Early versions of Process Monitor (up to version 2.8) ran on Windows 2000 SP4 with Update Rollup 1. The two tools were combined to create Process Monitor. RegMon and its sister application Filemon were primarily created by Mark Russinovich and Bryce Cogswell, employed by NuMega Technologies and later SysInternals prior SysInternals being bought out by Microsoft in 2006. In addition it shows how applications use files and DLLs, detects some critical errors in system files and more. It also allows for filtering on specific keys, processes, process IDs, and values. Process Monitor can be used to detect failed attempts to read and write registry keys. Process Monitor monitors and records all actions attempted against the Microsoft Windows Registry. It combines two older tools, FileMon and RegMon and is used in system administration, computer forensics, and application debugging. The tool monitors and displays in real-time all file system activity on a Microsoft Windows or Unix-like operating system. Process Monitor is a tool from Windows Sysinternals, part of the Microsoft TechNet website. It would also be nice if it did not require administrative privileges./ April 28, 2021 22 months ago ( ) (Linux version) Another requirement which I didn't really state is that speed is fairly important I was planning on doing this for things like compiling a C++-file, and pulling up a full GUI which generates a 20 MB logfile will have prohibitive overhead. I'm really only interested in what files are opened, and if they are opened for read/write or just read. If I narrow down my requirements even further, it is probably enough to be able to monitor calls to CreateFile(). I'm aware of Process Monitor, but I would like to receive the data in a form which I can import into another program for further analysis. I want to do this programmatically from another process.

I'm primarily interested in running a process and figuring out which files it has read and written.

On Linux I can probably get away using strace with suitable parameters, but how can I do this on Windows? I would like to be able to monitor certain system calls made by a process, primarily file I/O calls.

Windows process monitor