Processmonitor使用说明.doc

Process 主要功能介绍一、概述此软件主要功能是：监控文件、注册表、进程、网络访问、事件。二、详细功能1、可以显示每条监控记录的详细信息双击指定记录，或者右键-属性就可以查看具体详细信息。2、转到在指定的记录上右键-Jump to可以转到相应的注册表键或者文件上。3、Process Tree进程树显示，Tool-Process Tree(Ctrl+T)，顾名思义，显示进程详细信息，及调用关系。4、活动进程、文件、注册表、栈、网络、引用总结对当前监控的总括描述，通过菜单Tool进入相应功能。二、软件设置1、设置显示的列Options-Select Columns,具体每列代表的意思如下(英文,为了防止歧义这里就不翻译了.Application Details Process Name The name of the process in which an event occurred. Image Path The full path of the image running in a process. Command Line The command line used to launch a process. Company Name The text of the company name version string embedded in a process image file. This text is optionally defined by the application developer. Description The text of the product description string embedded in a process image file. This text is optionally defined by the application developer. Version The product version number embedded in a process image file. This information is optionally specified by the application developer.Event Details Sequence Number The relative position of the operation with respect to all events included in the current filter. Event Class The class (File, Registry, Process) of the event. Operation The specific event operation (e.g. Read, RegQueryValue, etc.). Date & Time Both the date and the time of an operation. Time of Day Only the time of an operation. Path The path of the resource that an event references. Detail Additional information specific to an event. Result The status code of a completed operation. Relative Time The time of the operation relative to Process Monitors start time or the last time that the Process Monitor display was cleared. Duration The duration of an operation that has completed. Process Management User Name The name of the user account in which the process that performed an operation is executing. Session ID The Windows session in which the process that executed an operation is executing. Authentication ID The logon session in which the process that executed an operation is executing. Process ID The Process ID (PID) of the process that executed an operation. Thread ID The Thread ID (TID) of the thread that executed an operation. Integrity Level The integrity level at which the process that executed an operation is running (Windows Vista only). Virtualized The virtualization status of the process that executed an operation (Windows Vista only).2、过滤显示内容Filter-Filter(Ctrl+L),这里的过滤设置很灵活，看下图便知3、高亮度显示指定条件的内容Filter-Highlight(Ctrl+H)，条件的设置跟过滤一样4、清屏和自动滚动清屏Edit-Clear