3

Process Monitor allows great power when it comes to filtering, but it doesn't do something which seems extremely simple and beneficial, which is to simply allow the option to remove rows which are nearly the same, and where there can be hundreds or thousands of these rows, and they really complicate trying to find other transactions.

For example, take a look at this image:=

enter image description here

(I censored some info with the red bar, but they're all the same filename).

Wouldn't it be great to be rid of that file ending with .automaticDestinations-ms, even if it's just for the same second's worth of time? It can always allow it again, after a second's worth of transactions has passed.

Here's another example:

enter image description here

Again, I don't want to see Irfanview updating its .ini file 1 zillion times, specifying every single time it locks, queries, reads, writes, unlocks, or whatever else it apparently wants to do.

Is there a way to do remove these duplicates from within Process Monitor, or perhaps there's similar software that can perform this fundamental task on the fly? I don't want to have to manipulate the log file with other software.

To be clear, I only want the duplicates gone, I would still like to see one UNIQUE entry for any of these transactions.

2
+25

Process Monitor contains several summary tools that can help in summing up the activity as regarding the targets. Unlike the main display of Process Monitor, these can at least be sorted on their columns:

Enter image description here

Here for example is the registry summary sorted on the key:

Enter image description here

That is the limit of the tools available using Process Monitor. More advanced tools can only be found outside of Process Monitor, by exporting the data, converting the data file to readable format, and sorting that data while only keeping unique values.

I will be using Excel for doing the sort, but numerous other utilities are also possible.

  1. Save the data in Process Monitor via menu FileSave.... This creates a file with a .PML extension which is in an unreadable proprietary format. Let's call it Logfile.PML.

  2. Use Process Monitor to convert the file to .csv format using:

    "C:\Program Files\Process Monitor\Procmon.exe" /Openlog Logfile.PML /SaveAs output.csv
    
  3. Import the file into Excel:

    • Start an empty workbook
    • Select Data on the ribbon
    • Click From Text
    • Browse for output.csv and click Import
    • In the Text Import Wizard, select Delimited and My data has headers, then click Next
    • Select Comma, then click Next
    • Leave General selected (or if you prefer choose Text)
    • Click Finish
    • Select Existing worksheet and click OK.
  4. Filter for unique values or remove duplicate values for one column:

    • Click on top of the column in question to select the entire column
    • To filter for unique values, click DataSort & FilterAdvanced, choose Unique records only, and click OK
    • To remove duplicate values, click DataData ToolsRemove Duplicates, select Continue with the current selection and click Remove Duplicates...

There are other free utilities that can process .csv files besides Excel, if you don't have it available.

| improve this answer | |
  • Doing it externally from ProcMon like this is the only way, since that tool doesn't include any equivalent built-in functionality. – I say Reinstate Monica Dec 7 '18 at 2:08
  • I'm afraid I was hoping for a live or on-the-fly solution, not one that required extra manipulation from other programs. I've clarified the question thusly. – Dan W Dec 8 '18 at 10:53
  • I have added a discussion of the summary tools, which are the only advanced processing available within Process Monitor. – harrymc Dec 8 '18 at 11:40
  • I checked your amended answer and at first glance, the File Summary window looked great, but unfortunately, the results aren't live, so I had to close and then reopen the File Summary window for updates. Also important columns such as the Time of Day or Image Path are omitted. – Dan W Dec 13 '18 at 10:08
  • That's why an external tool is required for doing more. – harrymc Dec 13 '18 at 10:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.