![]() I can't find any specific documentation that lists all of the operators and what they do but that's what it seems. ![]() ![]() The "exclude" relation operator behaves like a "does not contain" as far as I can tell. Path excludes C:\MyApp\MyDocuments\Temp Exclude.Here is a filter combo that works the way we want: So because the filter entity is "Path" for both "begins with" and "ends with", Process monitor OR's them, and thus we get the noise we don't want. You specified process name include filters for Notepad.exe and Cmd.exeĪnd a path include filter for C:\Windows, Process Monitor would onlyĭisplay events originating in either Notepad.exe or Cmd.exe that From the help file:Īll the filters that are related to a particular attribute type andĪNDs together filters of different attribute types. The Process Monitor help file explains why the begins with / ends with filters don't work together. Stuff like this: C:\MyApp\MyDocuments\Temp.txt (not a PDF)Ĭ:\Some\Other\Folder\file.pdf (not the folder I want) ![]() pdf event is logged is included, so you'll get results you don't want. What happens is anything that literally begins with that temp folder is included, and anywhere else a.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |