Possible bug - Drop Filtered Events not working anymore in Process Monitor 3.70

FlorinToma-7618 16 Reputation points
2021-04-28T13:49:44.59+00:00

Drop Filtered Events is not working anymore in Process Monitor 3.70.
Drop Filtered Events works ok in Process Monitor 3.60.

Behaviour in 3.70: enabling Drop Filtered Events has no effect
Behaviour reproduced in Windows 10 Build 18363.1443 Version 1909
Behaviour also observed on other windows 10 builds and also on win server.

Behaviour can be observed in the UI as following:

  • in 3.60, enabling Drop Filtered Events stops the counter in the status bar.
  • in 3.70, enabling Drop Filtered Events does not stop the counter in the status bar.

Tested on 64 bit.

Filter list used:

92148-2021-04-28-19-16-process-monitor-filter-izexlneocz.png

Sysinternals
Sysinternals
Advanced system utilities to manage, troubleshoot, and diagnose Windows and Linux systems and applications.
1,082 questions
0 comments No comments
{count} votes

4 answers

Sort by: Most helpful
  1. Pavel Yosifovich @MS 11 Reputation points
    2021-04-29T09:24:21.807+00:00

    Unchecking any filter items with a "Result" column should fix it. The problem that results are coming after the operation completes, where new events may have already occurred. We don't currently remove an event which is not the last.
    I will look for ways to improve this.

    2 people found this answer helpful.
    0 comments No comments

  2. clcheles 271 Reputation points
    2021-06-08T09:29:15.71+00:00

    this was solved in latest 3.82

    1 person found this answer helpful.
    0 comments No comments

  3. Claudiu C 1 Reputation point
    2021-05-10T16:31:29.633+00:00

    That's correct @Pavel Yosifovich @MS . this seems to be introduced in 3.70 though as 3.6 and 3.5 don't have this issue.

    0 comments No comments

  4. ssrmm 1 Reputation point
    2021-05-27T19:17:30.393+00:00

    I ran into this as well.

    In addition to the events not being dropped I'm also seeing a performance problem when "Drop filtered events" is enabled while there is a "Result" row in the current filter. I haven't measured anything, but it's really significant. Purely from eyeballing it I would say it's somewhere in the range of two to three orders of magnitude slowdown in this situation!

    0 comments No comments