Using the Output of Sysinternals Process Monitor in another programm/script in real time

Question

I'm working on a script that should check on certain system events (like opening of a file, or changing of a registry key) and start further actions depending on that. But I haven't found a clean way to get the information into my script.

I'm looking for a way to get the output of Sysinternals Process Monitor into another program. This should happen without user interaction in close to real time; so saving into a CSV/XML and than using this doesn't work. I've checked on using the backing file, but this is in the Process Monitor PML format, which i haven't found to be documented anywhere.

Does anybody know a way how I can get the output of Process Monitor into my script? Or an other (not too messy) way to get a real time list of opened files, registry keys etc into a python program?

Thanks!

Answer 1

If you want to parse stdout or a file, and your ok with a 32 bit only solution, try Dr Strace or ntstrace .

YOu could also look into ospy or another ProcMon alternative. ospy is open source, so at the very least you could look at the source code for capturing events.

Here is a list of alternates to ProcMon.