Windows sysinternals

118 Part II Usage Guide
without permanently removing it by clearing its check box. To enable the rule again, simply
select its check box again and click OK or Apply.
To reset the filter to default settings, click the Reset button in the Filter dialog box. You can
reset the filter from the Procmon main window by pressing Ctrl+R.
FIGURE 4-11 Process Monitor Filter dialog box.
Procmon ORs together all the filter rules for a particular attribute and ANDs filters for
different attributes. For example, if you specify Process Name “include” filters for Notepad.
exe and Cmd.exe, and a Path “include” filter for C:\Windows, Procmon displays only events
involving C:\Windows that originated from Notepad or Command Prompt. It doesn’t show
any other events involving other paths or other processes.
Another powerful way to add filter criteria is by right-clicking an event and selecting criteria
from the context menu. Figure 4-12 shows just the context menu from Figure 4-8 and
illustrates the available choices.
First, the context menu offers quick-filter entries for the value on which you click. For
example, the fourth and fifth items in Figure 4-12 show Include and Exclude quick filters
for registry path “HKCR\.exe\OpenWithProgids”. The Exclude Events Before option hides
all events preceding the selected one by adding a rule based on the event’s Date & Time
attribute; similarly, Exclude Events After hides all events following the selected one. Finally,
the Include and Exclude submenus (the second and third items from the bottom) list most
available filter attributes. Pick an attribute name from one of these submenus and the
corresponding value from the selected event will be added to the filter. You can also add a
filter based on the collection of values from multiple events simultaneously: select the events,
right-click, and select an attribute name from the Include or Exclude submenu. Doing this
configures a filter for all the unique values contained in the selected events.
www.it-ebooks.info