2

I am using Sysinternals Process Monitor to debug some incoming events and now I am trying to create a filter on Path and using wildcards. What I am trying to use is to filter path which begin with c:\MyApp\MyDocuments\Temp and ends with .pdf

Path filter should look like this: c:\MyApp\MyDocuments\Temp*.pdf

How can I do this?

Willy
  • 9,848
  • 22
  • 141
  • 284

2 Answers2

4

When you have two filters like this:

  • Path begins with c:\MyApp\MyDocuments\Temp
  • Path ends with .pdf

What happens is anything that literally begins with that temp folder is included, and anywhere else a .pdf event is logged is included, so you'll get results you don't want. Stuff like this:

C:\MyApp\MyDocuments\Temp.txt (not a PDF)
C:\Some\Other\Folder\file.pdf (not the folder I want)

The Process Monitor help file explains why the begins with / ends with filters don't work together. From the help file:

Process Monitor ORs together all the filters that are related to a particular attribute type and ANDs together filters of different attribute types. For example, if you specified process name include filters for Notepad.exe and Cmd.exe and a path include filter for C:\Windows, Process Monitor would only display events originating in either Notepad.exe or Cmd.exe that specify the C:\Windows directory.

So because the filter entity is "Path" for both "begins with" and "ends with", Process monitor OR's them, and thus we get the noise we don't want. Here is a filter combo that works the way we want:

  • Path ends with .pdf Include
  • Path excludes C:\MyApp\MyDocuments\Temp Exclude

The "exclude" relation operator behaves like a "does not contain" as far as I can tell. I can't find any specific documentation that lists all of the operators and what they do but that's what it seems. So even though we have two "Path" filters that will get OR'd, because one is Include and the other is Exclude, we get what we're after, which is only PDF's edited in that file path.

holmberd
  • 2,393
  • 26
  • 30
Mikel Saxton
  • 41
  • 3
  • 2
    to rephrase this cleverness for stray thinkers like myself, with **2 Includes** you get unwanted noise because it matches ..Temp **OR** .pdf. Instead, express one criteria as a double negative so you have an **Include and Exclude** which restricts your matches to both ..Temp **AND** .pdf. I have never paid attention to the "excludes" relation before this! Since the question asked for wildcard capability I'll mention that we have a free utility for querying Procmon PML files called viewer9 and [viewer9 supports wildcards](https://viewer9.com/docs/QuerySyntax.htm) – Ben Bryant Sep 09 '22 at 12:42
0

AFAIK, this is not possible. You can just use

begins with c:\MyApp\MyDocuments\Temp and another filter ends with .pdf.

Thomas Weller
  • 55,411
  • 20
  • 125
  • 222