Windows sysinternals

122 Part II Usage Guide
FIGURE 4-15 The Procmon Organize Filters dialog box.
Process Tree
Pressing Ctrl+T or clicking the Process Tree toolbar button displays the Process Tree dialog
box shown in Figure 4-16. The Process Tree dialog box displays all the processes that are referenced
in the loaded trace in a hierarchy that reflects their parent-child relationships, similar
to Procexp’s tree view. You can collapse or expand portions of the tree by clicking the plus (+)
and minus (–) icons to the left of parent processes in the tree, or selecting those nodes and
pressing the left and right arrow keys. Processes that are aligned along the left side of the
window have parent processes that have not generated any events in the trace.
FIGURE 4-16 The Process Tree dialog box.
Each process name appears next to its corresponding application icon. The icon is dimmed if
the process exited during the trace. To show only processes that were still running at the end
of the current trace, set the corresponding check box at the top of the dialog box.
www.it-ebooks.info