Compare software

Free to download and use, published by Microsoft as part of the Sysinternals suite. The source is not published.

• Per-file counts of opens, reads, writes and bytes
• Shows which DLL opened each file
• Can launch a process and trace it from the start
• Command-line options for scripted runs

• Shows the exact file or registry path that failed and the result code it returned
• Non-destructive filtering, so you can narrow down after capturing rather than before
• Full thread stack, session and user detail on every event
• A Linux version exists alongside the Windows one

• The published requirements list versions through Windows 8
• Injects a DLL into the inspected process
• Separate builds are needed for 32-bit and 64-bit targets

• Windows only for the main version
• Generates enormous volumes of events; filtering is mandatory, not optional
• Closed source
• Interpreting the output needs some understanding of how Windows loads things

• nirsoft.net/utils/process_activity_view.html

• learn.microsoft.com/en-us/sysinternals/downloads/procmon