Managed Stacks in Process Monitor

Question

Is it possible to see managed stack traces in Process Monitor for file access events of a given process? If not, is there the other way to accomplish such task?

Foliolate

Process Monitor is an unmanaged tool and records the native stack trace. You need a managed debugger to see the stack frames generated by the jitted code. Preventing the jitter from generating code is possible, use ngen.exe /debug on the program. No idea if that makes ProcMon smarter, possibly. – Powdery

Answer 1

Unfortunately Process Monitor does not yet support managed call stacks. But perfview is pretty good at decomposing managed stacks and it also provides a way to collect File I/O events:

Select File I/O events in Run/Collect dialog:

After tracing is finished you should have File I/O events available in the directory tree:

Double clicking it should present you a window with all collected File I/O operations

Each operation has a call stack registered and you may browse it on other tabs available in the events window.

Mantling