How to monitor programs and services on Windows startup?

windows boot logging

12,772

Solution 1

How do I monitor programs and services on Windows startup?

Windows services starting up are logged as events in the System Event log.

Are there any log file about Windows Services Status? expands on this.
MyEventViewer, by Nirsoft allows you to easily export Windows Event Logs to a comma separated file.
How to Create Your Own Windows Event Log Notification System presents a nice automated way to use MyEventViewer to send emails for example and/or save the filtered results file (csv format).
Process Monitor (from SysInternals/Microsoft) will track boot time and provide a dump file of all system and file activity during the boot process. See How to find what is causing Windows 7 Desktop pause for more information.

Disclaimer

I am not affiliated with any of the above software products in any way, I am just an end user of the software.

I've no idea how many of them will work on older version of Windows.

Solution 2

The command tasklist in Windows Command Prompt shows a static snapshot of all running programs and services, but it sounds like you need a process monitoring program. Sysinternals.com (on Microsoft Technet) has a free process monitor you can customize with your own filtering rules.

Sysinternals.com also has a Startup Monitor called Autoruns (also on Microsoft Technet) which may suit your needs more specifically than a regular process monitor.

12,772

Armfoot

What does the foot say?

Updated on September 18, 2022

Comments

Armfoot almost 2 years

I am looking for a way to have a kind of a simple --verbose log of all programs and services activities on Windows (XP, Vista, 7, 8, 10, etc.) startup.

Ideally it would show the name (and path), the memory allocated, the starting and ending runtime and the services that invoked (if it's an application), but I would be glad as well with just a names log.

It may be as simple as a command that is run before all the non-core windows stuff that can dump > startup_services.log and > startup_apps.log (probably would stop logging 2-3 minutes after booting). Is there such a thing already in the cmd line that can be used for this purpose?

Edit

This question was being marked as duplicate of another one, but that question has an answer for one part of my question: boot logging processes. I wanted as well a services log and if possible a simple way to save the log. David's answer below provided other ways to achieve this, and one of them generates the log to a CSV file, which in some cases is preferable to the heavy .PML files generated by the Process Monitor (PM) that can only be opened by the PM itself.
- Karan about 9 years
  
  If you want a list of programs and services that run at startup have you taken a look at Autoruns already?
- Armfoot about 9 years
  
  @Karan thanks Karan, but I have seen many of these kind of tools that are able to (de)activate auto-start entries, but none of those I found is able to create a simple log of one startup...
- DavidPostill about 9 years
  
  Windows services starting up are logged as events in System Event log. See Are there any log file about Windows Services Status?
- Armfoot about 9 years
  
  @DavidPostill Oh! I remember this one! It's not very easy to get a simple log from it though, but I appreciate it David!
- DavidPostill about 9 years
  
  possible duplicate of How to find what is causing Windows 7 Desktop pause
Armfoot about 9 years

+1 Floofies, I am running Process Monitor and it does have a very complete log of the latest activities (not for services though...), its filters are particularly good. Do you know how to run it right at startup (and possibly making it stop capturing events and save the PML after 2 minutes;)?
Floofies about 9 years

Process Monitor comes with a very useful helpfile, "procmon.chm", which contains documentation for command line options, scripting, and Boot Logging information. It is possible to create a startup script which automatically saves logs, and terminates Process Monitor when you no longer need it to run.
DavidPostill about 9 years

@Armfoot How to find what is causing Windows 7 Desktop pause You can use Process Monitor (from SysInternals/Microsoft) to track your boot time and provide a dump file of all system and file activity during the boot process.
DavidPostill about 9 years

@Armfoot How To Enable System Boot Time Logging using Process Monitor Tool
Armfoot about 9 years

@DavidPostill well, it seems like a bullseye shot :D thanks guys!
Armfoot about 9 years

I just restarted my pc after enabling Boot logging in the Process Monitor as music2myear described and the log it far more complete than I ever expected it to be (I also chose to enable thread profilling every 1 sec). It's amazing the amount of junk programs that I was able to find that still linger, even after using startup managers... Thanks for the link and all the other alternatives as well David, but I can see that the Process Monitor is the most powerful/organized solution for this :)