Here's an example on how to monitor notepad++.exe
1 - Open Procmon.exe -> crtl + E to toggle start/stop monitoring, crtl->x clear display -> crtl + L to open filter windows
2 - Use 1,2,3 to enter the criteria
3 - Crtl+E to start monitoring while using notepad++. Once done, crtl + E to stop
Thank you. I'm glad it can EXclude almost 2 million events! Quick follow-up question: is it able to monitor the names and the file path of 'open'ed files?Here's an example on how to monitor notepad++.exe
1 - Open Procmon.exe -> crtl + E to toggle start/stop monitoring, crtl->x clear display -> crtl + L to open filter windows
2 - Use 1,2,3 to enter the criteria
3 - Crtl+E to start monitoring while using notepad++. Once done, crtl + E to stop
Notepad++ was just an example. But the program I plan to use is not simple. For example, it uses an "add-on" program that comes with about 170,000 files. I'd like to save the files opened by the main program (if any, among the 170k files) to a text file for review after I quit the main program.@bofhlusr
I usually use this program to monitor the registry where the program set/write/delete its registry value. You probably want to look at task manager for the file name, as you can see here I am editing New Text Docunent.txt
1. Run Process Monitor.
2. Run Notepad
3. Start Process Monitor's 'Capture'.
4. Type a couple of letters in Notepad then stop.
5. Stop Process Monitor's capture.
6. Using 'Find' in Process Monitor's toolbar, look for 'notepad.exe' in the 'Process Name' column.
7. When an entry as been found, right-click on the entry and choose 'Include 'notepad.exe''. This will set a filter excluding events not linked to 'notepad.exe':
For your own search, you've made it clear you are interested just in files... so use the 'Show File System Activity' filter in the Activity bar in the main tool bar. This will temporarily disable all activity from view except 'File System':
Hope this helps...
Quote
