Windows sysinternals

374 Part II Usage Guide
FIGURE 13-5 Portmon filter dialog box.
Enter expressions in the Include field to identify column content that you want Portmon to
display, in the Exclude field to specify content that should cause a line not to be displayed,
or in the Highlight field to identify content that should be emphasized with color coding.
You can enter multiple expressions, separating each with a semicolon. Do not include spaces
in the filter expression unless you want the spaces to be part of the filter. Note that the “*”
character is interpreted as a wildcard, and that filters are interpreted in a case-insensitive
manner. The default rules include everything (“*”) and exclude nothing.
An expression must completely match a column value for the rule to apply. For example, if
you want to match lines that contain the word “baud” in the middle of other text (such as
IOCTL_SERIAL_GET_BAUD_RATE), you need to use “*” to account for the text before and after
the word “baud”. Use *baud* as your filter expression.
As an example, say you want Portmon to display all events except those that have a field
ending with “_WRITE” and to highlight events that include the word “baud”. You would apply
this filter:
Include: *
Exclude:
Highlight:
*_write
*baud*
Filtering is applied only to new events as they are captured. New text lines that match the
rules that are in effect are displayed; those that don’t are dropped and cannot be “unhidden”
by changing the filter rules after the fact. Also, changing the filter rules does not remove lines
that are already displayed by Portmon.
Highlighting is applied when you set the highlighting rules. The default colors for highlighted
rows are white text on a red background. You can change these colors by choosing Highlight
Colors from the Filter menu.
www.it-ebooks.info