Process intelligence
See the process tree, the evidence and the safety class together.
Task Manager tells you what is running. RamBeacon tries to answer why it is running, what it belongs to, and whether it is safe to touch. Process rows include identity, resource usage, classification evidence and protection state.
The explorer covers every enumerated process, including background entries and processes under 1 MB. You can switch between a flat table, application-family groups, and purpose groups without losing the underlying policy.
Identity that survives PID reuse
A process is not just a number. RamBeacon binds actions to PID, creation time and executable path, then revalidates that identity immediately before an approved action. That makes stale rows and PID reuse visible instead of dangerous.
Details include parent and child relationships, publisher and path evidence where Windows exposes it, window presence, access limitations and the active protection class.
Grouping built for real developer machines
Electron apps, browser tabs, language servers, emulators and container helpers create large process families. Application grouping aggregates memory and CPU so you can see the cost of a family rather than ten rows that look unrelated.
Purpose grouping uses local, evidence-based classification. Optional AI labels can annotate a group, but they cannot change membership, protection or allowed actions.
- Flat, application-family and purpose-group views.
- Aggregate memory and CPU for groups.
- Largest-groups panel and duplicate-group signals.
- Protected children remain unselectable.
Safety policy is not a tooltip
Critical Windows components, security software, protected services, RamBeacon itself, review-required processes and standard applications receive deterministic classes in Rust. The webview can display a policy but cannot override it.
Graceful close uses WM_CLOSE after an approval preview. Force termination is a separate path with a second confirmation and a single-use approval token bound to the process identity.
Even a standard application can hold unsaved work. RamBeacon warns, but you remain responsible for approving the action.
Related
Continue the investigation.
Investigate memory growth without calling everything a leak.
RamBeacon tracks bounded per-process memory history across 5, 15, 30 and 60-minute windows. It highlights sustained growth, spikes and confidence evidence — then leaves the judgment with you.
Read about Memory leak investigation System healthOne chronology for resource spikes, process changes and cleanup results.
RamBeacon merges resource spikes, process starts and exits, browser-tab connections, watchlist alerts, startup changes and approved cleanup outcomes into a filterable timeline with JSON export.
Read about System health Background activityFind sustained background activity with deterministic evidence.
Investigate sustained CPU, persistent disk activity and repeated process restarts using clear thresholds, severity, an event timeline and optional AI explanations — never automatic termination.
Read about Background activityGet RamBeacon
Understand your PC. Start with RamBeacon.
Inspect resource usage, review evidence, and approve supported actions from one Windows utility. No automatic cleanup. No invented metrics.