Package: procmondf
provides a convenient and efficient solution for capturing and analyzing system activity logs using Procmon and converting them to the pandas compatible Parquet file format (2% of the original pml file size)pip install procmondfTested against Windows 10 / Python 3.10 / AnacondaThe ProcMonDf class and its associated functions are used for logging and analyzing system processes and
events using Microsoft's Procmonhttps://learn.microsoft.com/en-us/sysinternals/downloads/procmonutility.
Procmon is a Windows-based tool that monitors and captures real-time system activity,
including file system and registry operations, process and thread activity, network activity, and more.The ProcMonDf class provides a convenient way to start and stop logging with Procmon,
save the log as a Parquet file, and optionally return the log as a pandas DataFrame.
It leverages the functionality of the Procmon utility and combines
it with the data processing capabilities of pandas and
Parquet file format for efficient storage (between 1% to 5% of the original pml file size) and analysis.
600.000 rows require about 5 mb of disk space.This functionality might be interesting for developers, system administrators, and analysts who need to track
and analyze system behavior, diagnose issues, understand resource usage patterns,
or monitor software performance.
By using the ProcMonDf class, they can automate the process of capturing system activity logs,
convert them to a structured DataFrame, and perform further analysis, filtering,
or visualization using the powerful tools available in the pandas ecosystem.The advantages of using ProcMonDf and the associated functions include:Simplified interface:The class encapsulates the complex logic required to start and stop Procmon logging,
convert logs to Parquet format, and manage temporary files.Data processing capabilities:The captured logs are converted into a structured DataFrame, allowing users to leverage the powerful data manipulation and analysis functionalities provided by pandas.Storage efficiency:The logs are saved in Parquet format, which offers a columnar storage layout and compression, resulting in reduced storage space requirements and improved query performance.Flexibility and extensibility:Users can customize the logging parameters and additional arguments
passed to Procmon to suit their specific requirements.Integration with existing workflows:The ability to return the log as a DataFrame allows users to seamlessly integrate it
into their existing data analysis pipelines or leverage other libraries and tools compatible with pandas.classProcMonDf:InitializesaProcMonDfobject.Args:output(str):ThepathtotheoutputParquetfile.Doesn't have to exist yet.Returns:NoneExample:fromprocmondfimportProcMonDfpm=ProcMonDf("c:\\proggi.pqt")pm.start_logging()# when you are done, use the following command to stop loggingdf=pm.stop_logging(deltmp=True,returndf=True)print(df[:5].to_string())aa_time_of_dayaa_process_nameaa_pidaa_operationaa_pathaa_resultaa_detail02023-06-2509:55:29.951767Explorer.EXE3904RegOpenKeyHKCU\Software\Classes\CLSID\{xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx}\InprocServer32NAMENOTFOUNDDesiredAccess:Read12023-06-2509:55:29.951783Explorer.EXE3904RegQueryKeyHKCR\CLSID\{xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx}SUCCESSQuery:HandleTags,HandleTags:0x022023-06-2509:55:29.951792Explorer.EXE3904RegOpenKeyHKCR\CLSID\{xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx}\InprocServer32SUCCESSDesiredAccess:Read32023-06-2509:55:29.951836Explorer.EXE3904RegQueryKeyHKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagementSUCCESSQuery:HandleTags,HandleTags:0x042023-06-2509:55:29.951837Procmon64.exe11160RegQueryValueHKLM\System\CurrentControlSet\Control\WMI\SecurityxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxNAMENOTFOUNDLength:528