Process Notifier is a lightweight portable alternative that can monitor one or multiple processes and notify the user via email if a process is started, closed, not found or found.

The program minimizes directly on startup, a right-click on the system tray icon displays all available options. A click on “Processes to Monitor” opens the configuration window where new processes can be added to the monitoring software.

You basically add the process executable file and configure the process state that you want monitored. It is optionally possible to add the process path to the software if you want to restart it in case it was found to be not running or closed on the system.

You can theoretically use the software to auto-restart processes that get terminated on the system. The email notifications are configured with a click on “E-Mail Settings”. Here it is important to add the recipient’s email address and the SMTP server settings.

The message subject and body can be customized. Both make use of placeholders that are listed in the menu as well. A screenshot can be attached to the system as well.

There are two additional configuration menus that you should look at. First the scan interval menu which defines the scan intervals on the system. The default value is set to 1 hour which many users may want to reduce, especially if they want to make sure that a process is always running on the system. A new interval in minutes can be configured for that.

The program preferences finally define if email and system tray notifications are enabled (which they are by default), if events are written to a text log and if all processes are scanned at startup.

Users can use the right-click menu to scan for processes manually.

Process Notifier is a lightweight program that is available as a 32-bit and 64-bit application for all recent versions of the Microsoft Windows operating system. The program is very robust despite that it has been released in version 0.0.2 beta by the developer. Windows users can download the portable software from the developer website.

• Processes: Displays all running processes on the computer system in a hierarchic view including process names, process IDs, user names and the cpu utilization. Options provided include starting and stopping processes, checking process information online, opening the containing folder or creating graphs./li>
• Services: A list of all services of the operating system. Each service is listed with its product, service and display name, status, service type, dependencies and load order group with options to display more details in the right sidebar after selecting a service. Services can be started and stopped from the menu.
• Modules: A list of modules that have been loaded again with many useful information like the path, file size, file type and product name.
• IP Connections: Displays all connections of the operating system. Information provided are the local IP, local port, remote IP and port, state, socket type, process and time of creation. Remote Whois information can be opened for any connection.
• Driver: The system drivers that have been loaded. Displayed are driver names, product names, status, driver type and dependencies.
• Startup: Displays the programs that are launched during Windows startup with options to disable and edit them.

Version 3 of What’s Running adds Windows 7 and Windows Vista support as well as support for 64-bit operating systems. One interesting option that is provided by the program is the ability to create a system snapshot which can then be compared with other snapshots that have been taken. The differences between two snapshots are then displayed by the program. This makes What’s Running an excellent program to monitor system changes over time.

The beta version of What’s Running 3 can be downloaded from the developer’s website. It is compatible with many Windows operating systems including Windows XP, Vista and Windows 7.

The following article will take a closer look at five application monitors and restarters for the Windows operating system. These programs monitor applications that the user configures. They usually also come with options to react on certain events.

Restarter

All application monitoring options are displayed in the main interface of the Restarter program. It displays the list of running processes on the top with the option to select one that should be monitored by the application. The monitoring interval can be configured as well as several startup and error parameters including killing the application if it becomes unresponsive and restarting it if it is not running anymore.

Pro

• Easy to use, manage everything in one program window.
• Low resource usage
• Can restart applications
• Logging

Con

• Can only monitor one application unless started several times
• No remote notification options
• Not portable

download link

Application Monitor

Application Monitor is another program that can monitor and restart applications that have been added to the program by the user. The process of adding applications to the software is slightly more complex as the user needs to select the program executable from the computer’s hard drive manually. Multiple executables can be added to the program this way. Application Monitor will automatically check if the program is running, restart it if it is not. It can write events into a log file and notify the user by sending an email to an email account if the SMTP server settings are filled out in the program’s options.

