Windows 10: are process monitor, process explorer and suricata a complete home network monitoring...

I am thinking that on windows 10, using process explorer, process monitor and suricata are a complete home network monitoring environment?

:)

 

New Process Monitor v3.53 and Process Explorer v16.31

Source: https://techcommunity.microsoft.com/...1/ba-p/1073828

 

Process Monitor

Process Monitor is no longer supported nor updated because of changes to Windows itself ("Error VSP1478: Performance counters are not supported on virtual or Hyper-V enabled machines. Please use a non-virtual machine or disable Hyper-V"). When this is the case, the processor graph won't load at all. Process Explorer by Sysinternals (owned by Microsoft) is probably the best substitute.

This simple application records how many handles and how much memory an application is using every second. You can type in a process name (for when the process will be started soon) or select an already running process from the drop down box. Click start and it will start to monitor it; click stop to halt monitoring.





If the application closes, it will stop updating so you can see if the handle limit (default 10,000) or memory limit (2 GiB 32-bit, 4 GiB 32-bit Large Address Aware) is exceeded. These are things you can address to perhaps stop it from crashing.

If you wish to to use a Process Identification number (PID), use # followed by the number wherever it requests a name (commandline or in the "Process" field). For example, if you want it to monitor the PID 812, enter #812 and click start.


To increase the handle limit, you must increase the registry key:
Code: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota[/quote]
Command line arguments:
ArgumentPurposeExampleprocess_nameEnters the given name in the Process dropdown box.csrss/sAutomatically starts monitoring the process named. This will not work without providing a process name.csrss /s


It requires .NET Framework 3.5 or newer to run.


Version History:
1.0.4 - Fixed a minor bug where Max Cores could exceed the number of cores in the machine.
1.0.3 - Added Processor graph/stats and ability to directly input a PID (via #134).
1.0.2 - Added launch arguments (detailed above).
1.0.1 - Displays the start time of monitor and how long the monitor observed the process on stopping.
1.0.0 - Original release.

 

Process Monitor

1.0.1 released. It displays how long the process monitor was observering a process on stop/close.