VMware ESXi and vSphere Cluster Management

Save Process Activity Snapshots in Process Explorer

Learn how to prepare Process Explorer, export visible process and lower-pane data as a tab-delimited snapshot, and use it for troubleshooting and comparison.

A Process Explorer snapshot is a point-in-time export of the process information currently displayed in Process Explorer. It records what was visible when you saved it, making it useful for documentation, incident investigation, support escalation, comparison, and later review.

A snapshot is not live monitoring. After the file is created, it does not update when processes start, stop, or change.

What a Process Explorer snapshot contains

Process Explorer is a Sysinternals Windows utility for viewing and investigating running processes and their associated details. Its primary view is the process pane, which lists processes in a hierarchy along with configured columns.

The export includes the displayed contents of the main process pane. Therefore, the captured process data depends on the columns, hierarchy, sorting, and current view visible at the time of saving. If the lower pane is enabled and showing information for a selected process, that visible lower-pane data is included as well.

The lower pane is an optional detail view associated with the selected process. It can display handles—references held by a process to operating-system objects such as files, registry keys, events, and mutexes—or loaded DLLs and other modules.

Prepare the display before exporting

Because the export reflects the current display, configure Process Explorer before saving it.

• Arrange relevant process columns so the snapshot contains useful context, such as process name, process identifier, parent process, CPU or memory information, user, path, and command line when available.
• Sort or locate the target process before exporting. Use the process tree, filtering, or search features to focus on the process involved in the issue.
• Select the target process if you need associated lower-pane information.
• Enable the lower pane when handle or module details are required, then choose the appropriate handle or DLL/module view.
• For an investigation, include relevant process-state, resource, identity, and command-line columns before reproducing the problem.

Save a snapshot

Use either the toolbar or keyboard workflow to export the current view.

1. Prepare the process pane and, if needed, the lower pane.
2. Select the Save toolbar button or press Ctrl+S.
3. In the save dialog, choose a destination and enter a descriptive file name.
4. Save the file.
5. Verify that the file was written successfully by checking the selected folder, file name, file size, and modification time.

Use names that preserve context, for example App-before-reproduction-2026-08-18-1430.txt. Include the host name or case identifier when appropriate, while avoiding sensitive information in the name itself.

Export file format

The snapshot is saved as tab-delimited text. In this format, tab characters separate fields on each row.

• Open the file in a text editor to inspect the raw headings, rows, and values.
• Import it into spreadsheet software and select tab as the delimiter if the application does not detect tabs automatically.
• Parse it with scripts that read tab-separated fields when repeatable analysis is needed.

This file is a data export. It is not a Process Explorer session file and it is not a system memory dump. It contains only the information represented by the visible Process Explorer views at export time.

Practical examples

Capture evidence of high CPU usage

1. Sort or configure the process list to show CPU-related information.
2. Identify the process using unusually high CPU and retain useful identifying columns, such as process name, identifier, path, user, and command line.
3. Save a snapshot with the toolbar Save button or Ctrl+S.
4. Attach the verified file to a support case or compare it with a later snapshot.

Document files or objects held open by an application

1. Select the target process.
2. Enable the lower pane.
3. Choose the handle view.
4. Save the snapshot so the process list and visible lower-pane handle details are preserved.

Handles are references a process holds to operating-system objects, including files, registry keys, events, and mutexes.

Record loaded modules during troubleshooting

1. Select the process suspected of loading an unexpected component.
2. Configure the lower pane to display DLLs or modules.
3. Export the current view.
4. Review the tab-separated fields in a text editor or spreadsheet.

DLLs are dynamic-link libraries. A module view can help document components loaded by a process, but it represents only the visible state at the time of collection.

Compare application state before and after an action

1. Configure the same relevant process columns and lower-pane view for both captures.
2. Save one snapshot before reproducing the issue.
3. Perform the action or reproduce the problem.
4. Save a second snapshot.
5. Compare process entries and lower-pane details across the two files.

Comparisons can reveal processes that started or exited, changed resource use, and changed open handles or loaded modules.

Review and interpret saved output

Start with a text editor when you need to confirm exactly what was exported. Check the headings and rows, then verify that the expected process and lower-pane sections are present.

For sorting, filtering, and comparison, import the file into spreadsheet software using tab as the field separator. Keep the original text file unchanged and work from a copy when transforming data.

Preserve collection time, system identity, the selected process, the display configuration, and the investigation context alongside each file. A useful record might state what problem was being reproduced, what action occurred between captures, and whether the process was active or changing during collection.

Limitations and data handling

• Only information visible at export time is captured. Hidden columns, hidden panes, excluded processes, and details outside the current view are not included.
• Processes can change or terminate between observation and export. A process seen earlier may no longer appear when the file is saved.
• Resource values describe a point in time and should not be treated as a continuous measurement.
• Process names, executable paths, user names, command lines, handles, and loaded module details can contain sensitive organizational or personal information.
• Protect exported files with the same care used for other troubleshooting or incident data.
• Redact sensitive paths, account names, command-line arguments, or other identifying data before sharing externally when appropriate.

Troubleshooting snapshot exports

Expected lower-pane details are absent

Likely causes include a hidden lower pane, no selected process, or a lower pane configured for a different data type.

• Show the lower pane before saving.
• Select the intended process.
• Confirm whether handles or DLL/module details are required.
• Export again after verifying the view.

The saved file appears as one column in a spreadsheet

The spreadsheet may not have recognized tab characters automatically. Use its text or CSV import workflow and set the delimiter to tab.

A process seen earlier is missing

The process may have exited before export, or a filter or current view may have prevented it from appearing. Capture while the process is active, then review filters, the process tree, and visible columns before repeating the capture.

The exported information is insufficient

Relevant columns may not have been visible, the lower pane may not have been enabled, or the state may have changed before collection. Configure the process view and lower pane before reproducing the issue, then collect multiple time-stamped snapshots around the event.

Exam-relevant notes

• A snapshot is a point-in-time export, not a live view.
• The main process pane is always the primary source of exported content.
• Lower-pane data is included only when the lower pane is enabled and displaying data.
• The lower pane can show handles or DLLs/modules, depending on its selected view.
• The output format is tab-delimited text.
• Ctrl+S and the toolbar Save button initiate the save workflow.
• The export contains visible data, not a session file or memory dump.

For related work, continue with saving Process Explorer snapshots as part of a repeatable Windows troubleshooting evidence process.