Process monitor使用说明.docVIP

Process 主要功能介绍 一、概述 此软件主要功能是：监控文件、注册表、进程、网络访问、事件。 二、详细功能 1、可以显示每条监控记录的详细信息 双击指定记录，或者右键-属性就可以查看具体详细信息。 2、转到 在指定的记录上右键-Jump to可以转到相应的注册表键或者文件上。 3、Process Tree 进程树显示，Tool-Process Tree(Ctrl+T)，顾名思义，显示进程详细信息，及调用关系。 4、活动进程、文件、注册表、栈、网络、引用总结 对当前监控的总括描述，通过菜单Tool进入相应功能。 二、软件设置 1、设置显示的列 Options-Select Columns,具体每列代表的意思如下(英文,为了防止歧义这里就不翻译了. Application Details Process Name The name of the process in which an event occurred. Image Path The full path of the image running in a process. Command Line The command line used to launch a process. Company Name The text of the company name version string embedded in a process image file. This text is optionally defined by the application developer. Description The text of the product description string embedded in a process image file. This text is optionally defined by the application developer. Version The product version number embedded in a process image file. This information is optionally specified by the application developer. Event Details Sequence Number The relative position of the operation with respect to all events included in the current filter. Event Class The class (File, Registry, Process) of the event. Operation The specific event operation (e.g. Read, RegQueryValue, etc.). Date Time Both the date and the time of an operation. Time of Day Only the time of an operation. Path The path of the resource that an event references. Detail Additional information specific to an event. Result The status code of a completed operation. Relative Time The time of the operation relative to Process Monitors start time or the last time that the Process Monitor display was cleared. Duration The duration of an operation that has completed. Process Management User Name The name of the user account in which the process that performed an operation is executing. Session ID The Windows session in which the process that executed an operation is executing. Authentication ID The logon session in which the process that executed an operation