Winternals: Defragmentation, Recovery, and Administration Field Guide

Exploring Process Activity with Process Explorer

In this section, I will detail most of the functions and features available within Process Explorer. I will not touch on every single nuance available within the program, because that would be very time-consuming, and besides, Process Explorer comes with a highly detailed Help function that obviates the need for a detailed explanation here.

Default Display Explanation

When you first open Process Explorer, you see a window divided into two sections, or panes (see Figure 2.1).


Figure 2.1: The Process Explorer Main Program Display

The Upper Pane

The upper pane shows a process tree composed of all active processes and their children. A child is a process that is called during execution of its parent process. The same process can be a child to another process in the tree and the parent of a process that it calls during its own execution. The processes aligned along the leftmost border of the upper pane have no parents. The root of the process tree is the system idle process and all processes descend vertically from there. The children of a given process appear below the parent in an indented fashion. By default, the upper pane shows the processes from all users, but you can toggle this by selecting View Show Processes from All Users on the menu.

Figure 2.2 is a key to the color-coding scheme that Process Explorer uses. You can change the colors if you want, by clicking Options Configure...

UNLIMITED FREE
ACCESS
TO THE WORLD'S BEST IDEAS

SUBMIT
Already a GlobalSpec user? Log in.

This is embarrasing...

An error occurred while processing the form. Please try again in a few minutes.

Customize Your GlobalSpec Experience

Category: Glazing
Finish!
Privacy Policy

This is embarrasing...

An error occurred while processing the form. Please try again in a few minutes.