Use the Exclude Events Before and Exclude Events After options on the right-click menu to filter out the majority of the events. In such cases the problem won't be apparent if only the Waters processes are visible. Press Control-R to reset the filters, then find events some ways before and after the problem occurrence.
#PROCESS MONITOR FILTER SOFTWARE#
In some cases, the problem is not with the Waters software processes themselves but with the OS or anti-malware processes.Some events, such as ACCESS DENIED, are almost always of interest. Double-click on an entry in the table to have procmon filter the entries to that result type. The paths for those entries, the process and usernames involved, and the stack traces in each event are useful in determining whether those entries are relevant to the problem or the cause of the problem. Procmon lists all of the distinct values in the Result column and the number of each result. With a problem log open and filtered appropriately, click the Tools menu > Count Occurrences. Select the Result column in the list and click Count.The point at which the "Problem" log diverges from the known-good log is the likely source of the problem. Step through the known-good and problem log files. The two logs should be similar in their workflow, with some slight differences in paths expected for usernames, machine names, and the like. Open both log files on a machine and apply the same filters in both files (refer again to the process lists for Waters products). If possible, get a procmon trace of the problem, and of the same action on another machine where it's successful.It would most likely be an attempt to access a file, a reg key, or send/receive data on the network. The last event before these events is the most likely suspect for the problem.
#PROCESS MONITOR FILTER SERIES#
Before that event there will be a series of "Thread Exit" events and/or events where the process queries for DLL files. These events can be ignored they are evidence of normal program cleanup by Windows. In many cases, such as normal or abnormal program exits, there will be a Process Exit event. If the problem is reproducible, and the procmon trace was stopped shortly after the issue was reproduced, press control-End to go to the last visible event in the log file.
0 kommentar(er)
