Procmon Time of Day Incorrect Order

Question

Using Procmon 3.86, if a particular process name is filtered for and there is a long period of time between event entries, new entries will be created at the top of the table rather than the correct location at the bottom. This creates a situation where the time sequence from the top of the table to the bottom can be out of order. There is no way to sort by the time column, so the output is stuck with out-of-order data.

Answer 1

+1

I'm also running into this, and it is especially painful when finally catching a rare event after a couple days of monitoring, but then finding the results scrambled.

I'm concerned that the quality of Sysinternals tools appears to be plummeting as of late.