OpenProcMon

OpenProcMon is a free, MIT-licensed process monitoring tool for 64-bit Windows. It records process, file system, registry, and network activity in real time, with filters for process name, PID, operation, path, result, and category. Its interface includes a process tree, activity summaries, and call-stack views that resolve modules for individual frames. The program reads and writes Sysinternals Process Monitor .PML logs, including logs made by the original Process Monitor. Developers can use its Rust SDK to connect to the driver, choose activity to monitor, apply filters, and consume parsed events programmatically. Its procmon-cli MCP server provides capture and analysis operations over stdio for supported AI clients, and capture tools can export filtered results as PML, CSV, or XML. The v0.5.0 release offers a Windows x64 ZIP with the GUI, CLI/MCP server, console example, skill, and guides. Live capture requires Administrator privileges to load the kernel driver; inspecting an existing .PML file does not. It does not support 32-bit Windows or 32-bit .PML files.

OpenProcMon brings live system activity monitoring, log compatibility, and developer tools together in a free Windows application. Check its 64-bit-only support and Administrator requirement for live capture against your needs.

OpenProcMon suits Windows users and developers who need to inspect system activity or work with Process Monitor logs. Its SDK and MCP tools may also suit people building driver-based monitoring tools or AI-assisted capture and analysis workflows.

OpenProcMon is a Windows utility for tracing system events and examining saved Process Monitor logs. It is a strong fit for developers and analysts who need fine-grained captures or want to automate trace analysis. Its depth comes with a clear boundary: live collection needs Administrator access, and 32-bit Windows is unsupported.

Overview

OpenProcMon brings real-time process, file system, registry, and network monitoring together with analysis of existing logs. Filters can narrow events by process name, PID, operation, path, result, or category, and highlighting helps distinguish relevant entries in a busy capture. That makes it suited to investigating specific activity rather than watching broad system health.

The GUI combines a process tree and activity summaries with call-stack views that resolve modules at each frame. It reads and writes Sysinternals Process Monitor .PML logs, including logs made with the original Process Monitor, so existing traces remain usable. The project is MIT-licensed, with its Rust rewrite under active development.

Key features

Capture and log analysis

Live capture spans four activity categories, while saved .PML analysis does not require elevation. The distinction matters in restricted environments: users can inspect a supplied trace without Administrator privileges, but collecting their own live events means loading the kernel driver as an Administrator.

Developer and AI workflows

The Rust SDK can connect to the driver, select monitored activity, apply filters, and consume parsed events programmatically. The procmon-cli MCP server exposes capture and analysis operations to AI agents over stdio; its capture tools can export filtered results as PML, CSV, or XML. MCP setup guidance covers Claude Code, Claude Desktop, Codex, Cursor, Windsurf, Cline, and Continue. These options make the project relevant to developers building capture workflows, including EDR-style tooling, but they are more than most users need for occasional manual inspection.

Pricing

OpenProcMon costs nothing. The free plan includes the MIT-licensed open-source application, with 64-bit Windows support and live capture requiring Administrator privileges. There are no paid tiers to weigh against its feature set; the practical trade-offs are platform and access requirements, not a reduced free-plan feature allowance.

The v0.5.0 release provides a Windows x64 ZIP containing the GUI, CLI/MCP server, console example, skill, and MCP guides. That package is a useful starting point for both manual review and programmatic use, but it does not remove the elevation requirement for live capture.

Platforms

OpenProcMon supports Windows, targeting 64-bit systems only. It does not support 32-bit Windows or 32-bit .PML files, so it is unsuitable for those environments and logs. Live capture requires Administrator privileges because it loads a kernel driver; analyzing an existing .PML file does not.

Who it's for

Choose OpenProcMon if you need detailed Windows event traces, want to work with Sysinternals-compatible logs, or are building SDK- or MCP-based capture and analysis workflows. It is less appropriate for general system monitoring, for 32-bit Windows users, or where Administrator access cannot be granted for live collection. Users who only need to review a saved compatible log can avoid that privilege requirement.

Pros and cons

• Broad event coverage: Real-time process, file system, registry, and network activity can be narrowed with several event filters.
• Compatible saved logs: Reading and writing Sysinternals .PML files lets users work with existing Process Monitor captures.
• Developer hooks: A Rust SDK and MCP server support programmatic event handling and AI-assisted capture and analysis.
• Administrator required for capture: Live monitoring loads a kernel driver, which rules it out where elevation is unavailable.
• 64-bit Windows only: It cannot serve 32-bit Windows systems or open 32-bit .PML files.

Alternatives

Process Monitoring Software is the broader category to browse if OpenProcMon's Windows tracing focus is too narrow.

• Glances is a free, open-source system monitoring tool for readers who want wider platform coverage, including Android, Linux, macOS, Windows, web, API, and self-hosted use; some optional features require extra dependencies.
• Process Lasso is another Windows option, with a free plan and paid single-PC subscriptions for readers considering a freemium alternative.
• PM2 suits readers seeking an open-source process manager with a real-time web interface, with a free Runtime plan and a paid Plus plan.
• Ambih Monitor is a Windows alternative with live monitoring and a free plan capped at five-session history per project; its Pro plan adds unlimited session history and anomaly detection.
• AppControl is a free-to-download Windows option that requires no email or registration.
• Autoruns is free for use across a user's devices or supported devices, with no install or usage limit.
• bottom (btm) is a free alternative for readers looking across Linux, macOS, and Windows.
• iotop is a free Linux option for readers comfortable with its root-access requirement.

Verdict

OpenProcMon is a compelling free choice for 64-bit Windows developers and analysts who need event-level tracing, Sysinternals log compatibility, or programmable capture workflows. Its main advantages are the combination of detailed filtering, useful call-stack analysis, and developer integrations at no cost. Look elsewhere if you need 32-bit support or cannot run live capture as an Administrator.