You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-endpoint/troubleshoot-av-performance-issues-with-procmon.md
+42-50Lines changed: 42 additions & 50 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,7 +7,7 @@ ms.reviewer: yonghree
7
7
manager: deniseb
8
8
ms.service: defender-endpoint
9
9
ms.topic: troubleshooting-general
10
-
ms.date: 01/06/2025
10
+
ms.date: 01/10/2025
11
11
ms.subservice: ngp
12
12
ms.localizationpriority: medium
13
13
ms.collection:
@@ -21,6 +21,12 @@ ai-usage: human-only
21
21
22
22
# Troubleshoot Microsoft Defender Antivirus performance issues with Process Monitor
23
23
24
+
> [!TIP]
25
+
> First, review common reasons for performance issues, such as high CPU usage. See **[Troubleshoot performance issues related to Microsoft Defender Antivirus real-time protection (rtp) or scans (scheduled or on-demand](/defender-endpoint/troubleshoot-performance-issues)**.
26
+
> Then, run the **[Microsoft Defender Antivirus Performance Analyzer](/defender-endpoint/tune-performance-defender-antivirus)**This tool will help identify the cause of high CPU usage in Microsoft Defender Antivirus, whether it's the Antimalware Service Executable, the Microsoft Defender Antivirus service, or MsMpEng.exe.
27
+
>If the Microsoft Defender Antivirus Performance Analyzer doesn't identify the root cause of the high CPU utilization, proceed with running **[Processor Monitor](/defender-endpoint/troubleshoot-av-performance-issues-with-procmon)**.
28
+
>The final tool in your toolkit to run is [Windows Performance Recorder UI (WPRUI) or Windows Performance Recorded (WPR command-line)](/defender-endpoint/troubleshoot-av-performance-issues-with-wprui).
29
+
24
30
## Capture process logs using Process Monitor
25
31
26
32
Process Monitor (ProcMon) is an advanced monitoring tool that provides real-time data on processes. It can be used to capture performance issues, such as high CPU usage, and to monitor application compatibility scenarios as they occur.
@@ -33,9 +39,9 @@ There are two ways to capture a Process Monitor (ProcMon) trace:
33
39
34
40
### Using the MDE Client Analyzer
35
41
36
-
1. Download the [MDE Client Analyzer](/defender-endpoint/download-client-analyzer).
42
+
1. Download the [MDE Client Analyzer](/defender-endpoint/download-client-analyzer).
37
43
38
-
1. Run the MDE Client Analyzer using [Live Response or locally](/defender-endpoint/run-analyzer-windows).
44
+
1. Run the MDE Client Analyzer using [Live Response or locally](/defender-endpoint/run-analyzer-windows).
39
45
40
46
> [!TIP]
41
47
> Before starting the trace, please make sure that the issue is reproducible. Additionally, close any applications that do not contribute to the reproduction of the issue.
@@ -50,84 +56,70 @@ There are two ways to capture a Process Monitor (ProcMon) trace:
50
56
51
57
1. Download [Process Monitor v3.89](/sysinternals/downloads/procmon) to a folder like `C:\temp`.
52
58
53
-
1. To remove the file's mark of the web:
59
+
2. To remove the file's mark of the web:
54
60
55
61
1. Right-click **ProcessMonitor.zip** and select **Properties**.
56
-
62
+
57
63
1. Under the *General* tab, look for *Security*.
58
-
64
+
59
65
1. Check the box beside **Unblock**.
60
-
66
+
61
67
1. Select **Apply**.
62
-
68
+
63
69
64
70
65
-
1. Unzip the file in `C:\temp` so that the folder path is `C:\temp\ProcessMonitor`.
71
+
3. Unzip the file in `C:\temp` so that the folder path is `C:\temp\ProcessMonitor`.
66
72
67
-
1. Copy **ProcMon.exe** to the Windows client or Windows server you're troubleshooting.
73
+
4. Copy **ProcMon.exe** to the Windows client or Windows server you're troubleshooting.
68
74
69
-
> [!TIP]
75
+
> [!TIP]
70
76
> Before running ProcMon, make sure all other applications not related to the high CPU usage issue are closed. Taking this step helps to minimize the number of processes to check.
