Filters are great but they appear to default to AND logic versus OR logic - why not offer both? Throw up a checkbox and be done with it.

Bruce Wayne 6 Reputation points
2021-03-05T16:59:07.77+00:00

I love the process monitor software. It's great for detailed information. I'm no expert about using it since I have just started recently but it appears to me that the filters are using AND logic where EVERY filter has to be true to display a captured event. I couldn't understand why some events were not being captured. I was just assuming OR logic. Why not offer both as options for the end user? Throw up a checkbox on the filter screen selecting AND or OR logic so that the end user can make their own decisions about the logic to use.

Sysinternals
Sysinternals
Advanced system utilities to manage, troubleshoot, and diagnose Windows and Linux systems and applications.
1,174 questions
0 comments No comments
{count} vote

2 answers

Sort by: Most helpful
  1. Castorix31 86,051 Reputation points
    2021-03-05T17:59:37.527+00:00

    If it used AND, you could not watch several processes...

    For example, this watches mmc OR SystemSettings.exe processes :

    74941-procmon.jpg

    0 comments No comments

  2. David Trevor 306 Reputation points
    2024-10-16T09:44:14.2+00:00

    I think filters on the same column (i.e. two filters on Process Name) operate as logical OR and filters on different columns (i.e. one filter on Process Name and one filter on Path) operate as logical AND.

    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.