How to collect ProcMon logs to troubleshoot AMP issues at startup

Available Languages

Download Options

PDF (1.1 MB)
View with Adobe Reader on a variety of devices
ePub (1.3 MB)
View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
Mobi (Kindle) (596.2 KB)
View on Kindle device or Kindle app on multiple devices

Updated:February 5, 2020

Document ID:215226

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Introduction

Procedure:

Introduction

As a System Administrator, you may want to obtain detailed logs using the Process Monitor (procmon.exe) to determine, if the FireAMP connector experiences hangs during the computer startup process. These logs will also be requested by Cisco TAC in order to troubleshoot such issues. Process Monitor is a free utility that can help us here. This can be downloaded freely from https://docs.microsoft.com/en-us/sysinternals/downloads/procmon

This document describes the steps on how to collect ProcMon logs and Memory dump if the problem occurs during a system boot process (which means that it's generating BSODs at boot). These logs are required to capture the system events taking place during boot.

Procedure:

1. Set-up the test machines in such a way so that the issue can be reproduced easily.

2. Download and Run the ProcMon tool as administrator. Go to File -> Process Monitor Backing Files and select a Path.

3. In Procmon Tool, go to Options -> Enable Boot Logging.

4. Select Generate threat profiling events and Every second.

5. Make sure all of the relevant Filters are selected in Procmon and data is being collected.

6. If you are unable to replicate the crash, you can force crash Windows using the utility NotMyFault64.exe which you can get from https://live.sysinternals.com/files/

The instructions on how to run that are here: https://docs.microsoft.com/en-us/windows/client-management/generate-kernel-or-complete-crash-dump

7. Crash the machine.

8. Boot the machine into Safe Mode and manually collect Procmon.pmb and MEMORY.DMP, both files are in C:\Windows folder. These files are to be shared with Cisco TAC.

7. Optionally, if you are able to boot it into "normal mode" if the PMB files are generated in the C:\Windows folder, then if you launch ProcMon again, you will see the following logs. From this, you can re-save the events by clicking on the Save button.