71
77
72
-
1. You can launch ProcMon in two ways.
78
+
5. You can launch ProcMon in two ways.
73
79
74
80
1. Right-click **ProcMon.exe** and select **Run as administrator**.
75
-
76
-
Since logging starts automatically, stop the capture by selecting the magnifying glass icon or pressing **Ctrl+E**.
77
-
81
+
82
+
- Since logging starts automatically, stop the capture by selecting the magnifying glass icon or pressing **Ctrl+E**.
83
+
78
84
79
-
80
-
To confirm the capture has stopped, look for a red X on the magnifying glass icon.
81
-
85
+
86
+
2. To confirm the capture has stopped, look for a red X on the magnifying glass icon.
87
+
82
88
83
-
84
-
Next, to clear the earlier capture, select the eraser icon.
85
-
86
-
87
-
88
-
Or use the keyboard shortcut **Ctrl+X**.
89
-
90
-
1. Run the **command line** as admin, then from the Process Monitor path, run:
91
-
89
+
90
+
91
+
3. Run the **command line** as admin, then from the Process Monitor path, run:
92
+
92
93
93
-
94
-
ConsoleEdit development language
95
-
96
-
97
-
```
98
-
Procmon.exe /AcceptEula /Noconnect /Profiling
99
-
```
100
-
94
+
101
95
> [!TIP]
102
96
> Make the ProcMon window as small as possible when capturing data so you can easily start and stop the trace.
103
-
104
-
105
-
106
-
1. After completing step 6, set filters by selecting **OK**. You can filter the results after the capture is complete.
97
+
> 
98
+
99
+
6. After completing step 6, set filters by selecting **OK**. You can filter the results after the capture is complete.
107
100
108
101
109
102
110
-
1. To start the capture, select the magnifying glass icon again.
103
+
7. To start the capture, select the magnifying glass icon again.
111
104
112
-
1. Reproduce the problem.
105
+
8. Reproduce the problem.
113
106
114
-
> [!TIP]
107
+
> [!TIP]
115
108
> Wait for the problem to be reproduced, then note the timestamp when the trace begins.
116
109
117
-
1. After capturing two to four minutes of process activity during high CPU usage, stop the capture by clicking the magnifying glass icon.
110
+
9. After capturing two to four minutes of process activity during high CPU usage, stop the capture by clicking the magnifying glass icon.
118
111
119
-
1. To save the capture with a unique name in the `.pml` format, go to **File** then click **Save...**. Ensure you select the radio buttons **All events** and **Native Process Monitor Format (PML)**.
112
+
10. To save the capture with a unique name in the `.pml` format, go to **File** then click **Save...**. Ensure you select the radio buttons **All events** and **Native Process Monitor Format (PML)**.
120
113
121
-
114
+
122
115
123
-
1. For better tracking, change the default path from `C:\temp\ProcessMonitor\LogFile.PML` to `C:\temp\ProcessMonitor\%ComputerName%_LogFile_MMDDYEAR_Repro_of_issue.PML` where:
116
+
11. For better tracking, change the default path from `C:\temp\ProcessMonitor\LogFile.PML` to `C:\temp\ProcessMonitor\%ComputerName%_LogFile_MMDDYEAR_Repro_of_issue.PML` where:
124
117
125
118
-`%ComputerName%` is the device name
126
119
-`MMDDYEAR` is the month, day, and year
127
120
-`Repro_of_issue` is the name of the issue you're trying to reproduce
128
-
129
-
> [!TIP]
130
-
> If you have a working system, you might want to get a sample log to compare.
131
121
132
-
1. Zip the `.pml` file and submit it to Microsoft Support.
122
+
> [!TIP]
123
+
> If you have a working system, you might want to get a sample log to compare.
133
124
125
+
12. Zip the `.pml` file and submit it to Microsoft Support.
0 commit comments