Skip to content

Troubleshooting

Jump to bottom
Gnawbie edited this page Apr 11, 2026 · 6 revisions

Troubleshooting

Monitor won't start / no tray icon appears

1. Script is blocked by Windows

Right-click ProcessMonitor.ps1 -> Properties -> tick Unblock at the bottom.

Or run in PowerShell:

Unblock-File -Path ".\ProcessMonitor.ps1"

2. See the actual error

Double-click Test-RunVisible.bat — runs the script in a visible console so you can read the error.

Or use Diagnose-Monitor.bat — unblocks the file and runs it visibly.

Start-Monitor.bat says "already running" but there's no tray icon

Old behaviour (now fixed): A stale PID file used to block startup even when the monitor wasn't actually running.

Current behaviour: Start-Monitor now checks WMI directly to confirm the monitor is actually running. If the PID file is stale, it is automatically deleted and the monitor starts fresh. No manual cleanup needed.

If you're still seeing this on an older copy of the file, manually delete the stale PID file:

%USERPROFILE%\ProcessMonitorLogs\.monitor.pid

Then pull the latest version of Start-Monitor.bat and re-run.

Start-Monitor.bat shows a blank PID or a Get-Process error

Cause: A cmd.exe quoting bug in older versions of Start-Monitor.bat caused the PID variable to come back empty, which then caused Get-Process -Id to fail with "Missing an argument".

Fix: Pull the latest Start-Monitor.bat — it now uses a temp PowerShell script file instead of inline -Command strings, which avoids the quoting issue entirely.

Stop-Monitor.bat says "not running" but the tray icon is still there

The stop script searches for the process by command line. Open Task Manager -> Details tab -> find powershell.exe -> End task.

Tray icon is there but no logs are being written

Check the log folder exists and is writable:

%USERPROFILE%\ProcessMonitorLogs\

Also verify WMI is running:

Get-Service winmgmt

It should show Running.

Balloon notifications not appearing

  • Check mute is off: right-click tray icon -> Mute Notifications should be unchecked
  • Windows Focus Assist / Do Not Disturb may be suppressing them

Errors log has too many false positives

Edit the $SkipNames array near the top of ProcessMonitor.ps1 to add processes you want to ignore:

$SkipNames = @("System", "Idle", "Registry", "smss.exe", "csrss.exe", "yourapp.exe")

Start-Monitor.bat shows "WARNING: Monitor did not start - PID file never appeared"

This means the monitor launched but exited immediately before writing the PID file. There are two known causes, both now fixed in the latest version:

Cause 1: Encoding error in ProcessMonitor.ps1

Older versions contained em-dash characters (—) in the crash description strings. PowerShell 5.1 reads .ps1 files as Windows-1252 by default, causing those UTF-8 multi-byte characters to corrupt the entire parse — the script would fail silently before doing anything, including writing the PID file.

Cause 2: Syntax error in Get-WerCrashDetail

A return if (...) statement (invalid PowerShell) in the WER lookup function also caused a silent parse failure on startup.

Fix for both: Pull the latest ProcessMonitor.ps1. You can verify the script parses cleanly by running this in PowerShell:

$errors = $null
$null = [System.Management.Automation.Language.Parser]::ParseFile("$env:USERPROFILE\path\to\ProcessMonitor.ps1", [ref]$null, [ref]$errors)
$errors

An empty output means no parse errors. If errors appear, re-download the file from the repo.

Quick test: Double-click Test-RunVisible.bat — if the script has a syntax error, PowerShell will print it to the visible console before exiting.

The log file is empty / nothing is being logged

Expected behaviour (v1.1+): ProcessMonitor now only logs crashes (non-zero exit codes). Clean exits are silently ignored. If your log file is empty or very sparse, that is a good sign — it means nothing has crashed.

To confirm the monitor is running, hover over the green tray icon — it should show Process Monitor - Running.

Log file is full of "WARN | Watcher error: You cannot call a method on a null-valued expression."

Cause: WaitForNextEvent() can return null in some Windows PowerShell 5.1 builds instead of throwing a ManagementException on timeout. The code then tried to access .Properties on a null object, hitting the WARN catch block on nearly every loop iteration.

This was always happening but was invisible before because CLOSE log entries drowned it out. After the "ignore clean exits" change, the WARNs became the only entries in the log.

Fix: Pull the latest ProcessMonitor.ps1 — it now null-checks the event object before touching its properties, so these cases silently continue instead of logging a warning.

"Cannot convert value to type System.UInt32" error on startup

Error message:

Cannot convert value "-1073741819" to type "System.UInt32".
At ProcessMonitor.ps1:52 char:1
+ $script:ExitCodeTable = @{

Cause: PowerShell 5.1 parses hex literals larger than 0x7FFFFFFF as signed 32-bit integers — so 0xC0000005 becomes -1073741819. Casting that negative value to [uint32] then fails at startup before the monitor even runs.

Fix: Pull the latest ProcessMonitor.ps1. The exit code table now uses plain hex strings as keys ("0xC0000005") which have no type casting issues.

Clone this wiki locally