Advanced system utilities to manage, troubleshoot, and diagnose Windows and Linux systems and applications.
How can I use "or" logic with Process Monitor's Filters and Highlight rules? (aka "any" vs "all")
As far as I can tell, Process Monitor's Filter and Highlight rules are all applied together as "and" rules (i.e. a row must satisfy all criteria, as opposed to any criteria, or a subset or sub-group of criteria).
For example, in a Process Monitor session, I might want to highlight all activity from Outlook.exe, in addition to all activity in any other processes concerning my %homepath%\Desktop directory - currently this is impossible:
- ...instead, if you were to set two Highlight rules: 1)
ProcessName equals "Outlook.exe"and 2)Path contains "C:\Users\Me\Desktop"then Process Monitor will only highlight rows where Outlook itself touches my desktop. - The same applies to the Include/Exclude Filter criteria.
- It's also unclear what the precedence of Include and Exclude rules are (e.g. if you have only Include rules in your Filter criteria, then are non-matching rows implicitly Excluded, or do I always need an explicit Exclude criteria?)
I appreciate that it would be nontrivial to implement a full GUI Filter Editor (like this) for setting arbitrary AND/OR rules with grouping, and such a UI tends to be tedious to use too, instead I'd be very satisfied if there were a free-form textbox for typing in rules directly, perhaps as C-style expressions or PowerShell-style (akin to Excel's PowerQuery M editor), so my above imagined highlight rule for "Outlook.exe activity - and anything looking at my Desktop" could be entered as:
( Path -contains "\Desktop" ) || ( ImageName -equals "Outlook.exe" )
As a stretch-goal, if it isn't too much to ask, I'd like to be able to have separate, multiple highlight rules, each with their own color.