If the application uses loopback, then I would suggest using rawcap.exe to capture loopback as it's more lightweight than Message Analyzer.Īn initial task would be to follow the thread IDs in the PML and the trace logging of the application.Ĭomparing a working set of logs against the freezing set could be helpful if that is an option. Wireshark may also be useful if the application appears to be hanging as a result of network activity. Maybe a few dumps using procdump when it has hung would also be good. Run Windows Performance Analyzer (Part of the SDK) to capture a ETL trace of the issue.Ĥ. Run Process Monitor of course but also add profiling events every 100 ms.ģ. Hopefully this will give you thread IDs and possibly PIDs if needed in the logs of the application assuming itĢ. Parse logs and store logs in a structured. If you don’t use a unique log format for all your applications, normalize the logs in the log shipper.

You might need to consult with Support of the application in question. The log format should be structured (e.g., JSON or key/value format) having various fields like timestamp, severity, message and any other relevant data fields like process ID, transaction ID, etc. Enable as much trace logging of the application in question. I would suggest the following logs should cover everything:ġ. You may need more than just Process Monitor unless you have a really good understanding of the application in question.

Rolling process monitor logs