread+0x46 (FPO: [0,0,0])
b4b9a738 805a3126 00000000 00000006 00000000 nt!KeWaitForSingleObject+0x1c2 (FPO: [Non-Fpo])
b4b9a7c4 b7f68e07 0012f380 b4b9a894 0012f368 nt!NtLoadDriver+0x179 (FPO: [Non-Fpo])
WARNING: Stack unwind information not available. Following frames may be wrong.
b4b9a888 804de7ec 0012f380 004c51f4 7c91eb94 Sandbox+0x13e07
b4b9a888 7c91eb94 0012f380 004c51f4 7c91eb94 nt!KiFastCallEntry+0xf8 (FPO: [0,0] TrapFrame @ b4b9a894)
004c51f4 00000000 00000000 00004000 77417918 ntdll!KiFastSystemCallRet (FPO: [0,0,0])


Hope this helps..


Edited by Thur - 09 August 2007 at 10:14am
Back to Top
Jeff Hook View Drop Down
Newbie
Newbie


Joined: 01 August 2007
Online Status: Offline
Posts: 2 		Post Options Post Options   Quote Jeff Hook Quote  Post ReplyReply Direct Link To This Post Posted: 01 August 2007 at 12:38pm

I'd like to know if I can use FileMon in Windows XP Home with SP2 due to my inability to run Process Monitor 1.20.0.0.

Optional details are below:

Most Sysinternals users seem to be IT professionals &/or "power users." I'm only a home user who's unable to use Process Monitor in XP Home, with SP2. I was looking for a current version of FileMon, but I found these notes at Sysinternals' FileMon page:

++++

Note: Filemon and Regmon have been replaced by Process Monitor on versions of Windows starting with Windows 2000 SP4, Windows XP SP2, Windows Server 2003 SP1, and Windows Vista. Filemon and Regmon remain for legacy operating system support, including Windows 9x…  

…FileMon works on NT 4.0, Windows 2000, Windows XP, Windows XP and Windows Server 2003 64-bit Edition, Windows 2003 Server, Windows 95, Windows 98 and Windows ME….

++++

I assume this means FileMon *isn't* regarded as appropriate for XP with SP2, so I obtained Process Monitor version 1.20.0.0 yesterday, but I wasn't able to run it.

It opened a reduced-size GUI, with the word “initializing” displayed on the bottom frame, but then didn’t respond further. Task Manager reported two instances of it but both were “not responding.” I repeatedly tried “End Task” with no effect, in Task Manager, sending many error reports to Microsoft. I wasn't able to reboot, and I was forced to "power down" the system unit by pressing its power button. I worried about the effects of this, but the system seemed to reboot without any sign of damage.

I'm using Task Manager even though I've recently read on Sysinternal's  Process Explorer page that users can substitute that utility for Task Manager. I was so favorably impressed by Sysinternal's comprehensive list of utilities, and by their thorough Web pages, that I assumed I'd found a "mother lode" of helpful software. This was my first attempt to use a Sysinternals utility, and I never expected this type of problem.

Jeff Hook

NJ,USA


Edited by Jeff Hook - 02 August 2007 at 4:26pm
Back to Top
ReneeFox View Drop Down
Newbie
Newbie
Avatar

Joined: 03 June 2007
Location: United States
Online Status: Offline
Posts: 29 		Post Options Post Options   Quote ReneeFox Quote  Post ReplyReply Direct Link To This Post Posted: 28 July 2007 at 11:16am
Maybe we should change the Topic of this post to "ProcMon Hangs after Initialization," because I think I get past that part. Nobody has said exactly where the process is when it hangs.

I do have great news, though. I won't be needing ProcMon, because all my Internet-jumping up and down caused EA to join up with nVidia, and they fixed the problem. Turns out that nVidia knew about this 2 years ago, and just needed a proverbial kick in the butt to fix it. I gave EA a proverbial kick to give nVidia one. So, I'm very happy because I love the game and haven't been able to play it right since I started playing it; crashes became more frequent, and annoying as all get out!

Smile
I Love Computers!
Back to Top
PaulForbes View Drop Down
Newbie
Newbie


Joined: 28 July 2007
Online Status: Offline
Posts: 1 		Post Options Post Options   Quote PaulForbes Quote  Post ReplyReply Direct Link To This Post Posted: 28 July 2007 at 7:10am
Another hanging on initialization person.
 
Vista home, running trend micro av.
Back to Top
mastabog View Drop Down
Newbie
Newbie


Joined: 16 July 2007
Online Status: Offline
Posts: 3 		Post Options Post Options   Quote mastabog Quote  Post ReplyReply Direct Link To This Post Posted: 25 July 2007 at 6:43pm
well, I eagerly tried out the new version v1.2 ... it hangs exactly the same.
 
dissapointed
Back to Top
mastabog View Drop Down
Newbie
Newbie


Joined: 16 July 2007
Online Status: Offline
Posts: 3 		Post Options Post Options   Quote mastabog Quote  Post ReplyReply Direct Link To This Post Posted: 16 July 2007 at 9:45pm

I came here looking for a fix/workaround to this problem but i see Mark hasn't come up with anything yet ... well, add another guy to the affected people list :(
Back to Top
molotov View Drop Down
Moderator Group
Moderator Group
Avatar

Joined: 04 October 2006
Online Status: Offline
Posts: 17492 		Post Options Post Options   Quote molotov Quote  Post ReplyReply Direct Link To This Post Posted: 14 June 2007 at 7:07am
Hi Erik Jan and ReneeFox,
 
I had previously stated:

As I understand it, ReneeFox is able to capture events with the first instance of Process Monitor that is started.  It does not seem that the problem described is the same as what you are experiencing. I am inclined to consider these as two separate issues.
 
However, I was not sure at that time that ReneeFox's issue was different. So, I chose to leave it in this topic.
 
It does appear evident to me now that this matter should be in its own topic, as it is sufficiently different.
 
I have moved ReneeFox's issue into its own topic, "ProcMon reduces system performance".
 
Thank you for your patience.


Edited by molotov - 14 June 2007 at 8:00am
Daily affirmation:
net helpmsg 4006
Back to Top
 Post Reply Post Reply Page  <1 34567 9>

Forum Jump Forum Permissions View Drop Down