Pro

• Portable software
• Remote notifications (email)
• Logging
• Can restart applications
• Can monitor multiple applications

Con

• Not as easy to configure as Restarter

download link

Keep Running

Keep Running is a basic application monitor that needs to be configured in a separate configuration file. It is a portable application that can monitor one application in the Windows operating system. The administrator needs to add the full path to the software and other options in the configuration file. It is also only possible to monitor one application at a time. A positive side effect of the bare-bone approach is that the process of the program uses the least amount of computer memory in the test field.

Pro

• Lightweight application
• Portable software

Con

• Difficult configuration
• Can only monitor one application
• No logging
• No notifications

download link

Kiwi Application Monitor

The free version of Kiwi Application Monitor offers basic options to monitor processes in the Windows operating system. It is possible to monitor multiple applications, view statistics, configure email notifications and logging options. It is possible to configure several options to close or restart applications if events are triggered.

Pro

• Can monitor multiple applications
• Statistics about monitored applications
• Email Notifications
• Logging

Con

• Not portable
• Moderate resource usage

download link

CRP (Control Running Programs)

Control Running Programs needs to be run in compatibility mode in Windows 7. The program can be used to control three distinct program behaviors: Program instances, starting and memory usage. It is for example possible to configure that a program should be restarted if it is not running (or crashed), that only one instance of the program should be open at any time and that it should be closed if it exceeds a certain amount of computer memory. CRP supports logging but no notifications.

Pro

• Can monitor multiple applications
• Logging

Con

• Not portable
• No notifications
• Needs to be run in compatibility mode in Windows 7

download link

Process Monitor comes with an option to log the Windows boot process. It will log everything which usually results in boot logs that are larger than 100 Megabytes. The program can however be used – with some expertise – to locate problematic drivers that slow down the boot process.

Here is how this is done. Download and start Process Monitor. Select the Options menu at the top and the Enable Boot Logging option in that menu. This makes Process Monitor log the next boot process of the operating system.

Restart the computer afterwards and start Process Monitor once the operating system has loaded. You will be asked to save the boot log to a directory on the hard drive. Load that boot log afterwards using [Ctrl O] or File > Open. This is a huge log file and the first thing that needs to be done is to filter for entries that are related to system drivers. You can do that by pressing [Ctrl L]. This will open the filter menu.

Locate the filter Process Name is System Exclude and remove it from the list of filters. Now add the following two filters to the list:

Process Name is System Include
Path ends with .sys Include

A click on ok will only display the entries that match both filters that have been added. This is still a list of 2500+ entries. The important part is to look at the time of day column. This lists the load time for all operations. All you need to do now is to locate gaps between events. Gaps of a few seconds need to be analyses, everything else is usually not worth analysis.

The example above shows a gap of almost 16 seconds between the two marked entries. Look at the path of the entry that is using that much boot time, the driver name is located at the end of the path. In this example it was sptd.sys. A quick Google search revealed that it is a driver used by Daemon Tools. There are two options available once the program has been identified.

It is possible to research the topic further by visiting forums (see if other users have the problem, find possible solutions), contacting the developer and updating the program or hardware (if possible). The other option is to remove the program from the computer system if it is not needed or if alternatives are available that do not increase the boot time by that amount.

Some of the applications that are included in the Sysinternals suite should be installed on every computer such as Rootkit Revealer, Autoruns, Process Explorer and Regmon. This collection might confuse inexperienced users due to the sheer amount of exectuable files that are listed in the main directory. It is difficulty to find out what some of the executables are doing, do you know for instance what psfile.exe will do ?

It would have been nice if at least a readme file would have been included to make it easier to understand the executables. A gui would have been even better. I would advise everyone to visit the Sysinternals website to lookup the programs before you execute them.

Update: The latest version of Sysinternals Suite has a size of 13.3 Megabytes. The collection still contains all programs that have been developed and released by Sysinternals in the past. All you need to do is to download the zip file and unpack it on your system to start using the applications right away.

Some applications ship with Windows Help files that explain the program’s core functionality. Other programs are still listed without information.

This collection is ideal for a troubleshooting CD or stick that you carry around whenever to have it ready whenever you need it.

An alternative to that is Sysinternals Live, which lets you run all Sysinternals applications directly from the web.